Key requirements related to improper payments during the period of our audit were included in IPIA, OMB M-18-20, and OMB Circular A-136. Federal agencies were required to take various steps regarding improper payments under IPIA and as directed by OMB M-18-20. The steps include the following: 1. Review all programs and activities and identify those that may be susceptible to significant improper payments (commonly referred to as a risk assessment), 2. For those programs and activities that agency risk assessments, OMB, or statute identifies as being susceptible to significant improper payments, agencies should develop statistically valid improper payment estimates, as well as analyze the root causes of improper payments and develop corrective actions to reduce them, 3. Report on the results of addressing the foregoing requirements. According to OMB officials, agencies are responsible for maintaining the documentation to demonstrate that these steps, if applicable, were satisfied. Figure 1 illustrates these steps, as well as the major components of conducting an improper payment risk assessment. IPIA required that agencies conduct improper payment risk assessments for all federal programs and activities at least once every 3 years and identify any program or activity that may be susceptible to significant improper payments. OMB M-18-20 provides guidance for implementing the IPIA requirements and covers agencies’ responsibilities for improper payment risk assessments, estimation, and reporting. According to the OMB guidance, agencies must institute a systematic method of reviewing all programs and activities to identify those that may be susceptible to significant improper payments. This systematic method can be a quantitative evaluation based on a statistical sample or a qualitative method, such as a risk-assessment questionnaire. Regardless of which method of review is used, IPIA required agencies to consider seven risk factors during the risk assessment. (See table 1.) OMB is also required to designate a list of high-priority programs for greater levels of oversight and review. The threshold for high-priority program determinations for fiscal year 2018 reporting and subsequent years is $2 billion in estimated improper payments, regardless of the improper payments rate estimate. In addition, OMB may determine that a program is high-priority for reasons other than exceeding the $2 billion threshold. High-priority programs are subject to additional requirements, such as submitting information about semi-annual or quarterly actions taken to reduce improper payments that can be used as a tool for tracking progress. According to OMB M-18-20, another fundamental requirement that agencies must meet is to recover any federal dollars that are a monetary loss to the government, unless legislation specifically prevents such recovery. Specifically, the Improper Payments Elimination and Recovery Improvement Act of 2012 (IPERIA) requires any program that expends at least $1 million during the year to implement payment recapture audits, if cost-effective to the agency, in order to recover improper payments. The requirement to conduct payment recapture audits applies to all agencies regardless of whether they have a program susceptible to significant improper payments. A payment recapture audit is a review and analysis of an agency’s or program’s accounting and financial records, supporting documentation, and other pertinent information supporting its payments, that is specifically designed to identify overpayments. It is not an audit that is performed in accordance with government auditing standards. OMB M-18-20 also states that for high-priority programs the agency shall report any action it has taken or plans to take to recover improper payments and intends to take to prevent future improper payments. If an agency has determined that performing payment recapture audits for any applicable program or activity is not cost-effective, a justification for that determination must be reported. Further, OMB M-18-20 states that agencies should report a justification for that determination through AFRs, Performance Accountability Reports, or in the format required through data requests from OMB. DOE’s 15 field Chief Financial Officers, in cooperation with DOE contracting officers, are responsible for overseeing contractor and other activities in the field, and they assist the OCFO in implementing improper payment reporting requirements. The OCFO issues Annual Payment Integrity Requirements and Guidance that transmits DOE’s instructions for meeting improper payments reporting and recapture requirements prescribed by OMB M-18-20. This guidance includes instructions for completing an attached template for reporting risk assessments and improper payments and payment recapture information. Using this template, 48 payment reporting sites provide information that is the basis for DOE’s department-wide improper payment risk assessment and reporting. These payment reporting sites consist of four types of federal entities and two types of contractors. (See appendix I for more information about DOE’s payment reporting sites.) In addition to the completed template, sites are directed to submit a signed certification that attests to the accuracy of the improper payment information and risk assessment and, if applicable, a justification for why payment recapture audits were not conducted. The OCFO completes a quality assurance checklist for each site and consolidates and reports the data as one program in DOE’s annual AFR. DOE reports on its improper payments 1 year in arrears; meaning, for example, that DOE’s fiscal year 2019 AFR included information on its improper payments identified in fiscal year 2018. In addition to reporting payment recovery information, as required by OMB Circular A-136, DOE has optionally reported some information it collected about improper payments that it identified at the time of the AFR issuance each year for fiscal years 2015 through 2019. (See table 2.) Specifically, DOE reported the amount of improper payments that had been made and identified in the preceding year—not based on a statistically valid estimate of improper payments but, rather, on reported amounts of known improper payments from individual payment reporting sites. DOE also reported improper payment rates that it calculated based on these reported amounts. DOE was not required to report a statistically valid estimate of improper payments in its AFRs because it determined it was at low risk of susceptibility to significant improper payments. See appendix II for additional details about improper payments in the data that DOE collected from the sites. In previous years, DOE reported statistical estimates of its improper payments. Specifically, DOE’s Performance and Accountability Reports and AFRs from fiscal years 2004 and 2007 through 2011 indicated that DOE used statistical sampling to produce projected improper payment estimates for certain payment categories. During these years, DOE reported estimated improper payment rates of less than 1 percent in these categories. However, in 2012 the DOE OIG determined that the estimated improper payment rate presented in DOE’s fiscal year 2011 AFR was not based on a statistical method. According to OCFO officials, DOE discontinued the use of statistical sampling to produce estimates in fiscal year 2012 because it was not required to do so, due to DOE’s determination that it was at low risk for significant improper payments. Since 2012, the DOE OIG has found DOE to be compliant with requirements for improper payment reporting and risk assessments as part of its required review. Specifically, the DOE OIG reported each year that DOE met the requirements for publishing improper payment information in its AFRs and performed the required risk assessments. According to an OIG official, the OIG is not required to perform evaluative procedures to determine the adequacy and completeness of DOE’s risk assessment and reporting in its AFR, and they have not optionally performed these procedures. The DOE OIG and other federal agencies or external audit organizations conduct periodic incurred cost audits and assessments of DOE’s cost- reimbursement contracts. The purpose of incurred cost audits is to determine whether such incurred costs are reasonable; applicable to the contract; allowable under generally accepted accounting principles and cost accounting standards applicable in the circumstances; and not prohibited by the contract, statute, or regulation. If, as a result of these audits or assessments, improper payments are identified—such as reimbursements for costs determined to be unallowable under the contract—DOE will question these costs, indicating that there is a possibility the costs are improper. DOE may then negotiate or otherwise work with the contractor to resolve the questioned costs. Sometimes, this can result in DOE recovering funds. According to DOE’s fiscal year 2019 annual payment integrity requirements and guidance, for the purpose of improper payment reporting, a questioned cost is not deemed an improper payment until it has been determined by the contracting officer to be unallowable. In addition, investigations conducted by DOE OIG, the Department of Justice, and other federal agencies may identify potentially unallowable DOE payments. Upon their resolution, these investigations may find such DOE payments to have been improper. According to OIG officials, improper payments identified through OIG investigations may be recovered through civil or administrative processes, and some of the improper payments identified through OIG investigations may lead to government-run criminal investigations. OCFO officials told us that recovered amounts may differ from the monetary loss associated with the original payments because of fees or fines, among other reasons. IPERIA requires agencies to include all identified improper payments in their reported estimate, regardless of whether the improper payment has been or is being recovered. According to DOE’s fiscal year 2019 annual payment integrity requirements and guidance, if the terms of a settlement require repayment to DOE, then the settlement amount would be considered an unallowable cost. Furthermore, the 2019 guidance states that due to the timing of when a settlement is reached, it is not possible to report these costs as an improper payment in the current year of reporting. Beginning in fiscal year 2018, DOE reported information in its AFR on improper payments made in prior years that were identified for recapture in the current reporting year. For example, in its fiscal year 2018 AFR, DOE reported that $92.69 million in prior years’ improper payments had been identified for recapture in fiscal year 2017. Similarly, in its fiscal year 2019 AFR, DOE reported $14.18 million in prior-year payments identified for recapture in fiscal year 2018. DOE’s reporting sites generally identify prior years’ improper payments identified for recapture through audits and investigations, among other strategies. DOE did not provide information on the years in which the prior-year improper payments were made, and the prior year improper payments identified for recapture were reported separately but not included in DOE’s reported improper payment amount and rate in any of its AFRs. The improper payment amounts that DOE reported in its AFRs for fiscal years 2015 through 2019 may not be accurate or complete and are likely understated, for two key reasons. First, we found that some DOE payment reporting sites did not correctly identify, track, and report their improper payments. Second, DOE reported improper payment amounts and rates for the current year, but did not report that the amounts and associated rates do not include a substantial amount of improper payments that may be identified in the years following the year in which the payment took place. The information in DOE’s AFRs for fiscal years 2015 through 2019 may not be accurate or complete, in part because DOE does not ensure that payment reporting sites correctly identify, track, and report their improper payments to the OCFO. Our review of documentation and interviews with officials at the selected payment reporting sites found some instances in which payment reporting sites’ processes for identifying and tracking improper payments did not always result in accurate and complete financial reporting as required. Specifically, we identified the following errors in reporting improper payments to the OCFO at three of the 10 sites we selected for review: Officials at one site told us that they resolve a portion of their improper payments by adjusting future invoices to account for the error. Site officials told us that in such cases, they do not track or report the amounts to the OCFO as improper payments. While adjusting future invoices is an efficient way to recapture improper payments, not tracking such adjustments as improper payments results in understated improper payments reported to the OCFO. The total amount of the understatement of these improper payments is not known. In addition, the site may have overstated other improper payments. In particular, site officials told us that they were unsure whether some of the annual adjustments from its indirect cost reconciliation process were reported as improper payments, even though OCFO officials told us that such adjustments are routine and are not considered improper payments. This could have resulted in an overstatement of improper payments, but the amount overstated is unknown. Officials at another site told us that they mistakenly included almost $1 million in questioned costs in their fiscal year 2017 improper payment reporting to the OCFO. Because questioned costs are not considered improper until they are determined to be unallowable, this means that the site overstated its improper payments by almost $1 million for that year. Additionally, this site subtracted its underpayments from its overpayments for its fiscal year 2015 reporting, resulting in an understatement of improper payments. Improper payments, regardless of whether they are over- or underpayments, should be added together and not netted, as both amounts are considered improper. Officials at the site told us that these issues had been corrected as of fiscal year 2018. Officials at a third site told us that they do not closely track underpayments and cannot state with certainty that all underpayments are included in the site’s annual improper payments report. The site therefore may be understating its improper payments each year. DOE’s Financial Management Oversight order states that financial management processes must include procedures and methods for ensuring that financial managers provide accurate, relevant financial reporting to customers, such as Congress and OMB. Additionally, federal internal control standards state that management should implement control activities through policies, including documenting policies in the appropriate level of detail to allow management to effectively monitor the control activity. However, not all of the payment reporting sites have fully documented their procedures for correctly identifying, tracking, and reporting their improper payments or ensuring the quality of their data, in part because there was no requirement to do so. Specifically, officials from all 10 selected payment reporting sites we interviewed told us they have procedures for tracking their identified improper payments. However, three of the 10 selected sites had not documented their procedures and two sites had documented some of their procedures but not others, including two of the sites mentioned in the examples above. By requiring payment reporting sites to document their procedures for identifying, tracking, and reporting their improper payments to ensure the quality of their data, the OCFO could better ensure that each payment reporting site maintains consistent procedures and provides comparable information about that site’s improper payments over time. Furthermore, the OCFO cannot ensure that sites are correctly identifying, tracking, and reporting improper payments and ensuring the quality of their data because the OCFO does not have a process to monitor that sites have documented—and are implementing—procedures to do so. The OCFO has taken some steps to help ensure the quality of the improper payments data that the sites report to the OCFO. For example, OCFO officials said they confirm that sites provide accurate information by requiring sites to self-certify the accuracy and completeness of the data, but does not take steps to verify the certification. Further, four of the five contractor payment reporting sites we interviewed told us the DOE field sites that oversee the contractors review the contractors’ submissions before sending the information to the OCFO; OCFO officials told us that the field sites do not formally approve these submissions. Additionally, OCFO staff complete a quality assurance checklist for each site’s submission. The checklist contains a series of questions to determine whether a site has submitted the required documentation and whether certain elements of that documentation are complete. OCFO quality assurance reviews also include simple mathematical checks for internal consistency, such as ensuring that the amount for total identified improper payments is the same across multiple tables. These steps, however, are not sufficient to ensure that sites are correctly identifying, tracking, and reporting improper payments and ensuring the quality of their data. For example, the quality assurance checklist does not include any tests to verify the accuracy of the procedures sites used to generate that data to ensure the sites’ data are reliable. By developing a monitoring process to ensure that payment reporting sites have developed and implemented procedures for identifying, tracking, and reporting their improper payments to the OCFO and ensuring the quality of their data, the OCFO could better ensure that the information it reports about improper payments in its AFR is accurate and complete. The amount of current year improper payments DOE reports in each fiscal year, as well as the improper payment rate DOE calculates based on this amount and reports in its AFRs, is not accurate or complete because it does not disclose that there are additional improper payments that are (1) not identified or that DOE’s OCFO is not aware of until a later date, or (2) potential improper payments that may be identified at a later date. Additionally, DOE does not conduct payment recapture audits, which may identify additional improper payments that could be recovered. DOE identifies many of its improper payments after the end of the fiscal year in which the payments occur and does not identify some improper payments until several years after they occur. These improper payments are identified through processes such as post-payment reviews, audits and assessments, and investigations that do not conclude until after the end of the fiscal year in which DOE made the payments. As a result, there is a known lag in identifying certain improper payments. The current year improper payment amount and associated rate DOE reported in its AFR excludes any improper payments that are identified after the end of the fiscal year in which the payments occurred. For example, in its fiscal year 2018 AFR, DOE reported $32.86 million of current reporting year (fiscal year 2017) improper payments, with an associated improper payment rate of 0.09 percent. In its fiscal year 2018 AFR DOE also reported $92.69 million of improper payments made earlier than fiscal year 2017; however DOE did not disclose that the amount of improper payments originally reported for any prior fiscal year had subsequently increased as a result of improper payments identified after the end of the fiscal year. While it is not possible for DOE to report on the specific amount of improper payments it has not yet identified, DOE also did not disclose in its fiscal year 2018 AFR that it expected to complete audits and investigations in subsequent years that could increase the amount of improper payments reported for fiscal year 2017. See figure 2 for categories of improper payments and the extent to which they are included in DOE’s improper payment amount and rate. Specifically, the OCFO excludes some known improper payments from the annual amount and associated rate it reports in its AFRs for the following reasons: Post-payment reviews may not conclude in the same fiscal year the reviewed payments were made. We have previously found that DOE identifies some improper payments through post-payment reviews. For example, DOE has not required its contractor payment reporting sites—most of which are M&O contractors—to submit invoices before DOE makes payments; instead DOE uses a “payments cleared funding arrangement,” which authorizes the contractors to withdraw funds directly from federal accounts. OCFO officials told us that improper payments made by DOE to contractors without such an agreement would be reported by the responsible federal site, and improper payments made by M&O contractors would be reported by the M&O contractor. DOE policies and procedures do not require that DOE site officials monitor M&O contractor withdrawals to determine the appropriateness of their incurred costs. DOE officials do not review M&O contractor withdrawal of funds to determine the appropriateness of M&O contract costs, and thus can only identify improper payments associated with these contracts through post-payment reviews of contractor costs that may occur after the end of the fiscal year. However, such post-payment reviews, such as monthly or quarterly reviews of invoices, may not identify certain improper payments— including improper payments that occurred late in a given fiscal year—leading DOE to exclude them from their annual reported improper payment amount and associated rate. For example, according to a document describing improper payments that one selected payment site reported to the OCFO, the site identified about $103,000 in fiscal year 2016 improper payments associated with travel during that same fiscal year. Additional reviews of fiscal year 2016 travel payments conducted in fiscal year 2017 identified further improper payments for travel of more than $35,000. Because the contractor identified these additional travel payments as improper through quarterly reviews that did not conclude until after the end of fiscal year 2016, this increase of about 35 percent in the site’s known improper travel payments was not included in the OCFO’s reported improper payment amount or rate for that year. In our March 2017 report, we recommended that DOE help ensure that necessary data are available to employ data analytics—which can identify improper payments more quickly than post-payment reviews can, increasing the likelihood that DOE will include them in its reported amount and rate for each fiscal year—as a tool to perform contractor cost-surveillance activities. Specifically, we recommended that DOE require contractors to maintain sufficiently detailed transaction-level cost data that are reconcilable with amounts charged to the government, including (1) cost data that, at a minimum, represent a full data population; and (2) the details necessary to determine the nature of each cost transaction. DOE disagreed with the recommendation. According to DOE officials, DOE is now developing plans to begin to use data analytics in fiscal year 2021. We continue to believe it is important for DOE to employ data analytics as a cost surveillance tool so DOE can better identify improper payments to its contractors in a timely manner and look forward to reviewing DOE’s plans and actions to address our prior recommendation. Audit coverage of DOE payments is limited, and some audits are not completed until several years after the audited payments were made. As we also found in March 2017, DOE uses incurred cost audits and assessments to identify contractors’ improper payments. However, our review of DOE OIG and other external entities’ audits and assessments of incurred costs for DOE’s 24 largest contractors for this report shows that, historically, these audits are infrequent and may occur several years after the costs have been incurred. For example, our updated analysis shows that as of September 2019, only about $25 billion—or 23 percent—of the nearly $108 billion in costs incurred during fiscal years 2014 through 2018 by DOE’s 24 largest contractors had been audited or assessed (see table 3). Although there is no requirement for how often contractors should be audited, the Contract Disputes Act of 1978 imposes a 6-year statute of limitations for the government to seek recovery of unallowable costs that could be identified through audits. According to our review of DOE reporting and documentation, known DOE improper payments amounts for a given fiscal year can increase in later years as more costs are audited. For example, one payment reporting site reported to the OCFO nearly $164,000 in improper payments made and identified in fiscal year 2017, and OCFO included this amount in the improper payment rate it reported in its fiscal year 2018 AFR. According to site documentation, the same site also identified, as the result of an audit in fiscal year 2017, an improper payment of nearly $920,000 that had occurred in a prior year. This improper payment was substantially more than the total amount of improper payments that the site reported in the fiscal year 2018 AFR. However, because the improper payment occurred prior to fiscal year 2017, the OCFO did not include it in its current year improper payment amount or rate for any fiscal year. For fiscal year 2020, DOE’s OIG has planned several assessments of costs the contractors incurred in prior fiscal years. However, contractor costs the OIG plans to review in the fiscal year 2020 planned assessments were incurred as early as fiscal year 2015. Therefore, any improper payments identified through the planned assessments will not be included in DOE’s reported improper payment rate using the current reporting methods and will instead be included in an overall lump sum amount of prior year improper payments, which has no effect on DOE’s reported improper payment rate. DOE does not track questioned costs centrally, and such costs can take several years to resolve. Audits and assessments can identify questioned costs that require additional review before they are either allowed or deemed improper. In its Semiannual Report to Congress, DOE’s OIG reported nearly $700 million of unresolved, questioned costs identified through its own audits and investigations as of September 30, 2019. Our analysis of the DOE OIG’s reporting found that a substantial portion of questioned costs the OIG identified were ultimately determined to be allowable once they were resolved; however, our analysis also found that DOE has not consistently resolved questioned costs in a timely manner. For example, some of the questioned costs that the DOE’s OIG identified—such as potential state gross receipts tax overpayments of $15.1 million that a DOE payment site made in fiscal years 2010 and 2011—have remained unresolved for nearly a decade. Large amounts of unresolved costs reported by DOE’s OIG add uncertainty about the completeness of the OCFO’s improper payment reporting. Moreover, the nearly $700 million of unresolved questioned costs that the DOE OIG reported does not include questioned costs identified through external audits of non-M&O contractors, such as those conducted by the Defense Contract Audit Agency or nongovernmental entities. Questioned costs identified through these external audits can be substantial, like those the DOE OIG has reported. For example, a 2017 incurred cost audit of a DOE contractor’s fiscal year 2010 costs conducted by an external firm identified nearly $280 million in questioned and unresolved DOE payments to the contractor. In November 2019, DOE officials told us that these questioned payments were resolved when DOE reached a settlement agreement with the contractor. DOE disallowed $34 million of the questioned costs as part of the settlement agreement, according to DOE officials. DOE’s Financial Management Oversight order states that financial management processes must include procedures and methods for ensuring that financial managers provide accurate, relevant financial reporting to customers. DOE customers include Congress and OMB. Additionally, federal internal control standards state that management should implement control activities through policies, including documenting policies in the appropriate level of detail to allow management to effectively monitor the control activity. According to OCFO officials, DOE does not have a mechanism for tracking questioned costs identified through external audits. Instead, OCFO officials said they rely on payment reporting sites to track these costs to resolution. However, the office does not require payment reporting sites to document policies for such tracking. DOE officials from two selected sites told us that their sites do not have policies for tracking questioned costs identified through external audits, including questioned costs that may later be deemed improper. As a result, the OCFO may not be aware of all potentially improper payments identified through external audits or know the status of their resolution. Without a requirement for sites to have policies to track questioned costs to their resolution, the OCFO cannot ensure that payment reporting sites are tracking—and ultimately reporting—all improper payments, and thus cannot ensure that it is including all improper payments in the amount it reports as actual in its AFRs. Investigations that identify DOE improper payments may not conclude until years after the payments were made. Investigations by DOE’s OIG, the Department of Justice, and other federal agencies can also identify DOE improper payments. However, similar to improper payments identified through audits, these improper payments—which can be substantial—may not be identified until years after they occur due to the length of time it takes to investigate and resolve criminal, civil, or administrative cases. For example, in fiscal year 2018, DOE reported $60.6 million of improper payments identified through a fiscal year 2017 settlement with a contractor. DOE made some of these improper payments as early as 2001. Also, in fiscal year 2018, a DOE payment site reported that no improper payments were made or identified in fiscal year 2017, but the site reported a $4.6 million prior-year improper payment associated with a subcontractor’s false claims that were settled with the subcontractor in fiscal year 2017. The OCFO reported these two cases, along with other DOE improper payments identified through investigations, as lump sum prior-year improper payments identified for recapture in its fiscal year 2018 AFR. However, the OCFO did not include these known improper payments in the improper payment amounts used to calculate its improper payment rates for the years in which DOE incurred the disallowed costs. Furthermore, some DOE improper payments are not reported as current or prior-year improper payments because the investigations of the payments were resolved in a manner that prevented DOE from formally considering the payments improper. For example, in 2015, DOE’s OIG reported that a company received a loan guarantee of more than $500 million from DOE after it “provided the Department with statements, assertions, and certifications that were inaccurate and misleading, misrepresented known facts, and, in some instances, omitted information that was highly relevant to key decisions in the process to award and execute” the loan guarantee. The company later declared bankruptcy and did not repay the loan. However, because DOE did not determine this payment to be improper through a legal case or any other process, the $500 million of known monetary loss was not included in DOE’s improper payments reporting in its AFR for any fiscal year. Also, in fiscal year 2017, DOE excluded a six- figure settlement with an outside party from its improper payment reporting. OCFO officials told us that they excluded payments associated with this case from their office’s reporting due to certain aspects of the settlement agreement. DOE’s Information Quality Guidelines state that information disseminated to the public, such as information on improper payments reported in DOE’s AFRs, should be presented in an accurate, complete, unbiased, and clear manner and should be useful to the intended users of the information. As previously noted, agencies with programs that are susceptible to significant improper payments—defined to include improper payments exceeding $100 million in a year—are required to develop improper payment estimates and corrective action plans. However, the OCFO cannot determine whether improper payments in a given year exceeded the $100 million threshold because the OCFO does not track information on the year that payments were made for all known improper payments for a given fiscal year—including improper payments identified in later years through resolution of questioned costs or conclusions of audits or investigations. By tracking information on the year the payment occurred for all improper payments identified, to include those identified in later years, and determining and disclosing in its AFR whether improper payments in a given year exceeded the $100 million threshold, DOE could better inform Congress, OMB, and the public about whether it has made significant improper payments. Additionally, DOE sites perform some payment recapture activities, but does not conduct payment recapture audits, which could identify additional improper payments that could be reported, and potentially recovered. As previously discussed, IPIA required any program that expended at least $1 million annually to conduct payment recapture audits, if cost-effective to the agency, or to provide justification if such audits are determined not to be cost-effective. A payment recapture audit is a review and analysis of an agency’s or program’s accounting and financial records, supporting documentation, and other pertinent information supporting its payments, that is specifically designed to identify overpayments. As such, payment recapture audits are tools to identify improper payments, in addition to an avenue for recovering those overpayments. DOE included a justification for its decision not to conduct payment recapture audits in its AFRs for fiscal years 2015 through 2019. For example, in its fiscal year 2019 AFR, DOE cited its improper payment rate of 0.09 percent and recapture rate of 97 percent to support the department’s determination that it was not cost-effective to perform payment recapture audits. DOE also cited other activities it employed to identify and recapture improper payments, such as prepayment review and approval of invoices, post-payment reviews, contractor internal audits, results of cost allowability audits of integrated contractors, and results from travel audits, among others. The OCFO fiscal year 2018 payment integrity guidance included a list of seven criteria that sites were to use to determine whether payment recapture audits are cost-effective. For fiscal year 2018, 42 of DOE’s 48 payment reporting sites submitted a justification stating that it would not be cost-effective to employ payment recapture auditors. Our review of the 42 justifications found that the quality of the justifications varied by site. We found that 40 of the 42 justifications did not demonstrate consideration of any of the seven criteria in support of their determinations that payment recapture audits would not be cost- effective. One DOE field site’s justification included three bullet points, as shown in figure 3, none of which aligned with the criteria. The OCFO uses a quality assurance checklist to review payment sites’ improper payment reports that includes verifying that the site submitted a justification and that the justification is “adequate.” The checklist does not define “adequate,” and the OCFO approved all of the justifications submitted, even those that did not demonstrate consideration of any of the seven criteria from the payment integrity guidance. DOE’s Financial Management Oversight order states that financial management processes must include procedures and methods for ensuring that financial managers provide accurate, relevant financial reporting to customers. Furthermore, under OMB M-18-20, agencies are required to recover any federal dollars that are a monetary loss to the government, unless legislation specifically prevents such recovery. By clarifying guidance to define the factors for assessing the adequacy of the justifications, and reviewing sites’ justifications for not performing or arranging for payment recapture audits, DOE could better ensure that the justifications it reports have a sound basis and that DOE is not missing opportunities to identify and recover improper payments. Additionally, DOE may be missing opportunities to recover federal dollars that are a monetary loss to the government, as required under OMB M- 18-20, because it has not evaluated whether sites could identify additional improper payments through payment recapture audits. Our analysis of information provided by DOE shows that in fiscal year 2003 the department conducted payment recapture audits and that the improper payments identified through these audits far exceeded the costs of conducting the audits. According to OCFO officials, the information on payment recapture efforts was from a payment recapture audit at one site; it was not an OCFO recovery audit program. The OCFO officials reiterated that the majority of the payment reporting sites have not performed payment recapture audits because they believe existing efforts are effective in recovering identified improper payments. However, payment recapture audits are designed to identify additional improper payments not previously identified. By evaluating whether it could identify enough additional improper payments to make payment recapture audits cost-effective, such as performing audits at a limited number of sites, DOE would have an opportunity to identify and recover additional improper payments or have better information to justify that payment recapture audits are not cost-effective. In its fiscal year 2018 improper payment risk assessment, DOE assessed its risk of susceptibility to significant improper payments as low. However, DOE did not provide sufficient documentation to support how it conducted its risk assessment and made this low-risk determination. Consequently, we could not determine if the process DOE used to perform its improper payment risk assessment provided a reasonable and reliable basis for making its risk determination. DOE’s process to conduct its fiscal year 2018 risk assessment may not be adequate to support its low-risk determination of susceptibility to significant improper payments. DOE has a decentralized process for conducting its statutorily required improper payment risk assessment every 3 years. For fiscal year 2018, DOE developed and provided each payment reporting site with an improper payment risk assessment template to complete. DOE directed all of its payment reporting sites to consider the seven risk factors listed in IPIA, as well as four additional risk factors that DOE developed. Table 4 lists the additional DOE-developed risk factors that sites were to consider in their risk assessments. DOE’s improper payment risk assessment template included a variable scale for rating each of the risk factors. The OCFO provided guidance instructing payment reporting sites to, when populating the template, consider the site’s exposure to the risk factors and to rate them by applying a numerical score to each risk factor. Each payment site totaled its numerical scores to calculate the site’s overall level of susceptibility to significant improper payments. DOE then consolidated all of the payment site assessments into an overall department-wide risk assessment. However, DOE could not explain, and did not provide us documentation to support, its rationale for the variable scales used to score such risk factors in its fiscal year 2018 assessments—both in the 10 payment-site risk assessments we reviewed and in DOE’s department-wide risk assessment—and how the scores assigned for each risk factor affected DOE’s susceptibility to significant improper payments. As a result, we could not determine if DOE’s process for conducting its fiscal year 2018 improper payment risk assessment provided a reasonable basis for DOE’s overall risk determination. Furthermore, the OCFO weighted all of the payment reporting sites equally in terms of overall risk when it aggregated the risk ratings into an overall assessment of susceptibility to significant improper payments. However, DOE did not provide an explanation or documentation of why the sites were weighted equally in the overall department-wide improper payment risk assessment, even though the payment types and dollar amounts of outlays processed by the sites varied widely. For example, a payment site processing $3 million of outlays in fiscal year 2017 had the same weight in the aggregated assessment as a payment site processing $5.7 billion of outlays. Finally, the OCFO did not provide evidence that it considered the known lag in identifying certain improper payments as an inherent risk during its fiscal year 2018 department-wide improper payment risk assessment process. This inherent risk relates to certain limitations affecting DOE’s ability to determine the extent of improper payments until several years after they occur, such as those identified through incurred cost audits and investigations, as previously discussed. For example, in its fiscal year 2018 AFR, DOE reported that a total of $124.35 million in payments were identified for recapture during fiscal year 2017, including $31.66 million made in fiscal year 2017 and $92.69 million made in years prior to fiscal year 2017. However, DOE did not provide us documentation to support how it considered the $92.69 million in improper payments made during years prior to fiscal year 2017—which could represent an inherent risk to the department—when assessing its risk of susceptibility to significant improper payments. As discussed earlier, some of the $92.69 million of improper payments identified for recapture occurred in fiscal year 2016. Thus, the amount of fiscal year 2016 improper payments that DOE reported in its fiscal year 2017 AFR is understated. Federal internal control standards state that management should design control activities to achieve objectives and respond to risks, and should implement control activities through policies. To contribute to the effective design and implementation of such control activities, management should clearly document internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. Additionally, management should periodically review policies, procedures, and related control activities for continued relevance and effectiveness. Further, although OMB does not direct agencies to demonstrate how each risk factor contributes to the agency’s overall susceptibility of risk for significant improper payments, OMB M-18-20 states that if a qualitative method is used during an improper payment risk assessment, it must be designed to accurately determine whether the program is susceptible to significant improper payments. DOE may not have an adequate process to support its risk determination because it did not properly document how it developed and considered risk factors during its fiscal year 2018 risk assessment. Until DOE revises its department-level process for conducting improper payment risk assessments, it cannot ensure that the process produces a reliable assessment of whether it is susceptible to significant improper payments. Specifically, without documenting its rationale for the variable scale used to score risk factors and weighting of the payment reporting sites, and consideration of the known lag in identifying the extent of total improper payments each fiscal year to support the development of its department- level risk assessment, DOE cannot demonstrate that its process for determining its low risk of susceptibility to significant improper payments is reasonable. Addressing these issues may result in DOE determining that it is susceptible to significant improper payments, and therefore subject to additional requirements—such as developing a statistically valid estimate of improper payments and reporting on actions to reduce improper payments, including a description of the root causes, and developing corrective actions to reduce them, including program-specific improper payment reduction targets. We also found that DOE’s OCFO did not sufficiently review the reasonableness of the selected payment reporting sites’ improper payment risk assessments. When we reviewed the risk assessments of the 10 selected sites, we found a lack of consistency in how the sites applied DOE guidance, as well as inadequate documentation supporting how the sites considered improper payment risk factors. Specifically, we found that the OCFO review process did not identify instances in which these sites did not adequately support certain ratings or did not adhere to DOE instructions for completing the improper payment risk assessment template. Staff from the OCFO used a quality assurance checklist to review the sites’ fiscal year 2018 improper payment risk assessments. However, the extent to which the OCFO reviewed documentation supporting payment sites’ risk assessments is unclear. Although the reviewer guidance provided in the quality assurance checklist directs reviewers to ensure that the documentation supporting the payment site’s risk rating adequately supports the risk factor being evaluated, a payment site official told us that OCFO reviewers did not consistently request to view their supporting documentation. Eight out of 10 payment reporting sites we reviewed had documentation to support that they followed DOE’s guidance to consider the results of prior GAO and DOE OIG audit reports and OMB Circular A-123-related assessment results. However, we found that two sites did not have such documentation. One site rated itself as having no significant deficiencies despite audit reports that indicated some deficiencies and findings for that site. Another payment site did not discuss the OMB Circular A-123 assessment results in its improper payment risk assessments, despite OCFO guidance to include such results when conducting improper payment risk assessments. However, quality assurance checklists completed by OCFO staff for these two sites did not indicate that documentation supporting the sites’ consideration of these prior reports and assessments in their risk assessments was missing. Further, five of the 10 payment reporting sites we reviewed did not provide sufficient explanation or documentation supporting their ratings for several of the risk factors they considered in their improper payment risk assessment, despite instructions in DOE’s guidance to do so. For example, one site cited “discussions with team lead” as the primary source of support for its ratings assigned for several risk factors. However, the site did not have documentation to support the results of these discussions and how such discussions supported the ratings for each risk factor. Federal internal control standards state that management should design control activities to achieve objectives and respond to risks, and should implement control activities through policies. To contribute to the effective design and implementation of these control activities, management should clearly document internal controls and other significant events in a manner that allows the documentation to be readily available for examination. We also found that OCFO staff did not document any potential changes to the payment sites’ risk ratings in the 10 quality assurance checklists we reviewed. However, the process to be followed in the event OCFO reviewers find that payment site risk ratings are not reasonable is unclear because DOE has not defined and documented in its policies and procedures the process for OCFO reviewers to override these risk ratings. DOE’s Financial Management Oversight order directs business units to evaluate and assess the effectiveness of their financial management oversight activities and other internal controls, such as the OCFO’s oversight of the payment reporting sites’ risk assessments. Further, the order charges the OCFO with reviewing and analyzing activities throughout DOE to evaluate the adequacy of established policies, procedures, and standards governing accounting and related reporting functions; evaluating the performance of internal controls over those functions; and recommending corrective actions as needed. In addition, according to federal internal control standards, management should also establish and operate monitoring activities to monitor the internal control system and evaluate the results. Such monitoring includes regular management and supervisory activities, comparisons, reconciliations, and other routine actions. Additionally, management should periodically review policies, procedures, and related control activities for continued relevance and effectiveness. Further, federal internal control standards state that management should use quality information to achieve the entity’s objectives. By developing, documenting, and implementing policies and procedures to require OCFO to review documentation supporting payment site risk assessments and define the process for overriding their risk determinations, DOE would enhance its ability to adequately monitor its decentralized improper payment risk assessment process and help ensure the accuracy and reliability of payment reporting sites’ risk assessments and DOE’s assessment of overall risk of susceptibility to improper payments. DOE’s OCFO relies on its 48 payment reporting sites to provide information about improper payments that DOE reports in its AFR; however, we identified several reasons that the information in DOE’s AFRs for fiscal years 2015 through 2019 may not be accurate or complete. First, DOE’s improper payments information may not be accurate or complete because the OCFO does not require the payment reporting sites to document their procedures for correctly identifying, tracking, and reporting their improper payments. By doing so, the OCFO could better ensure that the payment reporting sites provide consistent and comparable information about their improper payments over time. Second, the OCFO cannot ensure that sites are correctly identifying, tracking, and reporting improper payments to the OCFO and ensuring the quality of their data because OCFO does not have a process to monitor that sites have—and are implementing—procedures to do so. By developing such a monitoring process, the OCFO could better ensure that the information it reports about improper payments in DOE’s AFRs is accurate and complete. Third, DOE may not be reporting additional improper payments in the form of unallowable costs claimed by some contractors because, as we have previously found, DOE policies and procedures do not require that DOE sites monitor M&O contractor withdrawals to determine the appropriateness of costs incurred by the contractor. Under this arrangement, DOE does not use prepayment reviews to determine the appropriateness of M&O contract costs and, thus, can only identify improper payments associated with these contracts through post-payment reviews that typically occur after the end of the fiscal year. We previously recommended that DOE ensure data are available to employ data analytics—which can identify improper payments more quickly than post-payment reviews can—but DOE has not fully implemented the recommendation. We continue to believe it is important for DOE to employ data analytics as a cost surveillance tool so DOE can better identify improper payments to its contractors in a timely manner. DOE only includes improper payments that occur and are identified in the same fiscal year in its reported improper payment amount and rate in the AFR. However, DOE does not identify a substantial amount of improper payments in the same fiscal year due to the known lag in identifying such payments. Audits and assessments of DOE’s contractors can identify questioned costs that require additional review before they are either allowed or deemed improper, but DOE has not consistently resolved questioned costs in a timely manner because the OCFO does not direct payment reporting sites to document policies for tracking questioned costs to resolution. Without a requirement for sites to have policies to track questioned costs to their resolution, the OCFO cannot ensure that payment reporting sites are tracking—and ultimately reporting—all improper payments, and thus cannot ensure the accuracy and completeness of improper payments reported in DOE’s AFRs. Additionally, the OCFO cannot determine whether improper payments in a given year exceeded the $100 million threshold because the OCFO does not track information about the year that payments were made for all known improper payments for a given fiscal year. By tracking and disclosing information about all improper payments identified and the year in which these payments were made in its AFR, DOE would have better information to provide to Congress, OMB, and the public about whether it has made significant improper payments. Although DOE’s sites submitted individual justifications for not completing payment recapture audits, the quality of the justifications varied and did not meet DOE requirements. By clarifying guidance to define the factors for assessing the adequacy of the justifications, and reviewing sites’ justifications for not performing or arranging for payment recapture audits to ensure that the justifications meet requirements and are supported by appropriate analysis that considers the costs and benefits of performing the audits, DOE can better ensure that the justifications it reports have a sound basis and that DOE is taking advantage of all opportunities to both identify and recover improper payments, which in turn will help reduce the monetary loss to the government. Further, DOE may be missing opportunities to recover federal dollars that are a monetary loss to the government because it has not evaluated whether sites could identify additional improper payments through payment recapture audits. DOE has concluded that based on its self-assessed low improper payment rate and recapture rate, it is not cost effective to perform payment recapture audits. By evaluating whether it could identify enough additional improper payments to make payment recapture audits cost-effective, such as performing audits at a limited number of sites, DOE would have an opportunity to identify and recover additional improper payments or have better information to justify that payment recapture audits are not cost- effective. Finally, DOE may not have an adequate process to support its risk determination because it did not properly document how it developed and considered risk factors during its fiscal year 2018 risk assessment. Until DOE revises its department-level process for conducting improper payment risk assessments, it cannot ensure that the process produces a reliable assessment of whether it is susceptible to significant improper payments. Further, the process for the OCFO to oversee the accuracy of payment site risk ratings is unclear because DOE has not defined and documented, in its policies and procedures, the process for OCFO reviewers to override a payment site’s risk ratings in the event the reviewer finds that the rating was not reasonable. By developing, documenting, and implementing department-wide policies and procedures, DOE would enhance its ability to adequately monitor its decentralized improper payment risk assessment process and help ensure that individual payment reporting sites accurately score their risk factors—leading DOE to obtain a more accurate and reliable assessment of its overall risk of susceptibility to improper payments. We are making the following nine recommendations to DOE: The Office of the Chief Financial Officer should require payment reporting sites to document their procedures for identifying, tracking, and reporting improper payments to ensure they provide consistent and comparable information about their improper payments over time. (Recommendation 1) The Office of the Chief Financial Officer should develop a monitoring process to ensure that payment reporting sites document and implement procedures that will enable them to correctly identify and report improper payments to the OCFO. (Recommendation 2) The Office of the Chief Financial Officer should require payment reporting sites to document policies for tracking questioned costs to resolution. (Recommendation 3) The Office of the Chief Financial Officer should track information on the year the payment occurred for all improper payments, regardless of when they are identified, and determine and disclose in DOE’s AFR whether the department’s total annual improper payments exceeded $100 million in any given year. (Recommendation 4) The Office of the Chief Financial Officer should clarify guidance to (1) define the factors for assessing adequacy of payment reporting sites’ justifications that conducting recapture audits would not be cost-effective, and (2) require that the Office of the Chief Financial Officer review the sufficiency of these justifications against the criteria defined. (Recommendation 5) The Office of the Chief Financial Officer should evaluate whether payment reporting sites could identify enough additional improper payments through payment recapture audits to make those audits cost- effective, such as by performing audits at selected sites. (Recommendation 6) The Office of the Chief Financial Officer should revise DOE’s department- level process for conducting improper payment risk assessments to include (1) developing and documenting the rationale for the variable scale used to score risk factors and weighting of the payment reporting sites; and (2) documenting DOE’s consideration of the inherent risk associated with the lag in identifying certain improper payments subsequent to the fiscal year they occurred to ensure that the process results in a reliable assessment of whether the department is susceptible to significant improper payments. (Recommendation 7) The Office of the Chief Financial Officer should revise DOE’s department- level policies and procedures for reviewing risk assessments submitted by payment reporting sites to require a review and approval of the documentation supporting these assessments to help ensure the accuracy of the sites’ assessments. (Recommendation 8) The Office of the Chief Financial Officer should revise DOE’s department- level policies and procedures for conducting improper payment risk assessments to define the process for overriding a payment reporting site’s risk determination, when appropriate. (Recommendation 9) We provided a draft of this report to DOE for review and comment. DOE concurred with six of our recommendations and said that it plans to complete actions from November 2020 through December 2021 to address these recommendations. DOE did not concur with three of our recommendations; however, we believe that these recommendations remain valid. DOE’s written response is reproduced in appendix III and summarized below. In addition, DOE provided technical comments, which we incorporated as appropriate. DOE did not concur with our sixth recommendation to evaluate whether its payment reporting sites could identify enough additional improper payments through payment recapture audits to make those audits cost- effective, such as by performing audits at selected sites. In response to this recommendation, DOE stated in its comments that it has an ongoing Fraud Risk Management Working Group and that officials have developed a Fraud Risk Management and Data Analytics Implementation Plan to strengthen DOE’s capability to prevent, identify, and recover improper payments and fraud. However, DOE’s plan is still in draft form, and according to DOE’s technical comments, they will not begin using data analytics until fiscal year 2021. In addition, DOE stated in its comments that existing payment recapture activities such as pre- and post-payment reviews, contractor internal audits, use of the results of cost allowability audits of integrated contractors, and interim and close-out reviews of contracts and financial assistance awards are sufficient. As we discuss in the report, DOE determined that it does not need to conduct payment recapture audits based on justifications submitted by the reporting sites. However, most of the sites’ justifications did not include consideration of the OCFO criteria for making determinations about the cost-effectiveness of conducting payment recapture audits. We continue to believe that by evaluating whether it could identify enough additional improper payments to make payment recapture audits cost-effective, such as by performing audits at a limited number of sites, DOE would have an opportunity to identify and recover additional improper payments or have better information to justify that payment recapture audits are not cost-effective. DOE did not concur with our seventh recommendation to (1) develop and document the rationale for weighting risk factors, including the weighting of all payment reporting sites; and (2) document its consideration of the inherent risk associated with the lag in identifying certain improper payments subsequent to the fiscal year they occurred to ensure that the process results in a reliable assessment of whether the agency is susceptible to significant improper payments. Regarding the weighting of risk factors, DOE said that its risk assessment evaluates the volume and dollar amount of payments by payment category, payments subject to manual controls, and fluctuations in volume and dollar amounts. We recognize that DOE’s risk assessment template asks each site to assess its risk with regard to payment amounts and fluctuations. However, we are recommending that the OCFO document the weighting of all its risk factors, including its decision to consider as equal the risks identified by all sites—regardless of the dollar amount of outlays. While assessing the risk of improper payments at an individual site is important, it does not address the intent of our recommendation. We continue to believe that, because DOE did not properly document how it developed and considered risk factors during its fiscal year 2018 risk assessment, it cannot ensure that the process produces a reliable assessment of whether DOE is susceptible to significant improper payments. Regarding the consideration of inherent risk, DOE stated in its comments that the Payment Integrity Risk Assessment directs payment reporting sites to consider inherent risk as part of DOE’s Internal Control Program. We recognize that sites are to assess the inherent risk that an improper payment may occur. However, even if none of the sites identifies the known lag in identifying improper payments as a risk, based on our review of DOE’s AFRs, this lag is a risk to DOE as a whole. Therefore, we continue to believe that DOE should document in its risk assessment process its consideration of the known lag in identifying improper payments. Finally, DOE did not concur with our eighth recommendation to revise DOE’s department-level policies and procedures for reviewing risk assessments. Specifically, we recommended a policy revision to require OCFO review and approval of documentation submitted by payment reporting sites in support of their risk assessments to help ensure the accuracy of these sites' assessments. DOE stated in its comments that sufficient processes are in place for ensuring the accuracy of payment reporting sites’ risk assessments. DOE also stated that OCFO’s Payment Integrity Guidance instructs payment reporting sites to maintain detailed information supporting risk assessments, which is available to the OCFO and DOE’s auditors upon request, and that review and approval of the documentation occurs during periodic payment reporting site visits by OCFO staff. Further, DOE stated that as part of the OCFO’s quality assurance reviews, the OCFO evaluates the documentation used to support risk assessment ratings and directs updates to risk assessments if documentation listed does not support the stated risk ratings. As we discuss in the report, five of the 10 sites we reviewed did not provide sufficient explanation or documentation supporting their ratings for several of the risk factors. This includes one site that cited “discussions with team lead” as the primary source of support for the ratings it assigned for several risk factors. We continue to believe that by developing, documenting, and implementing policies and procedures to require the OCFO to review documentation supporting payment site risk assessments, DOE would enhance its ability to adequately monitor its decentralized improper payment risk assessment process and help ensure that individual payment reporting sites accurately score their risk factors, leading DOE to obtain a more accurate and reliable assessment of its overall risk of susceptibility to improper payments. We are sending copies of this report to the appropriate congressional committees, the Secretary of Energy, the Administrator of the National Nuclear Security Administration, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact Allison Bawden at (202) 512-3841 or bawdena@gao.gov; or Beryl Davis at (202) 512-2623 or davisbh@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. The Department of Energy (DOE) has 48 payment reporting sites that are responsible for conducting improper payment risk assessments and annually providing data on actual improper payments to DOE’s Office of the Chief Financial Officer (OCFO). The 48 sites consist of six types, four of which are types of federal entities and two of which are types of contractors. The four types of federal entities are Headquarters, DOE field sites, Power Marketing Administrations, and the Federal Energy Regulatory Commission. The two types of contractors are management and operating (M&O) contractor and non-M&O contractor. Table 5 lists the 48 payment reporting sites and provides the fiscal year 2017 outlays and improper payments data they reported to the OCFO for DOE’s fiscal year 2018 Agency Financial Report (AFR). The Department of Energy’s (DOE) Office of the Chief Financial Officer (OCFO) requires the payment reporting sites to provide some details about their improper payments that were not required to be included in the department’s Agency Financial Report (AFR) during the period under review. These details include information about how the improper payments were identified and the reasons why the payments were determined to be improper. As shown in figure 4, two methods accounted for most of the current year improper payments identified by DOE in fiscal year 2017: post-payment review (57.6 percent) and self-reporting (22.1 percent). As shown in figure 5, there was a broader range of reasons payments were determined to be improper in fiscal year 2017, although the majority (54.7 percent) were attributable to settlements as the result of litigation. In addition to the contacts named above, Hilary Benedict (Assistant Director), Michelle Philpott (Assistant Director), Kathy Pedalino (Analyst in Charge),Taya Tasse (Auditor in Charge), Perry Chen, Andy Furillo, Isabella Guyott, Latesha Love, Laura Pacheco, and Farrah Stone made key contributions to this report. Also contributing to this report were Kevin Bray, John Delicath, James Kernen, Jason Kirwan, Dan C. Royer, and Anne Thomas.

Summary: Improper payments—payments that should not have been made or were made in an incorrect amount—are a significant problem in the federal government. Agencies are required to perform risk assessments to identify programs that are susceptible to significant improper payments. House Report 115-697 included a provision for GAO to review DOE's system for tracking improper payments. This report examines the extent to which (1) the amounts reported in DOE's AFRs for fiscal years 2015 through 2019 were accurate and complete, and (2) its fiscal year 2018 risk assessment provided a reasonable basis for its risk determination. GAO reviewed DOE's improper payment reporting for fiscal years 2015 through 2019 and its fiscal year 2018 risk assessment, and reviewed documents and interviewed officials from 10 of 48 reporting sites selected to provide a range of sites and about half of fiscal year 2018 reported improper payments. The improper payments amounts that the Department of Energy (DOE) reported in its annual agency financial reports (AFR) for fiscal years 2015 through 2019 may not be accurate or complete. Agencies with programs that are susceptible to significant improper payments—including those with more than $100 million of improper payments in a year—are required to report statistically valid estimates of their improper payments. DOE determined these requirements did not apply, but optionally reported information on actual improper payments it made and identified in the prior year. For example, in its fiscal year 2019 AFR, DOE reported fiscal year 2018 improper payments—such as those made to contractors for unallowable costs—totaling about $36 million, less than 0.1 percent of its outlays. However, DOE did not disclose that these amounts do not include improper payments identified through reviews, audits, and investigations completed several years after it issues its AFR (see figure). For example, as of September 2019, DOE had not audited $23.8 billion of its $38.5 billion in fiscal year 2018 outlays. Such audits may increase the improper payments in a year by millions of dollars. For example, based on a 2017 audit, DOE identified $34 million in fiscal year 2010 improper payments. DOE does not always track information on the year improper payments were made that would allow it to determine whether improper payments identified later would increase the total to more than $100 million. By tracking and disclosing such information, DOE could better inform Congress, the public, and others about whether it exceeded the $100 million threshold and should be subject to additional reporting requirements. DOE determined that its risk of significant improper payments was low in its fiscal year 2018 risk assessment. However, GAO found that the risk assessment may not provide a reasonable basis for DOE's determination. DOE did not provide sufficient documentation to support that it considered the known lag in identifying improper payments as an inherent risk, nor did it provide sufficient documentation to support its rationale for the scale it used to score risk factors or for weighting risk ratings of payment reporting sites. For example, a payment site processing $3 million of outlays had the same weight in the overall assessment as a payment site processing $5.7 billion of outlays. As a result, DOE cannot demonstrate that its low-risk determination is reasonable and that its risk assessment process produces reliable results. GAO is making nine recommendations to DOE, including to track and disclose information on improper payments identified later and determine whether these payments exceeded $100 million in any year, and to revise its risk assessment process to ensure the process has a reasonable basis and reliable results. DOE agreed with six of the recommendations, but did not agree with three recommendations, including to revise its risk assessment process. GAO maintains that the recommended actions are valid.