The Food and Nutrition Service at USDA is responsible for overseeing the school meals programs at the federal level, which includes issuing regulations and guidance. The school meals programs are administered at the state level by a designated state agency—generally an education or agriculture agency—that issues guidance to school districts providing the meals. School districts are responsible for certifying students as eligible for free or reduced-price meals, providing children with nutritionally balanced meals each school day, and counting and claiming eligible meals for federal reimbursement, among other things. USDA and state agencies also conduct oversight of the school meals programs. Figure 1 summarizes the responsibilities of the different entities within the school meals programs. All students in schools operating the school meals programs may participate in the programs, and eligible students may be certified to receive free or reduced-price meals. Individual students can be certified into the school meals programs either through household application or direct certification. Household application. A household can submit an application that lists all sources of household income and the names of all household members, among other information. School districts compare this information to income-eligibility guidelines to determine whether the student is eligible for free or reduced-price meals. Alternatively, the household can indicate on the application that it participates in certain public-assistance programs—such as the Supplemental Nutrition Assistance Program (SNAP)—or that the student meets an approved designation, which confers categorical (automatic) eligibility for free meals. No documentation to support income listings—such as tax returns or pay stubs—is required at the time of application. Direct certification. Under the direct certification method, data matching is used to identify and certify students who are categorically eligible for free meals. State agencies are required by statute to match student enrollment records against SNAP records and may also match against records for other public-assistance programs or approved designations. Students who are directly certified into the school meals programs are eligible for free meals without a household application. Alternatively, schools can use certain program provisions to serve meals at no charge to all students (i.e., eligibility is not determined for each student individually on an annual basis). Community eligibility provision. Schools and school districts may apply for community eligibility if their percentage of students identified as eligible for free meals without an application—known as the identified student percentage—is at or above 40 percent. Meals served at schools using the community eligibility provision are reimbursed using a formula based on the identified student percentage. Other special provisions. Under these special provisions, schools generally use standard procedures to certify free and reduced-price eligible students and count meals by eligibility category to establish a base year. Following the base year, schools serve free meals to all students and are reimbursed based on the information collected in the base year. USDA reimburses state agencies, which in turn reimburse school districts, for qualifying meals through the process of meal counting and claiming. A meal is reimbursable if it meets federal nutrition requirements and is not reimbursable if it is missing a required food component or fails to meet the meal pattern requirements. Meals are recorded at the point of sale in a school. Generally, individual meals are recorded as either free, reduced price, or paid based on the student’s certification status, unless the school is operating under community eligibility or a special provision. Reimbursable meals are tallied at each school. School districts aggregate meal tallies from each school and then report to the respective state agencies on a monthly basis. State agencies then aggregate the reports from each district and submit tallies of free, reduced-price, and paid meals to USDA. USDA then reimburses states for the amount reported. Meals in each category (free, reduced-price, and paid) are reimbursed at different rates. Given that the school meals programs are administered on a daily basis at schools across the country, USDA officials stated that the agency relies on two key oversight practices—management evaluations and administrative reviews—to monitor these programs. Management evaluations. USDA conducts management evaluations of state agencies’ administration of the school meals programs. USDA uses risk-based criteria, such as the level of turnover in state agency staff, to select the state agencies to review each year. According to USDA officials, starting in fiscal year 2019, USDA will automatically select a state agency for review if it has not been reviewed in the past 3 years. According to USDA guidance, examples of operations it reviews during management evaluations include (1) state oversight of certification and verification of students into the school meals programs, (2) administrative reviews of school districts conducted by state agencies, (3) claims for reimbursement, and (4) state oversight of compliance with federal meal pattern requirements, among other areas. According to USDA officials, if USDA considers state agencies reviewed in one year as high risk for program noncompliance, those agencies may receive an additional management evaluation in the following year focused on technical assistance. Administrative reviews. USDA develops guidance for administrative reviews in which state agencies review school districts’ administration of the school meals programs. State agencies are required to conduct administrative reviews of each of their school districts at least once in a 3-year review cycle. USDA guidance states that the objectives of administrative reviews include identifying noncompliance, providing technical assistance, and assessing fiscal actions. Among other things, state agency staff are to review a school district’s certification records and its meal counting and claiming data for the most recent month for which a claim for reimbursement was submitted. State agency staff are also to review school meals served while the staff are on-site to determine whether the meals contain the required food components. State agency staff are to record any identified noncompliance and also provide technical assistance to school district staff. The Improper Payments Information Act of 2002 (IPIA), as amended, requires agencies to identify, estimate, and report their improper payment amounts and to develop and implement improper payment reduction plans, among other things. USDA estimates improper payments for the school meals programs through a model based on its APEC study, which is conducted by contractors. The most recent APEC study (APEC II) was released in May 2015 and covered activity during the 2012–2013 school year. USDA conducts an APEC study about every 5 years, with APEC III expected to be released in 2020. Conducting the APEC study involves multiple sampling and data analysis efforts, including the following examples from APEC II. In-person surveys. Contractors conducted in-person surveys of over 3,000 sampled households to collect information on each household’s circumstances at the time of application, including income, household size, and receipt of other public-assistance benefits. Using this information, contractors determined a sampled student’s eligibility status and compared it to the school district’s master benefit list and application or direct certification documentation. Data matching. Contractors assessed the accuracy of the identified student percentage—the figure used to determine reimbursement for schools using the community eligibility provision—for over 100 sampled schools. To do so, contactors used an iterative process to match sampled students to SNAP and Temporary Assistance for Needy Families records, as well as additional data sources if necessary. Observation of meal service. Contractors observed approximately 25,000 lunch transactions and 23,000 breakfast transactions at over 400 sampled schools to identify the food items in each meal at the point of sale, whether the meal was served to a student or nonstudent, and whether the meal was recorded as reimbursable. USDA determined that conducting the APEC study annually would not be feasible. Instead, the APEC study includes a model that allows USDA to use program participation data to report estimated improper payment error rates on an annual basis. Changes in program participation data result in small changes to the estimated improper payment error rates USDA reports during years between APEC studies. According to federal standards and guidance, executive-branch agency managers are responsible for managing fraud risks and implementing practices for combating those risks. Federal internal control standards call for agency management officials to assess the internal and external risks their entities face as they seek to achieve their objectives. The standards state that as part of this overall assessment, management should consider the potential for fraud when identifying, analyzing, and responding to risks. In July 2015, GAO issued the Fraud Risk Framework, which provides a comprehensive set of key components and leading practices that serve as a guide for agency managers to use when developing efforts to combat fraud in a strategic, risk-based way. The Fraud Risk Framework describes leading practices in four components, as shown in figure 2. The Fraud Reduction and Data Analytics Act of 2015, enacted in June 2016, requires the Office of Management and Budget (OMB) to establish guidelines for federal agencies to create controls to identify and assess fraud risks and design and implement antifraud control activities. The act further requires OMB to incorporate the leading practices from the Fraud Risk Framework in the guidelines. In July 2016, OMB published guidance about enterprise risk management and internal controls in federal executive departments and agencies. Among other things, this guidance affirms that managers should adhere to the leading practices identified in the Fraud Risk Framework. Further, the act requires federal agencies to submit to Congress a progress report each year for 3 consecutive years on the implementation of controls established under OMB guidance, among other things. It is important to note that fraud and “fraud risk” are distinct concepts. Fraud is challenging to detect because of its deceptive nature. Additionally, once suspected fraud is identified, alleged fraud cases may be prosecuted. If the court determines that fraud took place, then fraudulent spending may be recovered. Fraud risk exists when individuals have an opportunity to engage in fraudulent activity, have an incentive or are under pressure to commit fraud, or are able to rationalize committing fraud. When fraud risks can be identified and mitigated, fraud may be less likely to occur. Although the occurrence of fraud indicates there is a fraud risk, a fraud risk can exist even if fraud has not yet been identified or occurred. For example, suspicious billing patterns or complexities in program design may indicate a risk of fraud. Information to help identify potential fraud risks may come from various sources, including whistleblowers, agency officials, contractors, law-enforcement agencies, or beneficiaries. USDA has reported various actions aimed at lowering the school meals improper payment error rates in its agency financial reports. These actions—including onetime actions and longer-term efforts—cover multiple aspects of the programs. The actions USDA reported included the creation of a new household application prototype intended to reduce applicant errors and the development of training for food service workers to address administrative errors. USDA also reported on mechanisms to collect information on program errors to support agency analysis and monitoring efforts. Examples of the reported actions are illustrated in figure 3 below. Because the study used to develop improper payment error rates in school meals programs—APEC—is conducted about once every 5 years, the effect of these actions is currently unknown. Estimated improper payment error rates reported in years between APEC studies will generally not reflect the effect of most actions until the next study is released. Currently, the next APEC study is expected to be released in 2020. USDA changed what it considers to be an improper payment in the school meals programs for fiscal year 2018 reporting, resulting in improper payment error rates that are not comparable to those of prior years. Specifically, USDA determined that meal claiming errors do not meet the definition of an improper payment. According to USDA, meal claiming errors occur when meals are incorrectly categorized as reimbursable or nonreimbursable at the point of sale. For example, a meal claiming error occurs when a meal that is missing a required meal component (e.g., the required quantity of a vegetable) is counted as reimbursable. USDA officials reported that the rationale for the change in what constitutes an improper payment is that meal claiming error does not result in the payment of federal funds for services that were not provided or that were provided to ineligible recipients. Agency officials also stated that the remedy for meal claiming error is to add the missing food component to the meal, so correcting the error would not reduce program payments. Although the errors will not be considered in determining the reported estimated improper payment error rates, USDA officials stated that the agency is committed to reducing meal claiming error and will continue to measure it as part of its periodic APEC studies. Prior to fiscal year 2018 reporting, meal claiming errors were considered improper payments. As a result, this change contributed to a significant decrease in the estimated improper payment error rates for the school meals programs reported for fiscal year 2018, as shown in figure 4. Accordingly, the results shown for 2015 through 2018 in figure 4 are not comparable. Although USDA considers certain program integrity risks through specific processes, it has not assessed fraud risks in the school meals programs. As a result, USDA cannot determine whether its key oversight processes—extensive efforts designed for broad monitoring purposes— address areas at risk for fraud. The assess component of the Fraud Risk Framework calls for federal managers to plan regular fraud risk assessments and to assess risks to determine a fraud risk profile. Furthermore, federal internal control standards state that management should consider the potential for fraud when identifying, analyzing, and responding to risks. According to USDA officials, fraud in the school meals programs would look the same as nonfraudulent errors. For example, income listed on an application may be misreported intentionally or unintentionally. Consequently, agency officials stated that they have not established a process to plan or conduct a specific fraud risk assessment for these programs. Instead, fraud risks are considered through the agency’s efforts to assess overall program integrity risk in the programs. We have previously reported that integrating fraud risk management into a larger program integrity approach could limit the amount of resources and attention focused specifically on fraud prevention, detection, and response. The deceptive nature of fraud makes it harder to detect than nonfraudulent errors, potentially requiring control activities that are specifically designed to prevent and detect criminal intent. According to agency officials, USDA’s efforts to assess overall program integrity risks in the school meals programs include researching, monitoring, and reporting activities designed to identify areas of program operations susceptible to improper payments and program error. Specifically, agency officials stated that these efforts include research projects—the APEC study used to estimate improper payment error rates and other smaller-scale, informal projects—and a consideration of specific risks when annually determining which states USDA will review through management evaluations. These efforts to assess overall program integrity risk serve specific purposes and are not designed to identify or address fraud risks in the school meals programs. For example, the purpose of one research project mentioned by USDA officials was to identify challenges related to alternative service models for the School Breakfast Program, which include serving breakfast in locations other than a cafeteria and at a later time in the morning. USDA has not developed a process to consider these disparate efforts to comprehensively assess fraud risks. As a result, USDA’s efforts do not align with the overarching concepts of planning and conducting fraud risk assessments in the Fraud Risk Framework. The Fraud Risk Framework identifies leading practices for planning fraud risk assessments. Specifically, the leading practices include tailoring the fraud risk assessment to the program and planning to conduct the assessment at regular intervals and when there are changes to the program or operating environment. The leading practices also include identifying the tools, methods, and sources for gathering information about fraud risks and involving relevant stakeholders in the assessment process. Information to help identify potential fraud risks may come from various sources, including whistleblowers, agency officials, contractors, law-enforcement agencies, or beneficiaries. Existing oversight efforts— such as USDA’s management evaluations and administrative reviews— may also be a useful source, as information on errors and noncompliance may highlight areas at risk for fraud. The Fraud Risk Framework also identifies leading practices for conducting fraud risk assessments, as illustrated in figure 5. Without a process to plan and conduct regular assessments, USDA cannot identify and assess fraud risks facing the school meals programs. Such information is necessary to appropriately design and implement an antifraud strategy—including specific controls like USDA’s key oversight processes—and evaluate and adapt its strategy and controls to improve fraud risk management in these programs. Historically, the school meals programs have reported high estimated improper payment error rates. USDA has reported various steps to reduce the error rates, though a change in what USDA considers an improper payment in the school meals programs resulted in error rates for fiscal year 2018 that are not comparable to those of prior years. Although the two concepts are different, high improper payment error rates may suggest that the school meals programs may also be inherently vulnerable to fraud. However, USDA has not established a process to plan and conduct regular fraud risk assessments for the school meals programs, and existing efforts to assess specific risks in the school meals programs do not comprehensively consider fraud risks. According to leading practices, such an assessment is a pivotal step in managing fraud risks, helping to ensure that USDA’s key oversight efforts are targeted at areas at greatest risk for fraud in these programs, and helping safeguard the government’s substantial investment in them. The Administrator of the Food and Nutrition Service should establish a process to plan and conduct regular fraud risk assessments for the school meals programs that align with the leading practices in the Fraud Risk Framework. (Recommendation 1) We provided a draft of this report to USDA for review and comment. On April 29, 2019, the Director of the Office of Program Integrity for Child Nutrition provided us with the agency’s oral comments on the draft report. FNS officials generally agreed with the recommendation in the draft report. FNS officials noted that the agency does not currently conduct a formal fraud risk assessment, but they explained that the agency considers fraud risks through multiple existing efforts. These efforts include APEC and other studies, as well as key oversight processes. For example, FNS noted that the APEC study aims to identify the factors that contribute to errors in the school meals programs. Officials explained that this study includes an interview of sampled households, in part to determine whether these households underreported income on their applications and whether such underreporting suggests anything about the applicants’ intent. As noted in our report, we agree that these efforts may be a useful source of information on areas at risk for fraud. However, we continue to believe that additional action is necessary to comprehensively assess fraud risks in the school meals programs, consistent with the Fraud Risk Framework. USDA also provided technical comments, which we incorporated into the report, as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the appropriate congressional committees, the Secretary of Agriculture, the FNS Administrator, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix I. In addition to the contact named above, the following staff members made key contributions to this report: Gabrielle M. Fagan, Assistant Director; James M. Healy, Analyst in Charge; and Matthew L. McKnight. Also contributing to this report were Rachel Frisk, Maria McMullen, Jean McSween, and Sabrina Streagle.

Summary: In 2018, almost 30 million children participated in the National School Lunch Program and over 14 million participated in the School Breakfast Program, with cash payments totaling almost $17 billion. Historically, the school meals programs have reported high estimated improper payment error rates, which suggest that these programs may also be vulnerable to fraud. GAO was asked to review improper payment error rates and potential fraud in the school meals programs. This report (1) describes steps USDA has reported taking since 2015 to lower improper payment error rates and (2) examines the extent to which USDA has assessed areas of risk for fraud in the school meals programs. GAO reviewed the results of the most recent study USDA uses to estimate improper payments in the school meals programs, as well as the error rates and actions to reduce them reported in USDA's agency financial reports from fiscal years 2015 through 2018. Further, GAO analyzed guidance for key oversight practices and documentation regarding USDA's risk assessment processes. GAO examined these processes against the leading practices in the Fraud Risk Framework for assessing fraud risks. GAO also interviewed agency officials. The Department of Agriculture (USDA) has reported various actions aimed at lowering estimated improper payment error rates in the National School Lunch Program and School Breakfast Program (school meals programs). Examples include a new application prototype intended to reduce applicant errors and training for food service workers to reduce administrative errors. USDA uses a model based on a periodic study to estimate improper payments, and reported error rates will generally not reflect the effect of most actions until USDA's next study is released, likely in 2020. However, in fiscal year 2018, USDA redefined what it considers an improper payment. Specifically, meal claiming errors—for example, meals that are missing a required nutritional component but that are counted as reimbursable—are no longer considered improper payments, resulting in error rates for fiscal year 2018 that are not comparable to prior years. USDA has not assessed fraud risks in the school meals programs, which hinders its ability to ensure that its key oversight practices—extensive processes designed for broad monitoring purposes—address areas at risk for fraud. The assess component of A Framework for Managing Fraud Risks in Federal Programs (Fraud Risk Framework) calls for managers to plan regular fraud risk assessments and to assess risks to determine a fraud risk profile. USDA officials stated that the agency considers fraud risks through efforts to assess overall program integrity risk in the programs, which include research projects and consideration of specific risks when allocating monitoring resources. However, GAO found that USDA's efforts to assess risk do not comprehensively consider fraud risks. As a result, these efforts are not aligned with the overarching concepts of planning and conducting fraud risk assessments in the Fraud Risk Framework. Establishing a process to plan and conduct regular fraud risk assessments that align with the leading practices in the Fraud Risk Framework—including those in the figure below—will help USDA design and implement an antifraud strategy, as well as evaluate and adapt its strategy to improve fraud risk management in the school meals programs. GAO recommends that USDA establish a process to plan and conduct regular fraud risk assessments for the school meals programs that align with the leading practices in the Fraud Risk Framework. USDA generally agreed with the recommendation.