This section discusses DOE’s use of M&O and non-M&O contracts, cost- reimbursement contracts and cost-surveillance procedures, DOE headquarters and field office responsibilities for cost-surveillance and financial management policies and activities, leading practices for managing the risk of fraud and other improper payments, and data analytic tools and techniques to prevent and detect fraud. Since the Manhattan Project produced the first atomic bomb during World War II, DOE and its predecessor agencies have depended on the expertise of private firms, universities, and others with the scientific, manufacturing, and engineering expertise needed to carry out research and development work and manage the government-owned, contractor- operated facilities where the bulk of the department’s mission activities are carried out. DOE relies on contracts in general, and M&O contracts in particular, to do much of this work. The Federal Acquisition Regulation (FAR) authorizes DOE and other agencies with sufficient statutory authority and the need for contracts to manage and operate their facilities to use the M&O form of contract, but, according to DOE, it is the only agency using such contracts. An M&O contract is characterized both by its purpose and by the special relationship it creates between government and contractor. For example, the FAR recognizes that because of the nature of M&O contract work, or because it is to be performed in government facilities, the government must maintain special, close relationships with its M&O contractors and the contractors’ personnel in various important areas (e.g., safety, security, cost control, and site conditions). DOE’s use of M&O contracts has changed over time. Beginning in the 1990s, DOE undertook a detailed review of the then-existing M&O contracts to determine if the mission requirements remained appropriate for using such contracts. As a result of that review, DOE reduced the number of M&O contracts from approximately 52 to 29 and began using more non-M&O contracts, particularly for its environmental management activities and for some large capital asset construction projects. Although DOE uses fewer M&O contracts today than it did in the 1990s, they remain the primary contract form it uses, in terms of contract spending. In fiscal year 2015, for example, DOE had almost 6,700 non-M&O contracts and 22 M&O contracts. That year, DOE spent almost $19 billion on its M&O contracts—three-quarters of its total $25 billion in spending. Regardless of the contract form used—M&O or non-M&O—the majority of DOE’s contracts are cost-reimbursement contracts. Under cost- reimbursement contracts, the government primarily pays the contractor’s allowable costs incurred, rather than paying for the delivery of an end product or service; the government also pays a fee that is either fixed at the outset of the contract or adjustable based on objective or subjective performance criteria set out in the contract. This type of contract is considered high risk for the government because the primary risk of cost overruns is placed on the government. Cost-reimbursement contracts also require significantly more government oversight than do fixed-price contracts. For example, for cost-reimbursement contracts, the government must determine that the contractor’s accounting system is adequate for determining costs related to the contract and update this determination periodically. In addition, the government needs to monitor contractor costs—known as cost surveillance—to provide reasonable assurance that the contractor is using efficient methods and effective cost controls. By employing cost-surveillance procedures under cost-reimbursement contracts, the government can help ensure that the contractor is performing efficiently and effectively and that the government pays only for allowable, allocable, and reasonable costs applicable to the contract. As we reported in September 2009, federal agencies use a range of procedures for monitoring contractor cost controls. The procedures generally used by the civilian agencies we reviewed called for invoice reviews. Invoice reviews help to ensure that the goods and services for which the government is being billed were actually received, that the amounts billed are allowable, and that the government is not incurring costs that are inadequately supported. In addition, some agencies followed alternative procedures for monitoring costs and supplemented their cost monitoring with audits for the purpose of testing whether invoiced costs are allowable—known as incurred cost audits. The responsibility for establishing policies and performing cost- surveillance activities is split between DOE headquarters and field offices. The following DOE headquarters offices are responsible for establishing department-wide policies and guidance related to cost surveillance and financial management. DOE’s Office of Acquisition Management is responsible for establishing procurement-related policies and guidance. Among other things, the office is responsible for establishing cost-surveillance policies and guidance that help ensure that DOE pays only for allowable, allocable, and reasonable costs applicable to the contract. This includes updates to the DOE FAR Supplement (Department of Energy Acquisition Regulation), DOE Acquisition Letters, DOE procurement related Orders and Directives, and DOE’s Acquisition Guide. According to DOE Order 520.1A, DOE’s Office of the CFO is responsible for establishing, maintaining, and interpreting policy and general procedures for accounting and related reporting. In addition, the Office of the CFO is responsible for establishing policies and guidance for assessing DOE’s internal controls over contractor payments and assessing the risk of fraud and improper payments. Procurement and financial management components at DOE’s field offices are responsible for overseeing DOE contractors to include carrying out cost-surveillance and financial management activities. These include the following officials: DOE contracting officers are responsible for, among other things, determining the allowability of costs incurred by contractors under cost-reimbursement contracts. They are also responsible for ensuring that contract invoices are properly reviewed and analyzed before payment. In exercising this responsibility, a contracting officer may designate other qualified personnel to be the contracting officer’s representative for the purpose of performing certain technical functions in administering a contract, including conducting invoice reviews. DOE’s field office CFOs, in cooperation with DOE contracting officers and other field office staff, are responsible for overseeing contactor costs and conducting other financial management activities, such as internal control and improper payment risk assessments. For example, invoice reviews require close coordination among the contracting officer, contracting officer’s representatives, and the field CFO. In September 2014, we issued revised federal internal control standards that went into effect at the start of fiscal year 2016. These revised standards, along with our Fraud Risk Framework, OMB guidance, and the Fraud Reduction and Data Analytics Act of 2015 have placed an increased focus on the need for federal program managers to take a strategic approach to managing improper payments and risks, including fraud risk. Our Fraud Risk Framework provides comprehensive guidance for conducting fraud risk assessments and using the results as part of the development of a robust antifraud strategy. It also describes concepts and leading practices for establishing an organizational structure and culture that are conducive to fraud risk management, designing and implementing controls to prevent and detect potential fraud, and monitoring and evaluating fraud risk management activities. The leading practices described in the Fraud Risk Framework are meant to provide additional guidance for implementing requirements contained in federal internal control standards and OMB circulars. Our Fraud Risk Framework also states that practices in the Framework are not necessarily meant to be sequential or interpreted as a step-by-step process. The Fraud Risk Framework consists of the following four components: Commit. Commit to combating fraud by creating an organizational culture and structure conducive to fraud risk management. Assess. Plan regular fraud risk assessments and assess risks to determine a fraud risk profile. Design and implement. Design and implement a strategy with specific control activities to mitigate assessed fraud risks and collaborate to help ensure effective implementation. Evaluate and adapt. Evaluate outcomes using a risk-based approach and adapt activities to improve fraud risk management. Each component includes overarching fraud risk management concepts and leading practices for carrying out the concepts. These concepts include creating a structure with a dedicated entity to lead fraud risk management activities; conducting regular fraud risk assessments that are tailored to the program to determine the program’s fraud risk profile; design and implement a strategy to mitigate assessed fraud risks; and designing and implementing specific control activities, such as data analytic activities, to prevent and detect fraud. Leading practices for carrying out the concepts include: Designated antifraud entity. A designated entity to design and oversee fraud risk management activities serves as the repository of knowledge on fraud risks and controls, manages the fraud risk assessment process, and leads or assists with training and other fraud awareness activities. The dedicated entity could be an individual or a team, depending on the needs of the agency. Tailored fraud risk assessments and profiles. An effective antifraud entity tailors the approach for carrying out fraud risk assessments to the program. More specifically, antifraud entities that effectively plan fraud risk assessments identify specific tools, methods, and sources for gathering information about fraud risks. This information includes data on fraud schemes and trends from monitoring and detection activities. This approach allows the agency to develop a fraud risk profile that fully considers the specific fraud risks the agency or program faces, analyze the potential likelihood and impact of fraud schemes, and then ultimately document prioritized fraud risks. Develop and document an antifraud strategy. Managers who effectively manage fraud risks develop and document an antifraud strategy that describes the program’s activities for preventing, detecting, and responding to fraud. Data analytic activities. Data analytic activities can include a variety of techniques. For example, data matching and data mining techniques can enable programs to identify potential fraud or improper payments that have already been awarded, thus assisting programs in recovering these dollars, and predictive analytics can identify potential fraud before payments are made. Fraud awareness initiatives. Increasing managers’ and employees’ awareness of potential fraud schemes through training and education can serve a preventive purpose by helping to create a culture of integrity and compliance within the program. Further, increasing fraud awareness can enable managers and employees to better detect potential fraud. In addition, increasing fraud awareness through training and education of external stakeholders, such as contractors, can help prevent and deter fraud. Our Fraud Risk Framework incorporates long-standing industry practices related to the use of data analytics. In addition to the information included in the Fraud Risk Framework, the Institute of Internal Auditors, the American Institute of Certified Public Accountants, and the Association of Certified Fraud Examiners have issued practice guides and other materials that explain how data analytics can be used to help manage fraud risk. Selected information from these guides is discussed below. According to the Institute of Internal Auditors, data analytics enables an organization to analyze transactional data to obtain insights into the operating effectiveness of internal controls and to identify indicators of improper cost charges, fraud risk or actual fraudulent activities. In addition, because automated checks are less labor-intensive than traditional control mechanisms, such as manual checks, automating data analytic tests can allow managers to monitor large amounts of data more efficiently. Data analytics is used to identify activities or transactions that deviate from expected patterns. It can be used, for example, to review payroll records for fictitious employees or accounts payable transactions for duplicate invoices. The tools and techniques used may vary and range from simple data mining techniques, such as sorting and filtering, to using sophisticated algorithms to analyze multiple data sets. Examples of the type of data analytic tests that can be performed include the following. Calculation of statistical parameters (e.g., averages, standard deviations, highest and lowest values)—to identify outlying transactions that could be indicative of fraudulent activity. Classification—to find patterns and associations among groups of data elements. Stratification of numeric values—to identify unusual (i.e., excessively high or low) values. Joining different data sources—to identify inappropriately matching values, such as names, addresses, and account numbers in disparate systems. Duplicate testing—to identify simple and/or complex duplications of business transactions, such as payments, payroll, claims, or expense report line items. Gap testing—to identify missing numbers in sequential data. Validating data entry dates—to identify postings or data entry times that are inappropriate or suspicious. According to the Institute of Internal Auditors, for fraud detection data analytics programs to be effective, the fraud detection techniques listed above must be performed against full data populations. Although the use of sampling data is a valid and effective audit approach, it is not necessarily appropriate for fraud detection purposes. When only partial data are analyzed, it is likely that a number of control breaches and suspicious transactions will be missed, the impact of control failures may not be quantified fully, and smaller anomalies may be overlooked. It is often these small anomalies that point to weaknesses that can be exploited, causing a material breach. Analyzing the data against full data populations provides a more complete picture of potential anomalies. Random sampling is most effective for identifying problems that are relatively consistent throughout the data population; fraudulent transactions, by nature, do not occur randomly. DOE uses prepayment invoice reviews to monitor the costs of non-M&O contracts but has shortcomings in its control activities at the six site offices that oversee them, as well as resource challenges that limit the effectiveness of these reviews. DOE uses post payment incurred cost audits to detect fraud and other improper payments for both its M&O and non-M&O contracts, but resource constraints and other challenges limit the audits’ effectiveness. DOE uses prepayment invoice reviews to monitor non-M&O contract costs. Under such reviews, non-M&O contractors submit invoices to DOE for items delivered or services performed before the contractors receive payment. Invoice reviews help to ensure that the goods and services for which the government is being billed were actually received, the amounts billed are allowable, and the government is not incurring claimed costs that are inadequately supported. DOE contracting officers are responsible for ensuring that contract invoices are properly reviewed and analyzed prior to payment. In exercising this responsibility, contracting officers may delegate invoice review and analysis functions to other government personnel, such as technical and financial representatives. For the six DOE sites that oversee non-M&O contractors, invoice reviews generally included a technical review—to ensure that the costs billed were for services performed or goods delivered—and a financial review—to ensure that the costs billed conformed with the terms of the contract. However, the control activities at the six site offices that oversee non- M&O contracts have limitations. Specifically, DOE does not have a department-wide invoice review policy or well-documented procedures at most of these site offices, and DOE officials face challenges in reviewing invoices prior to payment. According to federal internal control standards, management should implement control activities through policies. However, officials with the Office of the CFO at DOE headquarters told us that DOE does not have department-wide invoice review policies and procedures. Instead, according to these officials, field CFOs and contracting officials are responsible for developing appropriate invoice review policies and procedures. Headquarters CFO officials said that they provide tools and guidance to field CFOs for things such as assessing internal controls and contractors’ accounting and purchasing systems, but they do not prescribe or assess payment procedures at DOE field offices. Similarly, DOE’s Office of Acquisition Management has issued invoice review guidance but does not prescribe specific policies and procedures. Specifically, DOE’s Acquisition Guide contains a chapter on contract financing that discusses reviewing and approving invoices. The guide states, for example, that prior to payment the responsible approving official must, among other things, ensure that all invoiced costs are allowable and allocable to the contract, items or services included on previously paid invoices are not also included on the current invoice, labor hours are billed at appropriate rates, and all other direct costs have been properly substantiated and are consistent with the requirements in the contract. According to DOE’s Acquisition Guide, however, these are general guiding principles for approving officials to consider when reviewing and analyzing cost elements included in contract invoices; they are not intended to repeat or conflict with local procedures. Unlike other chapters of the guide that contain relevant internal standard operating procedures to be followed by both procurement and program personnel, the invoice review and approval discussion is not considered an operating procedure, according to DOE’s Acquisition Guide. Moreover, our analysis of the invoice review and approval discussion contained in DOE’s Acquisition Guide found that it does not contain the detail necessary to serve as an operating procedure. We have reported previously on DOE’s invoice review policies and procedures at one of DOE’s largest clean-up sites. Specifically, in July 2007 we found that DOE’s Hanford Office was not adequately reviewing invoices for a multibillion-dollar cost-reimbursement contract to design and construct the Hanford Waste Treatment Plant, risking hundreds of millions of dollars in improper payments. Instead, DOE relied primarily on the Defense Contract Audit Agency (DCAA), an independent third party that has traditionally been the primary auditor for non-M&O contracts, to review and approve the contractor’s financial systems and relied on the contractor’s review and approval of subcontractor charges. DOE’s heavy reliance on others, with little oversight of its own, exposed the hundreds of millions of dollars it spent annually on the Waste Treatment Plant to an unnecessarily high risk of improper payments. Our July 2007 report recommended, among other things, that DOE perform an assessment of the risks associated with contract payments and establish appropriate policies and procedures for effective review and approval of the prime contractor’s invoices related to the Hanford Waste Treatment Plant. DOE agreed with the recommendation, and in 2007 the Hanford Office conducted a risk assessment and developed a revised invoice review policy that applies to contractor invoices that it reviews. However, it is not a department-wide policy. In the absence of DOE-wide policy and procedures, the six sites reported following different procedures. As discussed previously, invoice reviews generally include a technical review—to ensure that the costs billed were for services performed or goods delivered—and a financial review—to ensure that the costs billed conform to the terms of the contract. On the basis of questionnaire responses and documents provided by each of the six sites responsible for reviewing non-M&O contractor invoices, we determined that the procedures sites used for the technical and financial reviews varied—with some sites reporting that they used locally developed, site-specific procedures and others reporting that they relied on the general guidance provided in DOE’s Acquisition Guide (see table 1). In addition, on the basis of our review of site office policies and procedures, we determined that five of the six sites did not have well- documented policies or procedures. According to federal internal control standards, management should implement control activities through policies and document them in the appropriate level of detail to allow management to effectively monitor the control activity. Federal internal control standards also state that effective documentation assists in management’s design of internal control by establishing and communicating the who, what, when, where, and why of internal control execution to personnel. However, only one site—the Hanford Office—had detailed, well-documented operating procedures. The invoice review procedures for this site, for example, specified the number of transactions to be reviewed and included step-by-step instructions for selecting the transactions and the transactions’ component items to be reviewed and verified. None of the other sites’ local procedures contained detailed instructions for conducting the reviews. That is, they did not contain the who, what, when, where, and why of internal control execution. Instead, the procedures included general statements such as “the financial reviewer is to perform the necessary financial responsibilities in determining the adequacy of contractor cost invoices” or “the level of review should be based on risk as determined by risk assessment” but did not provide any specific detail or steps on how to perform the reviews. Moreover, several sites referenced DOE’s Acquisition Guide as their invoice review policy or procedure. However, as discussed above, DOE’s Acquisition Guide does not contain the details necessary to be an operating procedure. Without a DOE-wide invoice review policy that requires sites to establish well-documented invoice review operating procedures, DOE management has no assurance that the six offices are effectively conducting invoice reviews or that this control activity is operating as intended. Regarding the capacity and time officials have to devote to oversight duties, including invoice reviews, DOE faces significant challenges. According to a 2013 DOE Acquisition Workforce Study commissioned by DOE, insufficient capacity to properly administer contracts raises the risk of fraud, waste, and abuse, which could result in extra cost and delay. The core challenge facing DOE’s acquisition community, according to the study, is the pervasive lack of sufficient staffing in the majority of DOE field procurement offices. As we have reported previously, having the capacity to perform contractor oversight duties is an important criterion for demonstrating progress toward addressing DOE’s contract and project management challenges—an area we have designated as at high risk for fraud, waste, and abuse. Because contracting officers and their delegates play an important role in ensuring that the government makes payments to contractors only for goods and services received and accepted pursuant to contractual terms, these challenges also impact DOE’s ability to properly review contractor invoices. DOE’s ability to perform comprehensive invoice reviews is also limited by the large number of transactions associated with individual invoices and the limited amount of time DOE has to submit payment after receipt of an invoice. For example, the contractor responsible for the design and construction of the Hanford Waste Treatment Plant submits biweekly invoices for $20 million or more that average over 10,000 transactions each. Upon receipt of the contractor’s invoice, according to the terms of the contract, DOE has 10 business days to submit its payment. Consequently, officials responsible for performing invoice reviews may not be able to determine, prior to payment, if the amounts billed to DOE are allowable. For example, a reviewing official at the Hanford site included a disclaimer on invoices he reviewed, stating that “the appropriateness of the invoiced costs could not be determined in the time allotted.” Given the time constraints associated with prepayment review of invoices, DOE’s Hanford Office also selectively performs post payment invoice review; it is the only one of the six site offices to do so. Specifically, DOE’s Hanford Office selects a non-statistical sample of between 75 and 100 invoiced transactions to review on a quarterly basis after the invoices have been paid, according to the site’s local procedures. Officials from the Hanford Office told us that the items sampled are selected based on risk and that risk is determined based on a variety of factors, such as the results of internal and external audits. Using this approach, the Hanford Office was able to select and review less than 1 percent of the contractor’s costs for fiscal years 2013 through 2015. DOE disallowed a total of $9,078 of the contractor’s invoiced costs as a result of these reviews. For both its M&O and non-M&O contracts, DOE uses post payment incurred cost audits to detect fraud and other improper payments. However, resource constraints limit the effectiveness of these audits. For non-M&O contracts, DOE relies on DCAA to perform audits of contractors’ invoiced costs. However, resource issues and a backlog of audits at DCAA have resulted in audit delays. According to a 2015 DOE OIG report, some of DOE’s non-M&O contracts have not been audited in over 8 years. To try to address the DCAA audit backlog, DOE has used independent public accounting firms, expanded internal audit functions, and relied more heavily on invoice reviews and OIG audits and assessments. However, DOE’s OIG reported that these methods have not been completely effective and do not meet audit standards in some cases. For the 22 M&O contracts DOE had in fiscal year 2015, which accounted for about 75 percent of DOE’s spending, DOE did not perform post payment reviews of contractor costs. We reported in August 2016 that DOE officials told us they were able to monitor the appropriateness of M&O contractors’ withdrawal of funds in near real time. DOE officials said that this was possible because M&O contractors are required to integrate their accounting systems with DOE’s accounts each month, which provides DOE with visibility into contractor accounts. However, with the exception of monitoring aggregate spending to ensure that costs do not exceed budgetary limits, DOE policies and procedures do not require that sites monitor M&O contractor withdrawals to determine the appropriateness of costs incurred by the contractor. Specifically, none of the cost-surveillance policies, procedures, or guidance used by DOE sites discusses real-time monitoring of contractor withdrawals. Moreover, there are logistical issues at some sites that make it unlikely that such monitoring is occurring on a routine basis. According to DOE officials, not all sites have direct access to or visibility into M&O contractors’ systems. For example, to monitor withdrawals, DOE officials at one site said that they would need to gain access to the contractor’s system by traveling to the contractor’s site to obtain information about specific cost transactions. In addition, DOE does not require M&O contractors to submit invoices before receiving payment and instead requires a “payments cleared financing arrangement,” which is the authority for contractors to draw funds directly from federal accounts to pay for contract performance. Under this arrangement, DOE does not use prepayment reviews to determine the appropriateness of M&O contract costs. Moreover, for its M&O contracts, DOE does not use an independent third party to audit contractors’ costs and ensure that invoiced costs are allowable under the contract. Instead, incurred cost audits are performed by the M&O contractors’ internal audit staff under a process known as the “cooperative audit strategy.” Specifically, the M&O contractors’ internal audit organization is responsible for performing operational and financial audits, assessing the adequacy of management control systems, and conducting an audit of the M&O contractors’ incurred cost statements. In addition, M&O contractors are required to conduct or arrange for audits of their subcontractors when subcontracts are structured as cost reimbursement-type contracts, including time and materials and cost reimbursable subcontracts. According to the OIG’s audit manual, under the cooperative audit strategy, each year DOE’s OIG performs an assessment of incurred cost statements for the 10 M&O contractors that incurred and claimed the most costs that year. For the remaining M&O contractors, the OIG performs assessments based on risk. If not considered high-risk, the OIG assesses the contractor at least once every four years. The OIG assessments, however, do not represent independent third-party audits. Although the OIG is an independent third party, according to the DOE OIG audit manual, cost statement work under the cooperative audit strategy is not an audit but instead follows standards for review-level engagements, which are substantially less broad in scope. According to the OIG, the framework of the Cooperative Audit Strategy ensures the integrity and reliability of the review-level engagements by confirming the independence of the M&O internal audit organizations and through various oversite procedures. We did not perform work to substantiate the effectiveness of the OIG’s oversight procedures. DOE’s OIG has reported on the following challenges that impact the effectiveness of both M&O contractor cost audits and subcontractor audits. Regarding M&O contractor cost audits, a 2015 DOE OIG report noted delays in completing audits, and, in some cases, audits that did not comply with professional audit standards. For example, as of the end of fiscal year 2014, there were more than 22 open M&O contractor cost audits with a total of $1.1 billion in unresolved questioned contractor costs. Regarding subcontract audits, from 2010 to 2012, subcontracts valued in excess of $906 million had not been audited or were reviewed in a manner that did not meet audit standards, according to a 2013 OIG report. According to the report, the subcontract costs were not audited because the department did not ensure that its M&O contractors developed and implemented procedures to meet their contractual requirements. As discussed previously, the Fraud Reduction and Data Analytics Act of 2015 establishes requirements aimed at improving federal agencies’ controls and procedures for assessing and mitigating fraud risks and capabilities to identify, prevent, and respond to fraud, including improper payments, through the development and use of data analytics. Implementation of these requirements could help mitigate some of the resource challenges DOE is currently facing in overseeing payments to its contractors. DOE officials told us they plan to meet all requirements for managing the risk of fraud and improper payments, which should include requirements of the Fraud Reduction and Data Analytics Act of 2015. DOE has not used leading practices in its approach to managing its risk of fraud and other improper payments. In particular, DOE has not (1) created a structure with a dedicated entity to lead fraud risk management activities; (2) conducted fraud risk assessments that are tailored to its programs in order to develop a fraud risk profile; (3) documented a strategy to mitigate assessed fraud risks; or (4) designed and implemented specific control activities, such as data analytics, to prevent and detect fraud and other improper payments. The Fraud Reduction and Data Analytics Act of 2015, which Congress passed in June 2016, establishes requirements aimed at improving federal agencies’ controls and procedures for assessing and mitigating fraud risks and directs OMB to establish implementation guidelines that incorporate the leading practices identified in the Fraud Risk Framework. We compared the following leading practices in the standards and guidance of the Institute of Internal Auditors and our Fraud Risk Framework with DOE’s policies and procedures. Dedicated entity to manage fraud risk. A leading practice for managing fraud risk and demonstrating management’s commitment to combating fraud is to designate an entity to design and oversee fraud risk management activities. DOE has not created a structure with a dedicated antifraud entity to lead fraud risk management activities. In August 2015, DOE established its first Chief Risk Officer to advance department-wide approaches to enterprise risk management, which may include fraud risk management. However, the Chief Risk Officer has a broad focus on general risks to the department, and the specific responsibilities of the position have yet to be defined. As a result, it is not clear whether the position will include leading practices related to an antifraud entity’s responsibilities, such as serving as the repository of knowledge on fraud risks and controls, managing the fraud risk assessment process, and leading or assisting with training and other fraud awareness activities. Fraud risk assessments and profile. According to our Fraud Risk Framework, an effective antifraud entity tailors the approach for carrying out regular fraud risk assessments to its programs. This allows the agency to develop a fraud risk profile that fully considers the specific fraud risks the agency or program faces, analyze the potential likelihood and impact of fraud schemes, and then ultimately document prioritized fraud risks. DOE has not conducted fraud risk assessments that are tailored to its programs and that would allow the department to create a fraud risk profile, which is considered a leading practice for managing the risk of fraud. In March 2016, DOE revised its internal control evaluation guidance with the stated purpose of updating its focus on the identification of improper payment risks and fraud risks, among other things. According to DOE’s revised guidance, DOE updated its internal control assessment tools to allow its offices to identify and manage fraud risks. DOE provided us with a list of fraud risks that they had identified for fiscal year 2016 using the revised assessment tools. Examples of risks identified include statements such as “if costs are inaccurately reported, then mischarging could occur, impacting budgets and financial statements” and “if requisitions are not approved by the appropriate personnel, then inappropriate purchases may be made.” DOE’s approach was not tailored to DOE programs; instead, it provided all sites with the same list of potential risks. According to our Fraud Risk Framework, an effective antifraud entity tailors the approach for carrying out fraud risk assessments to the program. More specifically, antifraud entities that effectively plan fraud risk assessments identify specific tools, methods, and sources for gathering information about fraud risks. This information includes data on fraud schemes and trends from monitoring and detection activities. Because DOE’s approach to assessing its fraud risk is not tailored to its programs, DOE is not positioned to determine each program’s fraud risk profile. Strategy to mitigate fraud risk. Managers who effectively manage fraud risk, according to our Fraud Risk Framework, develop and document an antifraud strategy that describes the program’s approach for addressing the prioritized fraud risks identified during the fraud risk assessment. An effective antifraud strategy describes the program’s activities for preventing, detecting, and responding to fraud. DOE has not developed or documented a DOE-wide antifraud strategy or directed individual programs to develop program-specific strategies, according to DOE officials. As discussed previously, federal internal control standards require managers to design a response to analyzed risks. Managers should consider the likelihood and impact of the risks, as well as their defined risk tolerance. These are key elements of a program’s fraud risk profile. According our Fraud Risk Framework, effective managers of fraud risks use the program’s fraud risk profile to help decide how to allocate resources to respond to fraud risks. Specific control activities to prevent or detect fraud or improper payments. Managers who effectively manage fraud risks design and implement specific control activities, such as fraud awareness and data analytic activities, according to our Fraud Risk Framework. DOE has not designed and implemented specific control activities to prevent and detect fraud and other improper payments. Of the 10 field offices responsible for overseeing contractor costs, none required employees responsible for reviewing contractor costs to attend fraud awareness training. Moreover, DOE does not routinely use data analytic techniques. Data analytics is a type of control activity that can be effective in detecting fraudulent spending or other improper payments. Of the 10 field offices responsible for reviewing contractor costs, officials from 4 reported in their questionnaire responses that they employed data analytic techniques to help detect fraudulent or other improper costs in contractor invoices or charges. On the basis of the description of the specific data analytic methods they reported using, we determined that only one field office—the Hanford Office— had reported that it was performing analysis that could be considered data analytics. According to their response to our questionnaire, officials at the Hanford Office reported that they use data trending, risk matrixes, cost data graphing, and key word searches to look for anomalies. However, Hanford officials did not provide documentation to illustrate their use of these data analytic techniques as we had requested. In addition, the office’s invoice review procedures do not discuss the application of the data analytic techniques Hanford officials reported using. As a result, we could not substantiate the site’s reported use of data analytic techniques. We discuss the use of data analytics in more detail in the next section. According to DOE officials, they do not use leading practices for managing the department’s risk of fraud because they consider the risk of fraud to be low. DOE officials told us that, unlike other federal agencies, DOE is not at the highest risk for fraud and improper payments and therefore cannot be expected to commit the resources necessary to independently identify, evaluate, adapt, and implement private industry leading practices. According to DOE officials, “a lack of widespread implementation of private sector fraud prevention and detection leading practices at DOE is not indicative of a management failure to appropriately manage the risk of fraud.” These officials told us that DOE manages the risk of fraud and improper payments through its internal controls program; DOE OIG efforts to prevent, detect, and make recommendations related to fraud; and implementation of requirements of the Improper Payments Elimination and Recovery Act. DOE’s approach for managing its risk of fraud and improper payments, however, may not be sufficient. According to the DOE OIG’s Fiscal Year 2015 Performance Report and Fiscal Year 2016-2017 Performance Plan, the opportunity for fraud to occur or exist within various department programs is significant. Moreover, given that DOE has not conducted fraud risk assessments that are tailored to its programs, it is unclear how DOE officials reached the conclusion that the department’s risk of fraud is low. As discussed previously, the deceptive nature of fraud makes it difficult to measure in a reliable way. For example, the alleged fraudulent activity discussed previously, which involved contractors at DOE’s Hanford site and resulted in a $125 million settlement, was identified and reported by whistleblowers. It was not prevented or detected through any strategic fraud risk management effort on DOE’s part. In the absence of such a framework, DOE has little assurance that the types of conduct reported by these whistleblowers are not widespread. The leading practices contained in our Fraud Risk Framework are designed to help federal program managers take a more strategic approach to assessing and managing fraud risks. Although our Fraud Risk Framework may be new to DOE and other federal agencies, many of the leading practices contained in it are based on long-standing industry practices. Other frameworks and guides related to fraud risk management and integrity have existed for some time, including publications by the Institute of Internal Auditors, American Institute of Certified Public Accountants, and Association of Certified Fraud Examiners, as well as the Australian National Audit Office, the Committee of Sponsoring Organizations of the Treadway Commission, and the Organisation for Economic Co-operation and Development. The Fraud Risk Framework allows for flexibility in how these leading practices are implemented. Effectively mitigating fraud risks by adopting these leading practices can help DOE to meet its mission by helping to ensure that funds are used only for approved purposes. DOE officials told us that they plan to meet the requirements of the Fraud Reduction and Data Analytics Act of 2015 but should not be expected to implement private industry leading practices prior to the issuance of OMB guidance. Without implementing these selected leading practices for managing its risk of fraud, DOE is missing an opportunity to better position itself to meet the requirements of the Fraud Reduction and Data Analytics Act of 2015 and to organize and focus its resources in a way that would allow the department to mitigate the likelihood and impact of fraud. Without a dedicated entity within DOE to design and oversee fraud risk management activities, DOE is missing an opportunity to create a structure that is more conducive to fraud risk management. Without tailored risk assessments that result in an accurate fraud risk profile, DOE is not equipped to understand its fraud risk and take steps to mitigate it. Because DOE has not developed and documented an antifraud strategy that describes its programs’ approaches for addressing fraud risks, DOE is missing an opportunity to allocate resources more effectively to respond to fraud risks. Because DOE has not designed and implemented specific control activities, such as fraud awareness training and data analytics, it does not have assurance that its managers and employees are fully aware of potential fraud schemes. Such awareness can enable managers and employees to better detect potential fraud. Moreover, DOE is missing an opportunity to allow managers to monitor large amounts of data more efficiently. Finally, because DOE has not employed data analytics, and therefore has not benefitted from the experience of designing, implementing, and improving its analytic procedures, the department is not well positioned to implement the requirements of the Fraud Reduction and Data Analytics Act of 2015. In applying data analytics to identify potential indicators of fraud or other improper payments associated with selected DOE contracts, we found that much of the cost data we requested from two DOE contractors for the purpose of performing data analytics was not suitable for analysis. The data were not suitable either because they were not for a complete universe of transactions that was reconcilable with amounts billed to DOE or because they were not sufficiently detailed. Sufficiently detailed data include identifiers such as transaction date, dollar amount, item or service description, and transaction codes to indicate the type of cost represented (e.g., construction materials, property lease, and office supplies). However, for those subsets of DOE contractor data that were complete and sufficiently detailed, we were able to apply data analytics, and we identified potential indicators of improper charges that could be used to guide further investigation of these charges. Much of the transaction-level cost data for fiscal years 2013 through 2015 that we requested from one M&O contractor and one non-M&O contractor were not suitable for use with data analytic techniques. We requested data from two contractors—the M&O contractor that operates Sandia National Laboratories and the non-M&O contractor responsible for the design and construction of the Hanford Waste Treatment Plant. The M&O contractor at Sandia, however, was unable to produce a full data population of sufficiently detailed transaction-level data for any of the over $8 billion in costs it incurred and claimed during the 3-year time frame we examined (see fig. 1). More specifically, the contractor was unable to provide data files that could be used to compile a data set in which the total of all cost transactions could be reconciled with the total amount paid by DOE. According to representatives of the M&O contractor and documents they provided, the contractor’s core accounting system generates financial information for both internal and external use through the use of project accounting and general ledger modules. Specifically, the contractor’s project accounting module generates information for internal management use, and the general ledger module generates information for external reporting purposes. However, neither the project accounting nor the general ledger module contains transaction-level cost data suitable for data analytics (see app. II for more detail on issues with the data provided by the M&O contractor). Having a data set that reconciles with the amount charged to the government is important because it ensures that the data set represents a complete universe of cost transactions. Regarding the non-M&O contractor, we requested and received a data set of cost transactions for the nearly $1.8 billion it charged DOE over the 3-year period. Of the nearly $1.8 billion in costs, $1.342 billion were sufficiently detailed for the purpose of employing data analytics (see fig. 1). However, about $437 million in subcontractor costs were not sufficiently detailed. Payments to subcontractors accounted for almost 25 percent of all expenses billed by the non-M&O contractor to DOE for this period, but these transactions did not contain specific information regarding the types of services or materials purchased from the subcontractor. Without detailed cost data for the entire population of subcontractor-related costs, analyses of these costs were not possible. According to DOE officials, they review most types of costs as part of their quarterly post payment invoice review process. However, our analysis of all costs DOE sampled and tested from fiscal year 2013 through 2015 found that DOE sampled about 1 percent (50 transactions totaling $3.7 million) of the nearly $437 million in subcontractor-related costs. As discussed previously, fraudulent transactions, by nature, do not occur randomly and, therefore, are not effectively identified through sampling. When only partial data are tested, it is likely that a number of control breaches and suspicious transactions will be missed, the impact of control failures may not be quantified fully, and smaller anomalies may be overlooked. It is often these small anomalies that point to weaknesses that can be exploited, causing a material breach. Of the nearly $10 billion of costs these two contractors incurred during fiscal years 2013 through 2015, only $1.3 billion was suitable for analysis using data analytic techniques. (See fig. 1.) DOE has not required that these contractors maintain sufficiently detailed transaction-level cost data that are reconcilable with amounts charged to the government. Under federal internal control standards, managers should use quality information to achieve the entity’s objectives. To do this, managers may identify information requirements, obtain relevant data from reliable internal and external sources, and process data into information that is appropriate, current, complete, accurate, accessible, and provided on a timely basis. In addition, as discussed previously, the Fraud Reduction and Data Analytics Act of 2015 established new requirements aimed at mitigating fraud risk through the development and use of data analytics, among other things. Without requiring contractors to maintain sufficiently detailed transaction-level cost data that are reconcilable with amounts charged to the government, DOE will not be well positioned to meet the requirements of the Fraud Reduction and Data Analytics Act of 2015. Using simple analytic techniques (such as sorting and classifying), we reviewed costs charged to DOE for fiscal years 2013 through 2015 by the non-M&O contractor and identified indicators of potential improper cost charging that could be useful to guide further investigation of these charges. The purpose of employing data analytics was to identify costs that appeared unusual or out of the ordinary. Unusual costs are not necessarily fraudulent or improper but instead serve as red flags or possible indicators of improper cost charging that may warrant further review. Using data analytics, we identified unusual costs that we believe warrant further review by DOE. Examples of the costs we identified include the following. Relocation and temporary assignment costs. We identified employee permanent relocation and temporary assignment costs of nearly $26 million for the 3-year period we examined. In total, these costs were spread across 16 different cost codes in the other direct cost and labor files and seemed high. Furthermore, in reviewing the cost transactions associated with these 16 different cost codes, we identified a subset of transactions totaling $7.8 million that were unusual because they appeared to be per-diem payments but were not directly tied to an individual employee—an attribute normally associated with per-diem payments. Specifically, the transactions we identified were weekly lump-sum payments—averaging about $50,000 weekly—that were coded “temporary assignment per-diem paid by payroll.” None of the transactions contained information necessary to link them to the individual employees receiving payment. We also identified other transactions totaling over $2.5 million that were unusual because they did not appear to be reimbursements to employees for relocation expenses, but instead appeared to be relocation bonuses. For example, 68 payments of $25,600 each (total about $1.741 million) and 34 payments of $19,300 each (total about $656,000) were made to individual, named employees. Each transaction was connected to a permanent relocation and temporary assignment cost code and contained the cost description “miscellaneous other payments or reimbursements.” Christmas Day purchases. We identified four purchases of varying amounts ($400, $137, $81, and $11) totaling over $600 that were made from Amazon, an online retailer, on Christmas Day. There may be a valid reason for purchases that occur on a holiday, but in general, holiday purchases are considered red flags and should be scrutinized. Payments to an affiliate. We identified 455 affiliated subcontractor transactions totaling over $6.8 million. Specifically, these transactions reflect costs charged to DOE for services provided to the non-M&O prime contractor by a subcontractor that was affiliated with the prime contractor. The subcontractor, according to its website, is responsible for, among other things, monitoring supplier quality and on-time delivery for the prime contractor’s projects. Given the affiliation between the prime and subcontractor, additional scrutiny may be needed to ensure that goods and services provided by the subcontractor affiliate are competitively priced. Labor costs. We identified nearly 10,000 transactions totaling over $241 million in payroll costs that were included in the “other direct costs” data file instead of the labor cost data file. These transactions did not contain an earnings code (a code that indicates the type of cost, such as “straight time,” “overtime,” or other type of labor expense) that is typically assigned to labor costs. In July 2016, we provided the results of our analysis to DOE Hanford site officials, and in August 2016 we provided additional detailed information on our methodology to allow them to replicate our analysis. DOE Hanford site officials initially declined to respond to our questions about the results of our analysis. However, in December 2016, they provided a written response to our November 30, 2016, request to confirm facts about the data in which they disagreed with our observations and analysis and provided explanations for the cost charges we identified. Their specific explanations follow. Regarding relocation and temporary assignment costs, according to the Hanford site’s written response, appendix A of the Hanford Site Stabilization Agreement establishes daily travel pay rates for construction employees. The lump-sum per-diem payments totaling $7.8 million were “travel-to-the-site payments,” which are authorized by the Hanford Site Stabilization Agreement and are charged to DOE in lump-sum amounts because charging for individual (or daily) trips for hundreds of workers would be too onerous and inefficient. The transactions totaling over $2.5 million, which were identified as “miscellaneous other payments or reimbursements” were “living- away-from-home-option” costs, which are consistent with the Advance Understanding on Costs agreement that DOE has with the contractor. The site’s written response also states that Hanford officials expected relocation and temporary assignment costs to be significant because the Advance Understanding on Costs agreement authorizes these significant costs. As evidence that these charges were appropriate, Hanford officials provided us with a copy of the Advance Understanding on Costs agreement and the Hanford Site Stabilization Agreement. Hanford officials did not provide other documentation to support the appropriateness of these charges, and it is unclear how the site can substantiate per-diem payments if they are not associated with individual employees. Regarding the Christmas day purchases on Amazon, according to the written response, the contractor’s accounting software, which uses batch processing, generates transaction posting dates that may appear to be on a holiday when in fact the purchases were made before the holiday. For example, the transaction date for the Amazon purchases we identified was December 25, but these purchases were actually made on October 29 and November 4, according to the documentation DOE provided. However, DOE did not provide information regarding how it might isolate holiday purchases, given that transaction dates in the contractor’s system did not necessarily reflect the date of purchase. On the basis of our review of the site’s invoice review procedures, the Hanford Office does not specifically target for review transactions that fall on or around holidays. Moreover, if the contractor’s use of batch processing overrides the transaction date of a purchase, it is unclear how DOE can reliably determine the validity of costs charged to the government. Regarding each of the cost categories we identified, according to its written response, the Hanford Office has reviewed each of “these type” of expenses as part of its post payment invoice review process and found them to be proper. However, our review of all the transactions the Hanford Office reported sampling and reviewing for fiscal years 2013 through 2015 found that the Hanford Office had reviewed very few of the transactions we identified through our use of data analytics. Specifically, as part of its regular selective invoice reviews, the Hanford Office reviewed 4 relocation and temporary assignment transactions identified as “miscellaneous other payments or reimbursements,” 4 of the subcontractor affiliated transactions, and 1 of the nearly 10,000 payroll cost transactions that were included in the “other direct costs” data file instead of the “labor” file. The Hanford Office did not review any of the $7.8 million in lump-sum per-diem payments or the Christmas Day purchases on Amazon. In addition to the costs we identified above, we had initially identified $2 million in costs for equipment depreciation expenses billed to DOE that we thought were unusual until DOE officials provided us with information that clarified our understanding of the contractor’s data. Specifically, DOE officials explained that the entire description of the account we were examining was “depreciation or purchase” and that, in response to our observations, the Hanford office reviewed two transactions from this account and found that they were purchases and not depreciation. Although DOE’s clarification resolved our initial reason for flagging these costs, the new information raised other questions regarding the use of a single cost code to track dissimilar costs. The FAR requires that costs be allowable, reasonable, and allocable to the contract. Unless contractor costs are submitted in a manner that allows DOE to distinguish between depreciation expenses and purchases without having to review every cost submitted under a single cost code, it is unclear how DOE can ensure that costs are allowable and allocable. In addition, the contractor’s use of a single cost code to track dissimilar costs undermines DOE’s ability to identify potentially improper cost charges using data analytics. Data analytics, as discussed previously, enable an organization to analyze transactional data to obtain insights into the operating effectiveness of internal controls and to identify improper cost charges, indicators of fraud, or actual fraudulent activities. Because automated checks are less labor-intensive than traditional control mechanisms, such as manual checks, automating data analytic tests can allow managers to monitor large amounts of data more efficiently. Regarding the usefulness of performing data analytics, DOE officials told us that a data analytic analysis would not be cost-effective because it produced too many false positives—that is, unusual transactions that are later determined to be legitimate. In addition, they said that until recently there was no requirement to perform data analytics and, because it has not been required, they have not devoted the time or manpower to developing and implementing data analytic tools and techniques. DOE officials said that they agreed that our review may have helped identify how the use of data analytics can be expanded at DOE but said that performing data analytics would require DOE to complete “other steps” in our Fraud Risk Framework before deciding to design and implement additional analytics. However, practices in the Fraud Risk Framework are not necessarily meant to be sequential or interpreted as a step-by-step process. According to the Fraud Risk Framework, effective fraud risk managers collect and analyze data on identified fraud trends and use them to improve fraud risk management activities. For instance, managers may revise data analytic tests based on identified fraud schemes to better identify these schemes in the future. However, because DOE has not employed data analytics, as discussed previously, the department has not benefitted from the experience of designing, implementing, and improving its analytic procedures. As a result, the department is not well positioned to implement the requirements of the Fraud Reduction and Data Analytics Act of 2015. DOE’s approach to managing its risk of fraud and other improper payments relies on traditional cost-surveillance procedures, which include prepayment invoice reviews for its non-M&O contracts and post payment incurred cost audits for both its M&O and non-M&O contracts. The effectiveness of DOE’s approach, however, is hampered by shortcomings in control activities (policies and procedures). Without a department-wide invoice review policy or well-documented procedures, DOE management does not have assurance that invoice reviews are being performed or that these control activities are operating as intended. In addition, DOE has not used leading practices in its approach to managing its risk of fraud and other improper payments. In particular, DOE has not (1) created a structure with a dedicated entity to lead fraud risk management activities; (2) conducted fraud risk assessments that are tailored to its programs in order to develop a fraud risk profile; (3) developed and documented a strategy to mitigate assessed fraud risks; or (4) designed and implemented specific control activities, such as data analytics, to prevent and detect fraud and other improper payments. Without implementing these selected leading practices for managing its risk of fraud, DOE is missing an opportunity to organize and focus its resources in a way that would allow the department to mitigate the likelihood and impact of fraud. Finally, in applying data analytics to data from selected DOE contracts, our work demonstrated that with complete data that are sufficiently detailed, data analytics can be used to efficiently and more comprehensively monitor contractor costs. However, much of the cost data we requested from one DOE contractor and some data from the other were not sufficiently detailed for applying data analytics. DOE has not required that its contractors maintain sufficiently detailed transaction- level cost data that are reconcilable with amounts charged to the government. Without requiring contractors to maintain such data— including cost data that, at a minimum, represent a full data population and contain the details necessary to determine the nature of each cost transaction—DOE will not be well positioned to meet the requirements of the Fraud Reduction and Data Analytics Act of 2015 and employ data analytic techniques as a means to more efficiently monitor contractor costs and manage its risk of fraud and other improper payments. We recommend that the Secretary of Energy take the following six actions. To allow DOE management to effectively monitor invoice reviews and have assurance that this control activity is operating as intended, establish a DOE-wide invoice review policy that includes requirements for sites to establish well-documented invoice review operating procedures. To help DOE take a more strategic approach to managing improper payments and risk, including fraud risk, implement the following leading practices for managing the department’s risk of fraud: create a structure with a dedicated entity within DOE to design and oversee fraud risk management activities; conduct fraud risk assessments that are tailored to each program and use the assessments to develop a fraud risk profile; develop and document an antifraud strategy that describes the programs’ approaches for addressing the prioritized fraud risks identified during the fraud risk assessment; and design and implement specific control activities, including fraud awareness training and data analytics, to prevent and detect fraud and other improper payments. To help ensure that necessary data are available to employ data analytics as a tool to perform contractor cost-surveillance activities, require contractors to maintain sufficiently detailed transaction-level cost data that are reconcilable with amounts charged to the government, including cost data that, at a minimum, represent a full data population and the details necessary to determine the nature of each cost transaction, with such identifiers as transaction date, dollar amount, item or service description, and transaction codes to indicate the type of cost represented (e.g., construction materials, property lease, and office supplies). We provided DOE with a draft of this report for its review and comment. DOE provided written comments, which are reproduced in appendix III, and technical comments that were incorporated as appropriate. In its written comments, DOE generally concurred in principle with five recommendations but did not concur with the sixth, which is aimed at ensuring that DOE has the necessary data available to employ data analytics. DOE’s Office of Inspector General (OIG) also provided written comments, which are reproduced in appendix IV. We incorporated some of the OIG’s suggested language regarding their role in the Cooperative Audit Strategy. DOE generally concurred in principle with five of our recommendations. In its letter, DOE agreed to (1) establish a DOE-wide invoice review policy that includes requirements for sites to establish well- documented invoice review operating procedures; (2) create a structure with a dedicated entity within DOE to design and oversee fraud risk management activities—but stated that it will have to consider the cost, benefits, and need for a separate organization before implementing a dedicated antifraud entity to design and oversee fraud risk management activities; (3) conduct fraud risk assessments that are tailored to each program and use the assessments to develop a fraud risk profile; (4) develop and document an antifraud strategy that describes the programs’ approaches for addressing the prioritized fraud risks identified during the fraud risk assessment; and (5) design and implement specific control activities, including fraud awareness training and data analytics, to prevent and detect fraud and other improper payments. DOE states that it has already, or is in the process of, implementing each of these five recommendations. We will continue to monitor DOE’s efforts to implement these changes and address our recommendations. In its letter, DOE did not concur with our sixth recommendation to require contractors to maintain sufficiently detailed transaction-level cost data that are reconcilable with amounts charged to the government. In its letter, DOE states that it does not concur with this recommendation because the recommendation establishes agency-specific requirements for DOE contractors that are more prescriptive than current federal requirements and that its M&O contractors, not DOE, are responsible for performing data analytics and determining what data are needed to do so. Based on DOE’s response we are concerned that it does not fully appreciate its responsibility for overseeing contractor costs. Specifically: DOE disagreed with our recommendation because it asserted that implementing the recommendation would require DOE to establish agency-specific requirements for DOE contractors that are more prescriptive than current federal requirements. However, under the FAR agencies are authorized to establish their own agency-specific requirements governing contracts. Under federal internal control standards, managers should use quality information to achieve the entity’s objectives. To do this, managers may identify information requirements, obtain relevant data from reliable internal and external sources, and process data into information that is appropriate, current, complete, accurate, accessible, and provided on a timely basis. DOE also stated that its fiscal year 2017 internal control evaluations guidance requires M&O contractors to apply data-analytics, as appropriate, and that federal employees assess the contractors’ implementation of fraud risk activities, such as the use of data analytic tools to identify fraud risk factors. DOE’s letter, however, does not acknowledge that it has a responsibility for employing data-analytics under the Fraud Reduction and Data Analytics Act of 2015. Instead, DOE’s letter states that under the M&O contracting model, the contractor is responsible for performing data-analytics. The act— which is intended to improve federal agencies' development and use of data analytics for the purpose of identifying, preventing, and responding to fraud, including improper payments—does not specifically authorize DOE (or any other agency) to delegate its fraud management responsibilities to a contractor or any other nonfederal entity. The use of some data analytic techniques by its contractors does not relieve DOE of its responsibility to establish and maintain an effective fraud risk management framework. In addition, as we discuss in our report, the one M&O contractor we examined was unable to produce data that were suitable for data-analytic techniques to produce meaningful results. We continue to believe that the use of data-analytic techniques by DOE employees could help mitigate some of the challenges that limit the effectiveness of DOE’s approach for overseeing M&O contractor costs. However, effectively applying data- analytics is dependent upon the availability of complete and sufficiently detailed contractor data. Therefore, we continue to believe that DOE needs to implement our recommendation and require contractors to maintain sufficiently detailed transaction-level cost data that are reconcilable with amounts charged to the government. Although DOE did not concur with our sixth recommendation, DOE’s letter states that it will discuss the merits of government-wide guidance for applying data-analytics to contract costs with the data-analytics working group that OMB is required to establish as part of the Fraud Reduction and Data Analytics Act of 2015. DOE stated that if the working group determines that there is a need for contractors to retain and provide additional data to support data analytic procedures, any proposed new requirement should be discussed with the FAR Council; the OMB Office of Federal Procurement Policy; and potentially, the OMB Office of Intergovernmental and Regulatory Affairs. However, the purpose of the working group is to share "financial and administrative controls" and "data-analytics techniques". In other words, this is an information sharing entity to facilitate the sharing of fraud management best practices. It is not an implementing body, and agencies do not need its permission before proceeding with fraud risk reduction efforts. The law does not prohibit DOE (or any other agency) from acting unless and until there is interagency consensus on an issue. In addition to DOE’s response to our recommendations, DOE’s letter states that the department is concerned with the accuracy of statements throughout the report. Specifically, DOE states that it has invoice review procedures and uses data analytics in its internal control processes. We disagree. As we discuss in our report, officials with the Office of the CFO at DOE headquarters told us that DOE does not have department-wide invoice review policies and procedures. Instead, according to these officials, field CFOs and contracting officials are responsible for developing appropriate invoice review policies and procedures. Notably, in our query of all DOE sites, we found that most did not have well- documented invoice review procedures. Regarding the use of data- analytics, DOE officials stated that DOE’s contractors use some data- analytic techniques. However, as we discuss in our report, most DOE sites in our query of all sites do not use data-analytics. Further, as discussed in the report, we reviewed one of DOE’s large M&O contractors and found that cost data is not maintained in a way to support comprehensive data analysis and neither the contractor nor DOE was doing such analyses. In its letter, DOE also states that the report should acknowledge DOE’s compliance with requirements in effect at the time of our review. Our work was not designed as a compliance audit to test the effectiveness of DOE’s internal financial controls. Our report examined the extent to which DOE’s approach to managing its risk of fraud and other improper payments incorporates leading practices, such as the use of data analytics. We do not assert in our report that the leading practices included in GAO’s Fraud Risk Framework are requirements. However, as we discuss in our report, by not incorporating these leading practices, DOE is missing an opportunity to organize and focus its resources in a way that would allow the department to mitigate the likelihood and impact of fraud. As agreed to with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the appropriate congressional committees, the Secretary of Energy, the Administrator of NNSA, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-3841 or trimbled@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix V. To examine the Department of Energy’s (DOE) approach to managing its risk of fraud and other improper payments and challenges, if any, that may limit the effectiveness of this approach, we took the following steps. We reviewed the Federal Acquisition Regulation (FAR), Office of Management and Budget (OMB) requirements and Presidential memorandums, federal legislation regarding improper payments, our Standards for Internal Control in the Federal Government, our A Framework for Managing Fraud Risk in Federal Programs, and standards and guidance of the Institute of Internal Auditors to identify federal requirements and best practices for prevention and detection of fraud and other improper payments. To identify DOE’s agency-wide approach to managing its risk of fraud and improper payments, including key internal controls over financial and accounting operations and for contractor oversight, we reviewed DOE regulations, directives, procedures, and guidance, and we interviewed DOE officials from headquarters organizations, including the Office of the Chief Financial Officer (CFO), the office of the Chief Risk Officer, the Office of Acquisition Management, and the Office of Inspector General (OIG). To identify DOE’s approach to managing its risk of fraud and improper payments in its field locations, we developed a semi structured interview, which was administered to officials at DOE field locations that oversee at least one prime contractor. Through review of DOE documents and discussions with officials in the Office of the CFO, we identified 10 field office locations responsible for oversight of at least one prime contractor; and we determined that 6 of those sites oversaw at least one non-M&O contractor. To develop the interview questions, we reviewed OMB Circular A-123, federal internal control standards, and the Fraud Risk Framework provided in and identified key controls and leading practices for prevention and detection of fraud and other improper payments. We pretested interview questions and made changes to the interview guide as appropriate; we conducted these semi structured interviews with DOE’s field CFOs, contracting officers, and major contractors at each site. We also collected DOE policies and procedures for oversight and review of contractor costs from each site. We analyzed DOE and contractor responses and information provided through the semi structured interview process and summarized DOE’s approach to managing its risk of fraud and improper payments in its field locations. To gain an in-depth understanding of the local DOE processes for oversight of contractors’ costs, we visited DOE’s Hanford Office in Washington State and the National Nuclear Security Administration’s (NNSA) Office of Financial Performance in Albuquerque, New Mexico, and held discussions with DOE officials responsible for financial and administrative oversight of prime contractors at the sites. To identify challenges to DOE’s approach, we reviewed DOE internal assessments, OIG reports, and a DOE-commissioned study on DOE’s contract administration practices. We also interviewed officials from the DOE OIG audit and investigations units in headquarters and in the field to further identify and discuss additional challenges DOE faces in using its approach. To examine the extent to which DOE’s approach incorporates leading practices, such as the use of data analytics, through our review of standards and guidance of the Institute of Internal Auditors, federal internal control standards, and our Fraud Risk Framework, we identified key leading practices for managing the risk of fraud and improper payments in the federal government. The Fraud Risk Framework consists of four components—commit, assess, design and implement, and evaluate and adapt—each of which are overarching fraud risk management concepts and leading practices for carrying out the overarching concept. To ensure that we had a cross section of leading practices, we selected at least one leading practice from each component of the Fraud Risk Framework: commit to combating fraud by creating an organizational culture and structure that is conducive to fraud risk management, plan regular fraud risk assessments and assess risks to determine a fraud risk profile, and design and implement a strategy with specific control activities to mitigate assessed fraud risks. After determining that DOE had not adopted fraud risk management activities that incorporated leading practices from the first three components, we did not assess whether DOE was evaluating and adapting its use of leading fraud risk management practices. The leading practices we selected from each component were selected because the use of these practices could be objectively verified. We then compared DOE’s approach to managing its risk of fraud and improper payments, including our analyses and summary of its policies and procedures for oversight of its contractors, with the key leading practices and identified similarities and differences between these practices and DOE’s approach. To examine the application of data analytics in identifying potential indicators of fraud or other improper payments associated with selected DOE contracts, we planned to review costs charged to DOE by one management and operating (M&O) contractor and one non-M&O contractor. We selected these contractors for in-depth review based on type of contractor, contract size in dollars, and ease of access of contractor data. Specifically, we selected one M&O and one non-M&O contract to review because these types of contracts charge costs to DOE differently and we wanted to capture this variation in our review. We chose two contracts that were large in terms of dollars charged to DOE in order to have two large data sets with many types of expenses to analyze. We selected the non-M&O contractor at the Hanford Site for ease of access to the data and proximity to our offices for follow-up on data questions and issues. We selected the M&O contractor because it is co-located with DOE’s NNSA Office of Financial Performance, the field office responsible for oversight of all NNSA contractors, also making it much easier to follow up on data questions and issues. We requested 3 years of cost data charged to DOE by each contractor during fiscal years 2013 through 2015. Non-M&O contractor analysis. We requested data from Bechtel National, Inc., the non-M&O contractor responsible for the design and construction of the Waste Treatment Plant at DOE’s Hanford site. DOE provided the requested cost data for the non-M&O contractor in 72 files, and each file was separated into two types of costs: labor costs and other direct costs. These files contained fields regarding the natural class, source reference number and descriptions, cost accounting code, control account description, and others. We combined these data into two data sets, one set for labor costs and one set for other direct costs. To determine the reliability of these data, we (1) conducted a series of interviews with DOE officials responsible for the data to understand how the data are maintained and verified; (2) performed data testing, including checking totals in the data against control totals provided by the agency, as well as examination of outliers and missing data, and (3) reviewed the data dictionary. We determined the data were sufficiently reliable for the purposes of this engagement. We performed a variety of analyses of these data, including examining distributions of variables, classification of costs into categories, cross-tabulation, and trend analysis. For example, we summarized both the labor and other direct costs data by type of cost. We reviewed the results of these analyses and identified certain costs that could potentially be unallowable as defined in the FAR and that warranted further review. For some of the potentially unallowable costs we identified, we examined the details of the transactions to help us to identify the type and/or purpose of the costs represented. To validate our findings, we provided a detailed briefing to DOE on the results of our analyses and at that time we requested additional information about the purpose and allowability of the potentially unallowable costs we identified. DOE did not respond to our request to provide us with this information. DOE did, however, provide us with a file of individual cost transactions that it examined in connection with its review of the 72 invoice files from fiscal years 2013 through 2015. We performed a variety of analyses of these data, including, for example, classification of the costs into categories and cross-tabulating this information with the labor and other direct costs data summaries. M&O contractor analysis. We requested data from Sandia Corporation, the M&O contractor responsible for managing and operating Sandia National Laboratories. DOE was unable to provide us with the requested data in a format that was suitable for analysis. Specifically, DOE was unable to provide the data because the contractor tracked costs by project in several sub-accounting systems, and the contractor could not produce a full data population of sufficiently detailed transaction-level data for the costs it incurred and claimed during the fiscal years 2013 through 2015 time frame we examined. In addition, the contractor did not identify costs by the cost types identified in the FAR. The M&O contractor that operates Sandia National Laboratories was unable to produce a full data population of sufficiently detailed transaction-level data for any of the over $8 billion in costs it incurred and claimed during the fiscal years 2013 through 2015 time frame we examined. According to representatives of the M&O contractor and documents it provided, the contractor’s core accounting system generates financial information for both internal and external use through the use of project accounting and general ledger modules. Specifically, the contractor’s project accounting module generates information for internal management use, and the general ledger module generates information for external reporting purposes. However, neither the project accounting nor the general ledger module contained transaction-level cost data suitable for data analytics. The information contained in the contractor’s project accounting module did not have the expenditure detail needed to effectively perform data analytics, according to documents provided by the contractor. The contractor’s project accounting module tracks four cost categories: labor, chargebacks, travel, and purchases. Costs within each of these cost categories were not further identified by expense type, such as construction materials, property lease, or office supplies. The information contained within the contractor’s general ledger module also did not contain the expenditure detail needed to effectively perform data analytics. According to representatives of the M&O contractor and documents they provided, the contractor’s general ledger system is not set up to function like the ledgers used by nongovernmental businesses. A general ledger system, according to the contractor, would normally contain detailed information that would define the expenditure type and associated detail of the expenditure that could then allow analytics to be performed. Furthermore, the contractor told us that it does not produce financial statements and DOE does not require its contractors to report transactional detail to support the agency’s preparation of consolidated financial statements. Consequently, the contractor’s general ledger system does not contain the detailed information needed to allow analytics to be performed. According to representatives of the M&O contractor and documents they provided, although transaction-level cost data are not maintained in the project accounting or general ledger modules, detailed cost information is found in several of the contractor’s sub-accounting systems. Specifically, they said that the M&O contractor maintains several sub-accounting systems that separately process and capture transactions by type, such as travel, purchase card, and employee expense voucher systems. Data from the sub-accounting systems are summarized and used to populate the contractor’s project accounting and general ledger modules, according to contractor representatives and documents provided. Notably, the M&O contractor at Sandia does not meet the financial management system standards it sets for prospective subcontractors. According to the M&O contractor’s guidance for prospective subcontractors, an adequate accounting system must be able to collect, process, and report costs. It should be able to break out costs by cost element, and cost elements used should be easily traceable to the general ledger and the financial statements. As discussed above, the M&O contractor’s financial system does not enable cost elements to be easily traceable to the contractor’s general ledger, and the contractor does not produce corporate financial statements. Representatives of the contractor told us that they have processes and controls in place that ensure that cost information from their subsystems reconciles with amounts charged to DOE. However, documentation the contractor provided us regarding costs contained in each subsystem did not reconcile with amounts included on the contractor’s statement of costs incurred and claimed, and contractor officials could not confirm that the transactional expenditures pulled from the sub-accounting systems were reconciled with amounts charged to DOE. Instead, these officials suggested that we use data analytics on the subset of data contained in each of the sub-accounting systems—an approach they told us they use to ensure that the financial information they are reporting to DOE is proper. Unless the transactional expenditures pulled from the contractor’s sub-accounting systems are reconciled with amounts charged to DOE, however, there is no assurance that the data are complete. Without complete data, meaningful analysis using data analytics is not possible. According to DOE’s contract with the M&O contractor, the contractor’s financial management systems are to be responsive to the responsibilities of sound financial stewardship and public accountability. The overall system is to include an integrated accounting system suitable to collect, record, and report all financial activities; a budgeting system for the formulation and execution of resource requirements; a disbursements system for employee payroll and supplier payments; and an effective internal control system for all expenditures. Given the difficulty in producing transaction-level cost data that are reconcilable to the amounts charged to DOE, it is unclear how DOE ensures that the M&O contractor at Sandia meets these requirements. In addition to the contact named above, Diane LoFaro (Assistant Director), David Dornish, Farrah Graham, Mark Keenan, Courtney Liesener, Andrew Moore, and Kathryn Pedalino made key contributions to this report.

Summary: Over the past decade, incidents of fraud by DOE contractors have occurred. From 2003 through 2008, employees of one contractor at DOE's Hanford site in Washington state made hundreds of fraudulent purchases and solicited and received kickbacks. In another case, Hanford contractors agreed to pay a combined $125 million to settle disputed claims regarding federal dollars spent on nonnuclear-compliant parts. To help federal program managers combat fraud, in July 2015, GAO issued leading practices for managing fraud risks. GAO was asked to review DOE's processes, programs, and practices for managing its risk of fraud. This report examines (1) DOE's approach to managing its risk of fraud and other improper payments and challenges, if any, that may limit the effectiveness of this approach; (2) the extent to which DOE's approach incorporates leading practices; and (3) the application of data analytics in identifying potential indicators of fraud or other improper payments associated with selected DOE contracts. The Department of Energy (DOE) manages the risk of fraud and improper payments through its internal controls program, which includes, among other things, prepayment invoice reviews and post payment audits. However, several challenges limit the effectiveness of this approach. For example, DOE does not have a department-wide invoice review policy or well-documented procedures at five of the six sites with invoice review responsibilities. Consequently, DOE has no assurance that control activities at these sites are operating as intended. Time constraints also limit the effectiveness of invoice reviews. For example, some invoices can have numerous associated transactions and the reviews must be completed within a limited time frame before payment, which may be as short as 10 days. DOE's approach to managing fraud risk does not incorporate leading practices such as creating a dedicated antifraud entity to lead fraud risk management activities; conducting regular fraud risk assessments that are tailored to the program; developing and documenting a strategy to mitigate assessed fraud risks; or designing and implementing specific control activities, such as data analytic activities, to prevent and detect fraud. By not implementing leading practices, DOE is missing an opportunity to organize and focus its resources in a way that would allow it to mitigate the likelihood and impact of fraud. Moreover, the Fraud Reduction and Data Analytics Act of 2015 establishes requirements aimed at improving federal agencies' controls and procedures for assessing and mitigating fraud risks through the use of data analytics. The legislation also directs the Office of Management and Budget (OMB) to, among other things, establish implementation guidelines that incorporate fraud risk management leading practices. DOE officials told GAO that they plan to meet the requirements of the act but should not be expected to implement private industry leading practices prior to the issuance of OMB guidance. Incorporating leading practices could also help DOE more effectively implement the act's requirements once OMB guidance is available. It is not possible to fully employ data analytics as a tool to identify potential indicators of fraud or other improper payments at DOE because of limitations in contractor-maintained cost data. Much of the cost data maintained by the two DOE contractors GAO selected for data analytic purposes could not be used because these data did not include a complete universe of transactions that was reconcilable with amounts billed to DOE or did not contain details necessary to determine the nature of costs charged to DOE. Because DOE does not require its contractors to maintain sufficiently detailed transaction-level cost data that are reconcilable with amounts charged to DOE, it is not well positioned to employ data analytics as a fraud detection tool. Effective fraud risk managers collect and analyze data and identify fraud trends and use them to improve fraud risk management activities, according to leading practices that GAO has previously identified. Without the detailed data necessary to conduct such analysis, DOE is missing an opportunity to develop, refine, and improve its experience with data analytic tools and techniques, and better position itself to meet the requirements of the Fraud Reduction and Data Analytics Act. GAO is making six recommendations, including that DOE establish invoice review policies and procedures, employ leading practices such as data analytics to help manage fraud risk, and require that its contractors maintain sufficiently detailed cost data for reconciling with amounts charged. DOE generally concurred with five of GAO's six recommendations but did not agree to require contractors to maintain detailed data. GAO continues to believe that the recommendation is valid, as discussed in the report.