Our work over the past several years has demonstrated that improper payments are a long-standing, widespread, and significant problem in the federal government. In December 2007, we reported on DOD’s fiscal year 2006 travel program improper payment estimates. We found that (1) the improper payment estimate was understated by at least $4 million, (2) several weaknesses in DOD’s sampling methodology did not result in statistically valid estimates of travel improper payments at the component level, and (3) limited guidance and oversight by the Office of the Comptroller contributed to the unreliable assessment of improper payments for the travel program. The DOD OIG also has issued reports for the past few years highlighting weaknesses in the department’s efforts to report on improper payment information. The DOD OIG reported that the department had not implemented guidance to address the use of valid statistical sampling in determining programs and activities susceptible to significant improper payments. In January 2008, it reported that DFAS had not conducted adequate research to determine if contractor refunds were improper and, in some cases, had not reported improper payments associated with these refunds. The DOD OIG continues to report that the department has not fully complied with the requirements of IPIA and OMB’s implementing guidance and does not have adequate controls to fully implement a recovery audit program. Guidance for reporting under IPIA and the Recovery Auditing Act is provided in Appendix C of OMB Circular No. A-123. IPIA requires agencies to perform four key steps in meeting the improper payment reporting requirements as shown in figure 1. OMB’s implementing guidance instructs agencies to carry out the four key steps under IPIA, with one exception. For the first step—perform a risk assessment—OMB guidance allows agency programs deemed not risk- susceptible to conduct a risk assessment generally every 3 years. Further, agencies need not conduct formal risk assessments for those programs in which improper payment baselines are already established, are in the process of being measured, or will be measured by an established date. However, OMB guidance does state that if a program experiences a significant change in legislation, a significant increase in funding level, or both, agencies are required to reassess the program’s risk susceptibility during the next annual cycle, even if it is less than 3 years from the last assessment. As we have previously testified before your Subcommittee this is inconsistent with the express terms of IPIA, which require that agencies annually review all of their programs and activities. OMB then requires that agencies estimate the gross total of both over- and underpayments for those programs and activities identified as susceptible. These estimates shall be based on a statistically random sample of sufficient size to yield an estimate with a 90 percent confidence interval of plus or minus 2.5 percentage points. If an agency cannot determine whether a payment was proper because of insufficient documentation, Appendix C to OMB Circular No. A-123 requires that the payment be considered improper. The guidance further requires that agencies develop corrective action plans that include a discussion of the causes of the improper payments identified, corrective actions taken for each different type or cause of error, and the results of actions taken to address those causes. In addition, OMB Circular No. A-136, Financial Reporting Requirements requires agencies to report, in table format, improper payment estimates and related outlay amounts for the prior year, current year, and the following 3 years. As part of this reporting, OMB encourages agencies to report underpayment and overpayment amounts, if available. The Recovery Auditing Act requires each executive branch agency that annually enters into contracts with a total value of $500 million or more to use recovery audits and recovery activities as part of a cost-effective recovery auditing program. The law authorizes federal agencies to retain recovered funds to cover actual administrative expenses as well as to pay other contractors, such as collection agencies. OMB guidance requires, among other things, that agencies include in their annual reporting a general description and evaluation of the steps taken to carry out a recovery auditing program, the total amount of contracts subject to review, the actual amount of contracts reviewed, the amounts identified for recovery, and the amounts actually recovered in a current year. Further, OMB Circular No. A-136 requires agencies to report cumulative amounts identified for recovery and amounts actually recovered as a part of their current year reporting. The responsibility for assessing and reporting DOD’s improper payments information rests with the Office of the Under Secretary of Defense (Comptroller) (Office of the Comptroller). The Accounting and Finance Policy Directorate within the Office of the Comptroller is responsible for carrying out the day-to-day activities involved in meeting IPIA requirements. To collect improper payment information including risk assessments, improper payment estimates, and corrective actions, the Accounting and Finance Policy Directorate sends out an improper payment survey (IPIA survey) to all DOD agencies and military services requesting improper payment information for the current fiscal year (see app. II for a list of the 33 agencies and military services). The agencies and services are required to submit improper payment estimates to the Accounting and Finance Policy Directorate for all DOD payment activities identified under IPIA. The Accounting and Finance Policy Directorate then aggregates and reports the improper payment information in DOD’s annual AFR. Since implementation of IPIA, DOD has reported improper payment estimates for the following payment activities for fiscal years 2004-2008 as shown in table 1 below. Similarly to improper payment reporting, the Office of the Comptroller is responsible for identifying and annually reporting recovery audit information in DOD’s AFR, while its Accounting and Finance Policy Directorate is responsible for carrying out the day-to-day activities. DOD’s recovery auditing process over contract and vendor payments (commercial payments) encompasses several organizations including DFAS offices and external contractors, which are discussed later in this report. These organizations are required to compile and submit the universe of commercial payments, commercial overpayments identified for recovery, and commercial payments actually recovered to the Accounting and Finance Policy Directorate. It in turn aggregates and reports the recovery audit information in DOD’s annual AFR. DOD’s reported recovery audit information for fiscal years 2004-2008 is shown in table 2 below. DOD’s processes to conduct risk assessments, estimate improper payments, and develop corrective actions to reduce improper payments for its fiscal year 2007 IPIA reporting had significant weaknesses. A lack of detailed guidance as well as inadequate monitoring and oversight of DOD’s improper payment activities also existed, raising doubts about the accuracy of the information reported. DOD’s risk assessment process was inadequate to ensure that appropriate consideration was given to the risks associated with its payment activities, thus not allowing management appropriate visibility of its vulnerabilities. DOD lacked detailed guidance on how to conduct a risk assessment, including identifying the universe of activities, determining if risks exist, identifying what those risks are, and evaluating the results, as required by our internal control standards. Recognizing that the internal guidance and documentation needed to be improved, in December 2008, DOD issued a new Financial Management Regulation (FMR) chapter—Volume 4, Chapter 14, Improper Payments—to expand existing guidance to address IPIA requirements, by clarifying the agencies’ and military services’ responsibilities for reporting improper payment information, broken down by payment activity. Although we did not determine the adequacy of these changes as the scope of our audit was fiscal year 2007, we noted that DOD did not require its agencies and military services to document their risk methodologies, including risk factors considered, the potential or actual impact on their program operations, and the rationale for assessing risk as either low, medium, or high. While nine DOD components conducted risk assessments for their six payment activities totaling about $493 billion in fiscal year 2007, we found an additional $322 billion in outlays reported in DOD’s Statement of Budgetary Resources (SBR) that had not been assessed although IPIA requires that agencies annually review all programs and activities (see fig. 2). According to Office of the Comptroller officials, the six payment activities it assessed covered all DOD outlays for fiscal year 2007 and the $322 billion difference in outlays represented IPIA reporting differences related to payroll payments for three of its six payment activities (net outlays reported for IPIA purposes versus gross outlays reported for SBR purposes), intragovernmental payments, and payments resulting from classified activities. While DOD officials stated that it reconciled the $322 billion difference to the SBR (with the exception of classified activities), these officials did not provide us with this reconciliation to enable us to independently substantiate this difference. Further, these officials could not reconcile the $493 billion in outlays for the six payment activities to an alternative source, such as the SBR. Based on this comparison, DOD had not reviewed all of its programs and activities. Office of the Comptroller officials told us that DOD agencies and the military services were required to reconcile their payment activities with their budget data for fiscal year 2008 to ensure that all payment activities had been accounted for at the component level. In addition, DOD did not have sufficient documentation to support the level of assessed risk for the six payment activities it did evaluate as required by OMB guidance and our internal control standards. For example, none of the nine components that conducted risk assessments described their methodology or rationale for the level of risk assigned to each applicable payment activity. For the six risk assessments conducted, DOD had determined the risk of having significant improper payments was low, based on OMB criteria. However, given the lack of supporting documentation and evidence for the risk assessments and DOD’s history of long-standing weaknesses, including GAO’s designation of eight individual DOD areas as high risk, the low risk levels are not based on sufficient analysis and are likely unrealistic and not reflective of the wide range of vulnerabilities that exist within DOD. Office of the Comptroller officials told us that the department calculates improper payment estimates for the majority of the payment activities under IPIA, regardless of risk level assessed in determination of susceptibility to significant improper payments, because of the large volume and high dollar amounts of the transactions. DOD did not rely on the results of the risk assessments to determine whether to address the remaining IPIA requirements. Although DOD did not rely on its risk assessments, the implementation of IPIA requires agencies to make decisions as to how to proceed based on the completion of risk assessments, which is the first step. Therefore, DOD’s failure to conduct adequate risk assessments could negatively impact its ability to gain the information it needs to make decisions as it proceeds through the remaining steps to ensure proper implementation of IPIA requirements. As we previously reported, the information developed during a risk assessment forms the foundation or basis upon which management can determine the nature and type of corrective actions needed. It also gives management baseline information for measuring progress in reducing improper payments. Until the department recognizes the importance of performing comprehensive risk assessments, the reported information will not provide meaningful results or adequately depict DOD’s risk of improper payments, thus not providing the level of transparency envisioned by IPIA. DOD had neither established a methodology to estimate nor had it estimated the amount of improper payments for commercial pay—its largest payment activity with total outlays of $340.3 billion (see fig. 3). While DOD, in general, developed statistically valid sampling methodologies and estimated improper payment amounts for its remaining five payment activities, collectively the proportion of these five payment activities to DOD’s reported payment population subject to IPIA was about one-third of the total. See appendix III for a description of the sampling plans for DOD’s five payment activities. OMB guidance requires that for any programs and activities identified as susceptible to significant improper payments, agencies must develop a statistically valid methodology to estimate the annual amount of improper payments, including a gross total of both under- and overpayments. Although DOD assessed all six payment activities to be at low risk for improper payments, it chose to develop improper payment estimates for five of the six payment activities based on the large volume or high dollar amounts of the transactions. However, DOD did not estimate improper payments for commercial pay despite the large volume and high dollar amounts of the transactions. According to DOD officials, the department decided not to establish a statistically valid methodology or calculate an estimate for commercial improper payments under IPIA because (1) its past attempts to estimate commercial improper payments had resulted in improper payment estimates that were lower than the actual amount of overpayments identified, and (2) it would create duplicate reporting of improper commercial payments as this type of information was captured as part of DOD’s efforts to address Recovery Auditing Act requirements, which DOD officials believed resulted in a better measurement because it represented actual overpayments. However, in fiscal year 2006, DOD estimated $550 million in improper payments, which was nearly 30 percent higher than the $426 million of actual under- and overpayment amounts reported to address Recovery Auditing Act requirements. Regarding DOD’s point that reporting commercial improper payments under IPIA and the Recovery Auditing Act would create duplicate reporting, we disagree. DOD could leverage the results from its existing Recovery Auditing Act processes used to identify actual commercial under- and overpayments to develop its statistical sampling methodology to enhance the reported estimate. This approach is similar to DOD’s existing statistical sampling methodologies, which also include actual amounts for calculating improper payment estimates of civilian and military pay. As we previously reported, the scope of review under IPIA differs from that of the Recovery Auditing Act. Specifically, the scope of review under the Recovery Auditing Act targets agency-identified contract overpayments, whereas the scope of review under IPIA targets both under- and overpayments, including agency- and contractor-identified improper payments. Further, while OMB guidance allows agencies to exclude certain classes of contracts from their recovery auditing reporting, no such exclusions exist for IPIA. Establishing a well-designed statistical sampling methodology to estimate DOD’s improper commercial payments would not only facilitate compliance with IPIA requirements, but also help address a current data void on the extent of improper payments made to contractors and vendors. For example, based on our review of DOD’s fiscal year 2007 data of commercial payment errors, we identified $62 million in commercial improper payments and another $92 million of potential improper payments, which were not identified by DOD’s current Recovery Auditing Act processes. DCAA and the DOD OIG also identified payment errors not captured by DOD. For example, in August 2007, DCAA reported that a contractor had overbilled—and DOD had overpaid—award fees totaling about $267 million. Because DOD had not established a methodology to estimate improper payments for its commercial payment activity, these and other types of payment errors that meet the definition of improper payments were not reported, and thus, lacked the level of transparency and accountability called for under IPIA. Further, without an across-the-board, systematic estimate of the extent of improper commercial payments, DOD management could not determine (1) if improper commercial payments were significant enough to require corrective actions, (2) how much investment in new internal controls would be cost-justified, or (3) the effectiveness of any prior corrective actions. Although DOD reported the corrective actions taken or planned to reduce improper payments for its five payment activities that met its reporting threshold, the corrective actions for three of the five payment activities— military pay, civilian pay, and travel pay—generally did not address the root causes of the improper payments. For travel pay, we found that with the exception of one agency component, root causes had not been reported in DOD’s AFR, even though a description of the corrective actions taken had been disclosed. OMB guidance requires that, for all programs and activities with estimated improper payments exceeding $10 million, agencies must report on the root causes of the improper payments identified, actions taken to prevent or reduce those root causes, and the results of actions taken. For example, DOD reported that inaccurate or untimely reporting of entitlement data on such areas as time and attendance, personnel actions, and pay allowances was the primary cause for the improper payments for military and civilian pay. As actions to address these causes, DOD reported that it had developed performance metrics and goals to track the timeliness and accuracy of payments and that senior leadership had participated in quarterly meetings to discuss problem areas and find solutions to mitigate the risk of improper payments. While these actions measured entitlement performance, focused attention on the effectiveness of existing processes, and facilitated the sharing of information, it was unclear how these specific actions would address the root causes that led to inaccurate or untimely reporting and whether those actions would reduce improper payments. Conversely, for travel pay, we found that except for the U.S. Army Corps of Engineers, DOD agencies and military services did not report the associated root causes contributing to improper travel payments, even though corrective actions were disclosed in the AFR. The U.S. Army Corps of Engineers reported that the primary causes of improper travel payments included traveler input errors and inadequate supervisory review of travel vouchers. The Office of the Comptroller told us that the root causes and corrective actions implemented or underway were not fully disclosed in the AFR due to report formatting constraints, preventing the inclusion of all detailed information. However, when we reviewed the underlying support, we found that this documentation also lacked details as to (1) the corrective actions taken or planned and generally mirrored the corrective actions reported in the DOD’s AFR, (2) the root causes for improper travel payments, and (3) the results, if any, of the corrective actions taken. Accurately characterizing and publicly reporting the root causes and associated corrective actions to reduce improper payments enables agencies and others with oversight and monitoring responsibilities to measure progress over time and determine whether further action is needed to minimize future improper payments, thus enhancing accountability over the reduction of improper payments by ensuring that effective corrective actions are taken. The Office of the Comptroller’s monitoring and oversight of DOD’s improper payment activities were inadequate because they did not include verifying the accuracy and completeness of the information reported in DOD’s AFR as required by DOD guidance. Specifically, the Office of the Comptroller issued a memorandum in November 2006 that required the Project Officer for Improper Payments and Recovery Auditing to, among other things, verify that DOD’s reported information was accurate, complete, and meets or exceeds the minimum OMB reporting requirements. In addition, our internal control standards for monitoring provide that processes should generally be designed to ensure that ongoing monitoring occurs in the course of normal operations and include regular management and supervisory activities, comparisons, and reconciliations. Further, our internal control standards provide that controls should include a wide range of diverse activities including verification of information and be aimed at validating the propriety and integrity of both organizational and individual performance measures and indicators. During our review and analysis of DOD agencies’ and services’ IPIA survey responses, we found that the project officer had not conducted adequate follow-up to ensure that (1) the information provided was accurate and complete and sufficient to support risk assessment conclusions, and (2) reported corrective actions planned or underway addressed the root causes of the improper payments. For example, DOD agencies and military services did not provide supporting documentation for their risk assessment methodologies and conclusions, including the risk factors considered as part of this assessment and how they arrived at the final determination of risk for applicable payment activities. Yet we found no evidence that the Office of the Comptroller conducted appropriate follow- up as part of its oversight and monitoring responsibilities to ensure payment activities had been consistently assessed and provided some level of comparability among DOD agencies and military services. We previously reported on similar instances of lack of oversight and review by the Office of the Comptroller over IPIA reporting for DOD’s travel payment activity. In that report, we found that the IPIA survey excluded about $5.1 billion in the universe of travel payments for fiscal year 2006 and that only $824 million of the total travel payments had been reported in DOD’s annual report for the same period. We noted that these discrepancies would have been brought to management’s attention in a timely manner if monitoring activities, such as periodic reconciliations and comparisons, had been performed. Office of the Comptroller officials told us that the DOD agencies and the military services performed verification reviews prior to submission of their improper payment information, providing assurances that the reported information was accurate and complete. As a result, they did not believe it was necessary for the project officer to independently validate this information despite the requirement in the November 2006 memorandum to do so. However, based on our findings discussed earlier in this report, the oversight and monitoring activities performed by the agencies and services, as well as the Office of the Comptroller, were inadequate. Without adequate monitoring and oversight, DOD is at risk of inaccurately reporting the extent of its improper payments, not taking the steps needed to reduce improper payments, and ultimately not meeting IPIA requirements. DOD’s recovery audit program was inadequate because it leveraged existing processes that were not specifically designed to identify and recover overpayments as stipulated in the Recovery Auditing Act. Further, DOD’s internal guidance lacked detailed instructions to effectively address recovery auditing requirements. We also found that DOD’s reported recovery audit information for fiscal year 2007 was unreliable, as the reported amounts were incomplete and not fully supported. In addition, we determined that DOD’s monitoring and oversight activities were inadequate to ensure the accuracy and completeness of the reported recovery audit information. The majority of DOD’s processes used to identify and recover commercial (contractor and vendor) overpayments were inadequate because they were not specifically designed to do so as required by OMB guidance (see table 3 for these processes). Specifically, only DFAS’s Internal Review and DOD’s two external recovery audits were specifically designed to identify and recover commercial overpayments. We also found that DFAS suspended its Internal Review postpayment audit of contract payments— its largest payment activity—for fiscal year 2007, but did not disclose this limitation in its fiscal year 2007 AFR. DFAS officials told us that its Internal Review contract postpayment audits were suspended and that there was a reallocation of staff resources to support base realignment and closure (BRAC) initiatives, specifically auditing the records of affected DFAS sites that processed commercial payments from 2006 through 2008. According to DFAS officials, to compensate for this suspension, DOD relied on existing prepayment controls to identify contract overpayments, such as daily manual reviews of a random sample of invoices with thresholds of $500,000 or more. In January 2009, Internal Review officials informed us that the office had reinstituted efforts to conduct audits of contract payments. Internal Review’s current audit covers the “catch up” period of payments made between April 2006 and March 2008, and the audit results are expected by the end of fiscal year 2009. According to DOD officials, the existing processes were adequately designed to fulfill the requirements of the Recovery Auditing Act and OMB guidance and thus, no further actions were needed. However, we found the majority of the existing processes were not specifically designed to identify overpayments. For example, DFAS’s contract reconciliations were performed upon request to resolve previously identified discrepancies, including possible overpayments, within DOD’s contract, disbursement, and accounting records such as to correct funding classification or lines of accounting errors. Because a contract reconciliation would be performed only if an error related to a specific contract was found, contracts and the associated disbursements that did not have identified errors would not be subject to this review. As a result, this process was not intended to identify new, undetected contract overpayments as envisioned by the Recovery Auditing Act. In addition, we noted that DCMA’s and DCAA’s contract closeout processes were designed to ensure that applicable administrative actions had been completed during the course of a contract (e.g., all classified documents were disposed of) and not to specifically identify contract overpayments. The DOD OIG has reported instances where the department was unable to reconcile and close out contracts due to missing documentation and staff turnover. Further, although DOD considered DCAA contract audits an integral part of its recovery audit program, DCAA officials pointed out that because recovery auditing is a review of DOD components’ books and records, DCAA would generally have no role since its audits primarily focus on contractors’ records. Moreover, based on our review, DOD’s internal guidance did not identify the applicable payment and accounting systems to be reviewed, the frequency of this review, and the applicable roles and responsibilities at DFAS and the military services processing commercial payments, including coordination of these efforts. We found no discussion on how DOD would leverage existing audits to identify commercial overpayments performed at military service audit agencies, such as the Army Audit Agency. Further, the guidance did not include specific actions that addressed OMB’s recovery auditing reporting requirements, including actions to develop a corrective action plan to address the root causes of payment errors and steps to measure the total cost of the agency’s recovery auditing program. In fiscal year 2009, DOD acknowledged the need to clarify and update its guidance and has efforts underway to revise the recovery auditing chapter. DOD further reported in its fiscal year 2007 AFR that it had actions underway to implement a Business Activity Monitoring (BAM) service to provide a real-time or near real-time automated mechanism for analyzing transactions to prevent and reduce the risk of duplicate payments and other types of errors. DFAS believes this new process will reduce the need for internal postpayment reviews of commercial payments by identifying errors before payment occurs. DFAS anticipates DOD-wide implementation of BAM during fiscal year 2009. Until the department establishes processes specifically designed to address recovery auditing and updates its internal guidance, it will be unable to determine the extent to which contract overpayments exist and are subsequently recovered to fulfill the Recovery Auditing Act requirements. DOD did not fully address OMB recovery auditing reporting requirements in its AFR, such as disclosing the total costs associated with its recovery auditing activities and the associated recovered amounts related to overpayments made to vendors. DOD’s guidance did not include the specific recovery auditing reporting requirements identified in OMB’s guidance. The following describes the status of DOD’s actions on each of the nine reporting elements under OMB’s recovery auditing reporting requirements: A general description and evaluation of the steps taken to carry out a recovery auditing program. DOD reported a general description of the steps taken to implement its recovery auditing program, but did not provide an evaluation. The total cost of the agency’s recovery auditing program. DOD informed us that it did not report total costs because it was unable to calculate the amount. DOD officials told us that the agency did not have cost accountants and thus lacked the expertise needed to calculate the total cost of the agency’s recovery auditing program, particularly the costs of the agency’s internal recovery efforts (agency salaries and expenses). The total amount of contracts subject to review. DOD did not report the full amount subject to review. Specifically, DOD excluded from its AFR $20.5 billion of its commercial payment universe for fiscal year 2007. According to Office of the Comptroller officials, it did not include $20.5 billion for the U.S. Army Corps of Engineers and Army Europe in the universe of commercial payments because of an oversight error. The $20.5 billion represents commercial payments processed by Army Europe and the U.S. Army Corps of Engineers. If the $20.5 billion amount had been included, the total universe of reported commercial payments would have increased to $340.3 billion. The actual amount of contracts reviewed. As stated above, DOD excluded $20.5 billion from the full amount actually reviewed because of an oversight error. The amounts identified for recovery. DOD reported the overpayments identified for recovery for contractors, but not for vendors. DFAS officials told us that they did not report for vendor payments the amounts identified for recovery and actually recovered because the department did not have a process to separate and quantify DOD-identified vendor overpayments from contractor- identified vendor overpayments. In July 2007, DFAS introduced an automated process—the Contractor Debt System (CDS)—to track DOD-identified overpayments to vendors, but CDS was not fully deployed by the time DOD issued its fiscal year 2007 AFR. The amounts actually recovered in the current year. DOD reported the associated recovered amounts for contractor overpayments, but did not report similar information for vendors. As stated above, DOD did not report this information because it lacked the processes needed to distinguish between DOD-identified and contractor-identified vendor overpayments. A corrective action plan to address the root causes of payment errors. DOD did not report on its corrective action plan to address the root causes of payment errors. We requested—but DOD did not provide—its corrective action plan to reduce commercial overpayments. A general description and evaluation of any management improvement program carried out as part of its recovery auditing program. DOD reported a general description of an initiative— Business Activity Monitoring service—it planned to implement to reduce overpayments. However, DOD did not report a general evaluation of this initiative, because it had not been implemented. A description and justification of the classes of contracts excluded from recovery auditing review by the agency head. This reporting element is not applicable as DOD officials told us that the department reviewed all classes of contracts as part of its recovery auditing program. DOD also could not substantiate the reported $18.9 million of DFAS recovered contract overpayments for fiscal year 2007, because it did not maintain the underlying documentation that supported the amount. DOD was unable to recreate the documentation because the system data reflected real-time information and changed daily. Although the Office of the Comptroller reported commercial overpayment data for the Navy for fiscal year 2008, it did not do so for fiscal year 2007 and was unable to confirm whether it should have reported comparable data for that period. Office of the Comptroller officials told us that they did not follow up with the Navy to determine why it did not report recovery audit information for fiscal year 2007. Our internal control standards related to control activities state that all transactions and other significant events need to be clearly documented and should be readily available for examination, and that documentation and records should be properly managed and maintained. Until DOD reports the required information and ensures the accuracy of the information it does report, the extent to which Congress, OMB, and other oversight bodies can rely on this information to make informed decisions is questionable. The Office of the Comptroller’s oversight and monitoring of DOD’s recovery auditing activities were inadequate as they indicated that they had not verified the accuracy and completeness of the information reported in DOD’s AFR. These activities were generally limited to compiling data received from DOD agencies and the military services and performing a fluctuation analysis of these data to identify changes in amounts between the current and prior year. We found that the roles and responsibilities for the Recovery Auditing Project Officer, who was tasked with overseeing DOD’s recovery auditing efforts, were not documented in the November 2006 memorandum from the Office of the Comptroller establishing the position. In addition, the project officer devoted minimal time—about 10 percent for fiscal year 2007—to overseeing DOD’s recovery auditing efforts, and frequent turnover occurred with this position. Between fiscal years 2007 and 2008 we noted that four different people had been assigned to oversee DOD’s recovery auditing program. Our internal control standards for monitoring provide that processes should generally be designed to ensure that ongoing monitoring occurs in the course of normal operations and include regular management and supervisory activities, comparisons, and reconciliations. Further, our internal control standards provide that controls should include a wide range of diverse activities including verification of information and be aimed at validating the propriety and integrity of both organizational and individual performance measures and indicators. Also, excessive turnover could significantly impact the department’s ability to sustain the knowledge, skills, and experience needed to effectively oversee implementation of the Recovery Auditing Act requirements. Office of the Comptroller officials acknowledged that the recovery audit data submitted by the DOD agencies and military services were not independently validated to ensure that the information was accurate, complete, and met the minimum reporting requirements. In December 2007, DOD established a recovery auditing working group comprised of representatives from the DOD agencies and military service components to identify best practices for recovery auditing; however, this group has yet to meet. At the DOD component level, we were informed that Navy, on its own initiative, established a working group in fiscal year 2008 to identify and recover commercial overpayments and report this information to the Office of the Comptroller. Without adequate monitoring and oversight, the department does not have adequate assurance that its future reporting under the Recovery Auditing Act will be accurate and complete. DOD has not established the mechanisms—processes and detailed implementing guidance—needed to effectively implement the requirements for both IPIA and the Recovery Auditing Act. The department reports that its payment activities are at low risk for improper payments without adequate supporting analysis and documentation and despite its history of long-standing financial management weaknesses. Because addressing IPIA requirements is a sequential process, DOD’s failure to conduct comprehensive risk assessments, which is the first step, has adversely affected decisions made to address subsequent steps in the process. DOD has not accurately portrayed the full extent of improper payments or the associated root causes. As a result, any corrective actions taken are likely to fall short of fixing the problems that resulted in these errors. With regard to recovery efforts, DOD continues to rely on processes that are inadequate for identifying the extent of overpayments to contractors and vendors and ensuring that these amounts are recovered. Until the department takes definitive action to fulfill the requirements of these acts and implement preventive internal controls, it is at risk of making improper payments and wasting taxpayer funds. To improve DOD’s efforts to address improper payment and recovery auditing requirements, we recommend that the Secretary of Defense direct the DOD Comptroller to take the following 13 actions. For IPIA, the DOD Comptroller should Establish and implement a systematic approach, as a part of the risk assessment process, to ensure all programs and activities are reviewed to determine susceptibility to improper payments. Develop and implement detailed guidance for conducting risk assessments, including the steps to determine if risk exists, what those risks are, and the potential or actual impact of those risks on program operations. Require DOD agencies and the military services to document the risk assessment methodology used, including the risk factors considered, and the rationale for assessing the risk level for the payment activity. Develop and implement a statistically valid methodology to estimate and report commercial improper payments (contract and vendor over- and underpayments). This methodology should include all payment errors regardless of the source of the error—DOD, contractors, or vendors—as required by IPIA. Identify and fully disclose the root causes of improper payments annually in the AFR. Identify and fully disclose the corrective actions, and monitor the corrective actions to ensure that they address applicable root causes. Perform oversight and monitoring activities to ensure the accuracy and completeness of the improper payment data submitted by the DOD agencies and the military services for inclusion in the AFR. For Recovery Auditing Act, the DOD Comptroller should Establish and implement processes specifically designed to identify and recover commercial overpayments. Develop and implement detailed guidance to assist DOD agencies and the military services in effectively carrying out recovery audits and activities, including the payment and accounting systems to be reviewed, the frequency of these reviews, applicable roles and responsibilities, and reporting requirements. Establish and implement a process to identify costs related to the department’s recovery auditing program, including costs for employees’ salaries. Establish and implement a process to identify and report vendor overpayments and the associated recovered amounts. Maintain documentation to support the amounts reported in the AFR to allow for independent evaluation of this information. Perform oversight and monitoring activities to ensure the accuracy and completeness of the recovery auditing data submitted by the DOD agencies and the military services for inclusion in the AFR. Also, document the roles and responsibilities of the Recovery Auditing Project Officer. DOD provided written comments on a draft of this report which are reprinted in their entirety in appendix IV. DOD also provided technical comments that we have incorporated as appropriate. In its written comments, DOD disagreed with all but 1 of our 13 recommendations designed to strengthen its improper payment and recovery auditing processes. DOD stated that generally the actions envisioned by our recommendations were already being accomplished within the department or were not required by OMB and thus, such direction from GAO was not necessary. We disagree. While DOD presently has efforts underway, as noted in this report, it has not yet established the processes and detailed guidance for effectively implementing either IPIA or the Recovery Auditing Act. In its comments, DOD did not provide any new evidence that was not considered in our report. Accordingly, we continue to believe that our recommendations are critical for DOD to enhance its efforts to minimize improper payments and recover those that are made. The following paragraphs illustrate the nature of DOD’s comments and our analysis of its key points. DOD disagreed with our three recommendations aimed at enhancing DOD’s risk assessment processes. We recommended the DOD Comptroller require DOD agencies and the military services to establish and implement risk assessment methodologies, along with documentation of key factors considered and the rationale for assessing the risk level for the payment activity. DOD stated that such direction was not necessary as it had established IPIA program baselines and measures and reports on all of its IPIA programs annually in accordance with OMB guidance. As described in our report, DOD’s risk assessment process was inadequate to ensure that appropriate consideration was given to the risks associated with its payment activities as we found an additional $322 billion in DOD outlays that had not been assessed under IPIA. For payment activities assessed, DOD did not require its agencies and military services to document their risk methodologies, including risk factors considered, the potential or actual impact on their program operations, and the rationale for assessing risk as either low, medium, or high. As such, none of the nine DOD components that conducted risk assessments described their methodology or rationale for the low level of risk assigned to each applicable payment activity. Given the lack of supporting documentation and evidence for the risk assessments as well as DOD’s history of long-standing internal control weaknesses, including GAO’s prior designation of eight functional DOD areas as high risk, the low risk levels are not based on sufficient analysis, are likely unrealistic, and are not reflective of the wide range of vulnerabilities that exist within DOD. DOD also disagreed with our recommendation that it develop and implement a statistically valid methodology to estimate and report commercial improper payments (contract and vendor over- and underpayments). DOD stated that it has followed guidance provided by OMB and that commercial improper payments are to be identified, recovered and reported in accordance with the Recovery Auditing Act. As described in our report, DOD stated that reporting improper commercial payments under IPIA would create duplicate reporting because this information was captured as part of DOD’s efforts to address Recovery Auditing Act requirements. However, we disagree because those actions are not sufficient to address IPIA. Both acts must be addressed with regard to commercial payment activity. Each act has a different scope of review and reporting requirements. Based on the improper payment definition under IPIA and OMB’s guidance that instructs agencies to develop a statistically valid estimate, the statistical sampling requirement would apply to commercial payments under IPIA. Developing an across- the-board, systematic estimate of the extent of improper payments gives management baseline information for measuring progress in reducing improper payments and how much investment in new internal controls would be cost-justified. DOD disagreed with our two recommendations to identify and fully disclose in the AFR the root causes of improper payments and the corrective actions, including monitoring those actions to ensure that they address applicable root causes. DOD commented that the AFR was not the appropriate forum for this detailed level information and that it had procedures in place to identify, fully disclose, and monitor corrections. We have two main concerns with DOD’s responses to these recommendations. First, DOD did not consistently follow OMB reporting requirements to identify root causes and related corrective actions and the underlying documentation of the reported corrective actions lacked details as to the corrective actions taken or planned and the corresponding results, if any. Second, because of the inherent responsibility to be a good steward for public resources, it is important that corrective actions and the effectiveness of such be openly communicated or available not only to the Congress and agency management but also to the general public. Balancing the benefits of summarizing information with reporting compliance and user needs is critical. Corrective actions cannot be effectively monitored and assessed unless the detailed corrective actions are known and tied to the root cause(s) of improper payments that they are intended to address. We made five recommendations aimed at strengthening DOD’s recovery audit processes related to establishing and implementing processes specifically designed to identify and recover commercial payments, developing detailed guidance to carry out recovery audits and activities, identifying costs related to its recovery auditing program, implementing a process to identify and report vendor overpayments and associated recovered amounts, and maintaining documentation to support reported amounts. DOD concurred with our recommendation to identify the cost related to its recovery audit program. DOD disagreed with the other four recovery auditing recommendations because it believed the agency had already established and implemented such processes. However, as we point out in this report, the majority of DOD’s processes aimed at identifying and recovering improper payments were inadequate because the primary purpose of these processes were not to identify commercial improper payments as required by the Recovery Auditing Act. For example, DCMA and DCAA’s contract closeout processes were designed to ensure that applicable administrative actions had been completed during the course of a contract (e.g., all classified documents were disposed of) and not to specifically identify contract overpayments. In addition, DOD’s current FMR guidance (dated December 2005) did not include specific elements that would be necessary to effectively carry out a recovery auditing program. Further, DOD had not established a process to fully identify and report vendor overpayments. This problem continued to exist as DOD acknowledged in its fiscal year 2008 AFR that while it was able to identify DOD-identified overpayments for its DFAS component, it was unable to identify and report vendor overpayments for all of its components and that efforts would continue until all DOD components achieved this capability. DOD disagreed with our two recommendations related to oversight and monitoring and commented that they were duplicative, except for the additional language related to documenting the roles and responsibilities of the Recovery Auditing Project Officer. We clarified our recommendations related to oversight and monitoring to emphasize the need of these activities for both IPIA and the Recovery Auditing Act. As we stated in our report, the DOD Office of the Comptroller’s oversight and monitoring of improper payment and recovery auditing activities were inadequate as the office did not verify the accuracy and completeness of information received from DOD agencies and military service components and reported in its AFR. We are sending copies of this report to interested congressional committees; the Secretary of Defense; and the Director, Office of Management and Budget. In addition, this report will be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9095 or by e-mail at dalykl@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix V. The objectives of this report were to determine whether the Department of Defense (DOD) had adequate controls in place to address the Improper Payments Information Act (IPIA) and the Recovery Auditing Act requirements.To determine whether DOD adequately addressed IPIA requirements, we reviewed the applicable legislation and related OMB implementing guidance.We further reviewed DOD’s agency financial reports (AFR) for fiscal years 2004 through 2008, internal DOD improper payment guidance, and prior GAO and DOD Office of Inspector General (DOD OIG) reports on improper payments. We reviewed these documents to understand DOD’s efforts to address IPIA requirements and to identify previously reported issues with DOD’s improper payment reporting. In addition, we performed the following work: To assess DOD’s IPIA risk assessment process to identify payment activities susceptible to significant improper payments, we reviewed our Standards for Internal Control in the Federal Government and executive guide on Strategies to Manage Improper Payments: Learning from Public and Private Sector Organizations as guidance to assess DOD’s internal controls over disbursements. We interviewed agency officials such as the Project Officer for Improper Payment and Recovery Auditing, and obtained and reviewed fiscal year 2007 IPIA responses, where available. We also compared the amounts reported as the basis for improper payments to other documentation such as the President’s Budget and Statement of Budgetary Resources to determine whether all DOD outlays were subject to improper payment assessments. To assess the statistical validity of DOD’s reported improper payment estimates for fiscal year 2007, we conducted an independent analysis of its sampling methodologies, including a review of the sampling plans for each DOD agency and military service component. In addition, we performed an independent assessment of DOD’s IPIA processes, including a legal analysis of the improper payment definition in relation to DOD’s classification of commercial payment errors (contract and vendor payments) as either improper or proper to determine whether DOD had reached appropriate conclusions. In addition, we interviewed the IPIA Project Officer, Defense Finance Accounting Service (DFAS)-Kansas City, and DFAS-Columbus officials, to identify, estimate, and reduce improper payments and reviewed supporting documentation, when available, in order to gain an understanding of DOD’s IPIA process. We also interviewed DOD OIG officials to discuss their findings and recommendations related to DOD’s efforts to address IPIA requirements. To assess DOD’s corrective action plans to reduce improper payments, we interviewed agency officials, reviewed corrective actions to reduce improper payments, and reviewed corrective action plans to determine whether appropriate linkages existed between the root causes of improper payments and specific corrective action steps. We also performed an analysis of DOD’s improper payment error rates to determine whether the improper payment error rates for DOD payment activities had changed from fiscal year to fiscal year. To assess the accuracy and completeness of DOD’s reported fiscal year 2007 improper payment amounts, we recalculated summary amounts included on DOD’s IPIA survey and traced those amounts to supporting documentation. To determine whether DOD had adequately addressed the Recovery Auditing Act requirements, we reviewed applicable legislation and related OMB implementing guidance, DOD’s AFR for fiscal years 2004 through 2008, internal DOD recovery auditing guidance, and prior GAO and DOD OIG reports on recovery auditing. We interviewed agency officials such as the Recovery Auditing Project Officer, the Director of Internal Review, and the Chief of DFAS’s Debt Management Office regarding DOD’s process to identify and recover commercial overpayments and reviewed accompanying and supporting documentation, when available. We also interviewed Defense Contract Audit Agency (DCAA) and Defense Contract Management Agency (DCMA) officials such as the DCAA Headquarters Program Manager of the Policy Programs Division and DMCA contract specialists to determine their role in DOD’s recovery auditing process and reviewed applicable guidance.Further, we interviewed DOD OIG officials such as the DOD OIG Program Director and the Audit Project Manager at DFAS-Columbus to discuss their findings and recommendations related to DOD’s efforts to address recovery auditing requirements. Also, we interviewed Department of the Navy officials regarding results of the recovery audit performed to identify overpayments made in its telecommunications program. In addition, we interviewed TRICARE Management Activity (TMA) officials to obtain clarification and supporting documentation on the healthcare-recovered amounts reported in DOD’s AFR. To assess the accuracy and completeness of DOD’s reported fiscal year 2007 recovery audit information, we reviewed DFAS and TMA supporting documentation submitted to the Office of the Comptroller to substantiate amounts reported in the AFR. We traced these schedules and total amounts submitted to the Office of the Comptroller back to various supporting breakdowns (at the transaction level). In addition, we recalculated and verified the accuracy of the recovery audit amounts in DOD’s summary recovery auditing table. We conducted site visits at two of the five DFAS processing center locations (Kansas City, Missouri and Columbus, Ohio). We selected the DFAS-Kansas City site because it was responsible for receiving IPIA survey information from other DFAS sites, compiling the information, and checking the information for accuracy and completeness. As part of this site visit, we obtained an understanding of DFAS’s process for conducting monthly postpayment reviews of military and civilian pay to identify improper payments. In addition, we selected the DFAS-Columbus site because it processed a majority of DOD’s commercial payments—the agency’s largest payment activity—on behalf of the DOD agencies and military services. Also, DFAS-Columbus was the only DFAS site that processed DOD contract payments. At the DFAS-Columbus site, we obtained an understanding of the commercial prepayment and postpayment controls in place affecting IPIA and Recovery auditing requirements. To determine the reliability of DOD’s improper payment and recovery audit information, we interviewed knowledgeable agency officials, such as the DFAS-Indianapolis Director of Accounts Payable and DFAS- Indianapolis Accounts Receivable specialists, to ascertain the procedures used to assume the quality of the data. We reviewed DOD’s commercial payment activity from its contract and vendor pay systems and its Improper Payments Online Database (IPOD) that stored the improper payment information. We also traced data back to supporting documentation, including DOD’s fiscal year 2007 IPIA survey, the AFR, and the recovery auditing activity schedule. We performed a data reliability assessment of DOD’s statistical sampling methodologies for the fiscal year 2007 reported improper payment estimates, (see appendix III). We concluded that the data were reliable for our purposes. We conducted our audit work from June 2008 to June 2009 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions, based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We obtained written comments on a draft of this report from the Under Secretary of Defense (Comptroller) and have summarized these comments in the Agency Comments and Our Evaluation section of this report. In its fiscal year 2007 Agency Financial Report (AFR), the Department of Defense (DOD) reported on five payment activities as part of its Improper Payments Information Act (IPIA) reporting: military pay, military health benefits, civilian pay, military retirement, and travel pay. The information reported in DOD’s AFR is compiled from the IPIA survey submitted by the DOD agencies and military services. DOD agencies and military services used related confidence levels over different ranges (generally, as prescribed in OMB guidance) to plan and estimate improper payment amounts reported in DOD’s fiscal year 2007 AFR. We reviewed the sample plans for each of the five payment activities, at the component level, and determined those methodologies generally complied with the Office of Management and Budget’s (OMB) implementing guidance. OMB guidance requires that applicable agencies estimate the gross total of both over- and underpayments for those programs and activities identified as susceptible to significant improper payments. OMB also requires that the estimates be based on a statistically valid random sample of sufficient size to yield an estimate with a 90 percent confidence interval of plus or minus 2.5 percentage points around the estimate of the percentage of improper payments. Alternatively, agencies may use a 95 percent confidence interval of plus or minus 3.0 percentage points around the estimate of the percentage of improper payments to estimate improper payments for agency programs. If an agency cannot determine whether a payment was proper because of insufficient documentation, OMB guidance requires that the payment be considered an error. A brief description of each payment activity’s methodology reported in its sampling plan is provided below. The military health benefits program consists of disbursements for the medical care of active duty military personnel, retirees, their family members, and family members of deceased service members. TRICARE Management Activity (TMA) processed all military health benefit payments for DOD. To estimate military health benefits improper payments, TMA selected samples from the two populations of its contract payments, as shown in table 4 below. The contract samples were drawn on a quarterly basis and stratified by dollar value. For both contract types sampled, denied payment samples were based on the amount billed and nondenied payment samples were based on government costs. The military pay program consists of military payroll disbursements. The Defense Finance and Accounting Services (DFAS) processed all military payroll payments for DOD. To estimate improper payments, DFAS-Kansas City conducted monthly postpayment reviews to determine the accuracy of net military pay using a simple random attribute sample and summed monthly results to calculate an annual estimate. In addition to its statistical sample, the military pay program’s estimate of improper payments included actual data on improper payment amounts. Table 5 shows information reported in the sampling plan for military pay. The civilian pay program consists of civilian payroll disbursements. DFAS, Army, and Navy processed civilian payments in fiscal year 2007. DFAS- Kansas City conducted monthly postpayment reviews to determine the accuracy of net pay using simple random attribute samples. In addition to monthly samples, DFAS added actual improper payment data to further enhance its estimate. DFAS monthly results were summed to calculate the annual estimate. Army’s sample plan consisted of annual postpayment reviews and analysis of a sample of disbursements, and Navy’s sample plan consisted of a statistical sample of Military Sealift Command Civilian Mariners payments. Table 6 shows detailed sampling plans for each component of the civilian pay program. The military retirement program consists of disbursements to military retirees and annuitants. DFAS processed all military retirement payments for DOD. DFAS-Cleveland performed monthly postpayment reviews to determine the accuracy of payments using simple random samples. Three samples were conducted to assess the accuracy of payments—one for deceased retirees, the other for retired accounts, and the third for annuitant accounts, as shown in table 7. The deceased retirees sample is designed to identify retiree payments going to deceased individuals, while the retired and annuitant samples identify whether regular payments are accurate. The following components processed travel payments: DFAS, Army, Navy, and Air Force. Table 8 shows detailed sample plans for each component of the travel pay program. DFAS-Indianapolis conducted random monthly reviews to determine accuracy of payments and summed monthly results to arrive at an annual sample.Army travel pay consisted of Army Korea, Army Europe, and the Army Corps of Engineers. Army Europe and Army Corps of Engineers components conducted monthly postpayment reviews of travel payments. Army Korea did not provide sampling results. Navy conducted a statistical sample of travel payments processed through its system. Air Force conducted post audit reviews of a random sample of travel payments. In addition to the contact named above, Carla Lewis, Assistant Director; Sharon Byrd; Francis Dymond; Vanessa Estevez; Patrick Frey; Jason Kirwan; Crystal Lazcano; Sophie Simonard-Norman; Pamela Valentine; and David Yoder made key contributions to this report.

Summary: The Department of Defense (DOD) is required, as are other federal executive agencies, to report improper payment information under the Improper Payments Information Act of 2002 (IPIA) and recovery auditing information under section 831 of the National Defense Authorization Act for Fiscal Year 2002, commonly known as the Recovery Auditing Act. The DOD Office of Inspector General has previously reported deficiencies at DOD related to these acts and GAO's prior work on DOD's reporting of its fiscal year 2006 travel improper payments estimate also identified shortcomings. Because of these and other long-standing weaknesses, the subcommittee asked GAO to examine DOD's fiscal year 2007 improper payment and recovery audit reporting to determine whether adequate processes existed to address both statutory requirements. To complete this work, GAO reviewed DOD's annual reports, conducted site visits, and met with cognizant DOD officials. DOD's process for addressing IPIA requirements had significant weaknesses. For example, as shown in the figure below, DOD did not conduct risk assessments for all of its payment activities as $322 billion in agency outlays were excluded from the amounts assessed. For those payment activities reviewed, DOD assessed the risk of improper payments occurring as low despite the department's long-standing financial management weaknesses and could not provide documentation supporting the methodologies used and the final risk level. GAO also found that DOD did not estimate improper payments for commercial pay under IPIA requirements, its largest payment activity. Further, the Office of the Comptroller's oversight and monitoring activities were inadequate because they did not include verifying the accuracy and completeness of the information in the agency's financial report (AFR). In addition to not estimating improper payments for commercial pay, DOD's processes for identifying and recovering commercial overpayments were inadequate, because they were not designed for this purpose as required by the Recovery Auditing Act. For example, GAO found that contract closeout processes were designed to ensure that applicable administrative actions had been completed (e.g., all classified documents were disposed of) and not to specifically identify contract overpayments. DOD also lacked detailed guidance on how to conduct a recovery audit program and did not fully address the recovery auditing reporting requirements in its AFR, such as disclosing the total cost associated with its recovery auditing activities. The Office of the Comptroller also did not verify the accuracy and completeness of the recovery audit information in the AFR, which resulted in $20.5 billion being excluded from its universe of commercial payments. DOD stated that its processes were sufficient to address the requirements of both acts, but since then has taken some actions, such as updating relevant guidance. Until these critical deficiencies are addressed, DOD will be unable to determine the extent to which improper payments exist and are subsequently recovered.