In 1968, Congress created NFIP to address the increasing cost of federal disaster assistance by providing flood insurance to property owners in flood-prone areas, where such insurance was either not available or prohibitively expensive. The 1968 law authorized subsidies to encourage community and property owner participation. To participate in the program, communities must adopt and agree to enforce floodplain management regulations to reduce future flood damage. In exchange, NFIP makes federally backed flood insurance available to homeowners and other property owners in these communities. Since NFIP was established, Congress has enacted legislation to strengthen certain aspects of the program. For example, the Flood Disaster Protection Act of 1973 made the purchase of flood insurance mandatory for properties in Special Flood Hazard Areas (SFHA)—areas at high risk for flooding—that are secured by mortgages from federally regulated lenders and located in NFIP participating communities. This requirement expanded the overall number of insured properties, including those that qualified for subsidized premiums. The National Flood Insurance Reform Act of 1994 expanded the purchase requirement for federally backed mortgages on properties located in an SFHA. FEMA bases premium rates for NFIP policies on a property’s risk of flooding and other factors. FEMA studies and maps flood risks, assigning flood zone designations from high to low depending on the risk of flooding. For example, SFHAs are high-risk areas that have a 1 percent or greater annual chance of flooding and are designated as zones A, AE, V, or VE. Areas designated as V or VE are located along the coast and are at risk of 3 foot or higher breaking waves. Areas designated as A or AE can be located along the coast or inland. Zones B, C, or X are areas with a moderate-to-low risk for flooding. Zone D denotes areas for which flood risk analysis has not been conducted. FEMA also uses property characteristics in setting premium rates, such as elevation of the property relative to the property’s base flood elevation (BFE)—the level relative to mean sea level at which there is a 1 percent or greater chance of flooding in a given year—and building type (residential or nonresidential). Additionally, FEMA uses policy characteristics in setting premium rates, such as coverage and policy deductible amounts. NFIP has two types of premium rates: those that reflect the full risk of flooding to the group of properties within a rate class (full-risk rates) and those that do not reflect full risk (subsidized rates). The largest number of subsidized policies has been for properties built before FIRMs became available. Even with highly discounted rates, subsidized premiums are, on average, higher than full-risk premiums. Full-risk rated structures have been built to flood-resistant building codes or have mitigated flood risks and generally are at or above BFE. However, FEMA can calculate full- risk rates for structures that are up to 15 feet below BFE in A zones, and 10 feet below BFE in V zones. Pre-FIRM subsidized properties generally were not constructed according to the program’s building standards or were built without regard to BFE. Therefore, subsidized structures generally are assumed to be more prone to flooding (that is, riskier) than other structures and premiums are higher, even with the subsidy. For example, according to FEMA’s flood insurance manual effective October 1, 2014, the costs of building and contents coverage for subsidized policies in an AE zone were higher than coverage for a similar full-risk policy at 1 foot above BFE. Although the percentage of policies that is subsidized and percentage of premiums from these policies relative to all NFIP policies has decreased over time, the number of subsidized policies has not changed greatly. In 2012, subsidized policies accounted for about 20 percent of NFIP policies. From 1978 through 2012, the percentage of policies that was subsidized decreased because the number of total policies increased, but the numbers of subsidized policies stayed fairly constant (see fig. 1). Similarly, the percentage of premiums from subsidized policies decreased from 1978 to 2012. In 2012 premiums from subsidized policies represented 38 percent of all NFIP premiums (see fig. 2). The Biggert-Waters Act and HFIAA affected NFIP’s ability to charge subsidized premium rates on certain types of properties and will change the number of policies that are subsidized as well as the size of the subsidy. For example the Biggert-Waters Act prohibited subsidies from being extended for homes sold to new owners after July 6, 2012 (date of enactment) and removed them if properties lapsed in coverage as a result of the policyholders’ deliberate choice. Under the changes in the Biggert-Waters Act, the number of subsidized policies could have decreased over time. HFIAA reinstated premium subsidies for properties that were purchased after July 6, 2012, and properties not insured as of July 6, 2012. Thus, new policies may join NFIP and receive subsidized rates and the number of subsidized policies could increase over time. However, provisions under both acts changed the status of subsidies and decreased the size of subsidies by annually increasing subsidized rates. The Biggert-Waters Act required FEMA to phase out subsidies—annually increasing premiums by 25 percent until full-risk rates were reached—for certain types of properties, including business properties, residential properties that are not a primary residence, properties that have experienced or sustained substantial damage or improvement, and severe repetitive loss properties. HFIAA did not affect the phase out schedule of these subsidies—which represented about 41 percent of all subsidized policies, as of September 30, 2013 (see fig. 3). Under HFIAA, FEMA also generally must increase premium rates on other subsidized policies by 5–15 percent annually. The time that will be required for subsidized rates to reach full-risk rates varies by flood zone, coverage amounts, and elevation relative to BFE. At the level of the rate increases to phase out certain subsidies required under the Biggert-Waters Act (25 percent per year), some policyholders could continue to benefit from subsidized rates for 12 years or more. For annual increases of 15 percent under HFIAA, phase-out times for subsidies will be longer. For annual increases of 5 percent, policyholders could continue to benefit from subsidized rates for more than 30 years. For example, figure 4 shows the different timelines for a subsidized single-family policy in an AE flood zone to reach the full-risk rate (with the number of years varying according to amount of coverage, elevation relative to BFE, and the percentage of the annual rate increases). As FEMA increases subsidized rates, at some point a policyholder may have an incentive to obtain an elevation certificate and pay the full-risk rate rather than the subsidized rate because the full-risk rate would be lower. For example, a policyholder choosing $250,000 in building coverage for a currently subsidized AE zone policy at BFE would pay a lower full-risk rate than the subsidized rate if the policyholder documented the elevation with an elevation certificate. If a policyholder chose to supply an elevation certificate, FEMA would charge the lower of the full-risk and subsidized rates. FEMA sells and services NFIP policies primarily through private insurance companies that participate in the Write-Your-Own (WYO) program. Insurance agents from these companies are the main point of contact for most policyholders. FEMA compensates the companies based on a percentage of the premiums and claims for policies they manage. WYOs adjust, settle, and pay flood claims, as well as handle lawsuits arising from claims. Based on information the insurance agents submit, WYOs issue policies, collect premiums, deduct an allowance for commissions and operating expenses from the premiums, and remit the balance to NFIP. When flood losses occur, policyholders report them to their insurance agents, who notify the WYOs. The WYOs review the claims and process approved claims for payment. FEMA reimburses WYOs from the National Flood Insurance Fund for the amount of the claims plus a percentage of the claims to cover adjusting and processing expenses. FEMA has modified its WYO compensation methodology over time. Although WYOs handle most flood policies, FEMA also contracts with a company that serves as FEMA’s direct agent. The direct agent sells and services standard policies, but also exclusively sells and services repetitive loss and group policies. The direct agent is compensated through the contract rather than with a percentage of premiums and claims. The WYOs and FEMA’s direct agent submit information on new and renewed policies and claims to FEMA’s policy and claims data system. As part of its monitoring and oversight responsibilities, FEMA conducts operational reviews of the direct agent annually, and WYO companies about every 3 years. FEMA funds NFIP primarily through insurance premiums and fees paid by policyholders. FEMA uses NFIP premiums to pay insurance claims (losses) and all program expenses, including salaries, outreach, research, and operating expenses. When premiums are insufficient to cover these losses and expenses, FEMA may borrow money from Treasury. NFIP’s program expenses are either variable (increase with premium increases) or fixed (do not change with premium increases). Variable expenses include state or local premium taxes, and WYO commissions and expenses. Fixed expenses include NFIP salaries, floodplain mapping, mitigation grants, contractor costs, and the direct agent. In addition to premiums, NFIP collects a policy fee from each policyholder that covers a portion of the fixed expenses. After expenses, FEMA uses the remainder of premiums to pay for losses and debt repayment (see fig. 5). FEMA does not collect the flood risk information for most subsidized policies and therefore cannot accurately determine forgone premiums (the difference between subsidized premiums paid and the premiums that would be required to cover the full risk of losses) associated with subsidized policies. FEMA has not required all policyholders to submit flood risk information, specifically elevation certificates, which are needed to determine their full risk, because it does not use the information in rating subsidized policies. In implementing the Biggert-Waters Act, FEMA began requiring certain policyholders to submit elevation information upon renewal or when new policies were issued as required for full-risk rates. However, according to FEMA officials, FEMA will not continue to collect this information with the restoration of these subsidies under HFIAA. According to FEMA officials, obtaining elevation certificates can cost policyholders from about $500 to $2,000 or more. Therefore, the information needed to accurately measure forgone premiums associated with subsidized policies is not available. We previously recommended that FEMA collect flood risk information from all affected policyholders in SFHAs. In July 2013, we found that to phase out and eventually eliminate subsidies specified under the Biggert- Waters Act and revise rates over time, FEMA would need information on the relative risk of flooding and property elevations (elevation certificates), which generally had not been required for subsidized policies prior to the act. We recommended that FEMA develop and implement a plan to obtain the flood risk information needed to determine full-risk rates for properties with subsidized rates. FEMA agreed with the recommendation and as part of our current review said that it was evaluating different approaches for obtaining the information and using it more broadly. FEMA officials also stated that obtaining this information from other sources is very difficult because BFEs are not available on the maps for about 500,000 subsidized policies and some technologies for obtaining elevations lack precision. FEMA officials stated that they will continue to rely on policyholders to voluntarily obtain elevation certificates. Policyholders with structures at lower risk (higher elevations relative to BFE) have an incentive to obtain the certificates because they can qualify for lower rates. However, policyholders with structures at higher risk (lower elevations relative to BFE) have no incentive to obtain an elevation certificate. Thus, it is unlikely that FEMA will collect flood risk for all properties relying only on voluntary submissions. Although FEMA has taken some steps, we maintain the importance of fully implementing this recommendation and obtaining flood risk information to measure accurately forgone premiums associated with subsidies. Under HFIAA, FEMA must increase subsidized premium rates for all but certain properties by 5–15 percent annually, which eventually should phase out all pre-FIRM subsidized rates. FEMA will need the property-level information for these subsidized policies and the policies with subsidies that are being phased out through the annual 25 percent increases under the Biggert-Waters Act, to know when the relevant subsidized premium rate reaches the full-risk rate for any given policy. Obtaining information that would allow for measuring forgone premiums associated with subsidies also is important because although the size of subsidies will decrease under HFIAA, the number of subsidized policies could increase over time and continue to affect the financial stability of the program. Historically, the percentage change in subsidized policies generally followed the same trend as the percentage change in total policies (see fig. 6). FEMA has begun to collect elevation information for policyholder disclosure purposes as required by HFIAA, but according to FEMA officials they have not determined it to be of sufficient quality for use in determining full-risk rates, which would be required to measure forgone premiums. HFIAA requires FEMA to clearly communicate full flood risk determinations to individual property owners regardless of whether their premium rates are full actuarial rates or subsidized. Additionally, information about risk is important in that it can influence behavior, such as purchase decisions and decisions to mitigate risk. According to FEMA officials, in response to the HFIAA provision, FEMA has begun gathering relevant information from publicly available sources and considering formats for disclosing the information to policyholders. Additionally, they said that FEMA has an ongoing pilot program in North Carolina to use Light Detection and Ranging (LIDAR) technology and flood maps to determine flood risk at the property level. According to FEMA officials, the information from these two efforts could give an order of magnitude for the risk, but may not be of sufficient quality to use in rating policies. This information also may not be of sufficient quality to measure forgone premiums associated with subsidized policies. Although the information to measure actual forgone premiums for subsidized policies was not available, using available information we estimated forgone premiums for 2002–2013 to be roughly $16–25 billion and $11–17 billion net of expenses. We were unable to calculate the actual forgone premiums for subsidized policies because, as stated previously, FEMA does not have the information required to determine flood risk for most of these policies. Therefore, to estimate forgone premiums we used two statements about the subsidy’s impact on NFIP premiums that are included in FEMA’s actuarial rate reviews for 2002– 2013. Impact on aggregate premiums. If FEMA were to eliminate the subsidy for the approximately 20 percent of policies with subsidized rates, while leaving the unsubsidized policies unchanged, the aggregate premium for the entire NFIP would increase approximately 50–75 percent. Percentage of expected long-term losses covered by subsidized premiums. The subsidized pre-FIRM properties are estimated to pay 45–50 percent of the full-risk premium needed to fund the long-term expectation for losses. That is, subsidized policyholders pay 45–50 percent of what they would pay if they were charged full rates. FEMA first reported this percentage as 35–40 percent for 2002, but gradually increased the percentage after making adjustments to the subsidized rates. We note several limitations to using these statements to produce our estimates. First, FEMA officials said the statements should not be considered definitive or precise; therefore, our estimates also are not precise. The officials stated they based the statements on their analysis of a 1999 PricewaterhouseCoopers (PwC) report, which sampled pre- FIRM structures around the nation, determined their flood zones, elevations relative to BFE, and full-risk rates, and then projected a nationwide distribution of the policies. FEMA officials said they used this information to arrive at the 35–40 percent estimate for 2002. They used professional judgment to make adjustments to the statements over the years based on how rate increases for subsidized policies compared with inflation. Second, relying on these statements limited the scope of our analysis because FEMA did not include these statements in actuarial reviews for years before 2002. Therefore, we could not estimate the total historic forgone premiums of these subsidies and limited our scope to 2002–2013. In the past, FEMA subsidized a much larger percentage of policies (76 percent in 1978, compared with 21 percent in 2013), so current estimates should not be applied to previous years. Third, FEMA’s statements do not account for any changes in program participation that could result from increasing the premium rates of subsidized policies to full-risk rates. According to FEMA officials and insurance industry stakeholders, higher premiums could have resulted in reduced participation in NFIP over time as policyholders either decided to drop policies or were priced out of the market. The 1999 PwC study estimated a possible 50 percent decrease in participation by affected property owners if subsidies were immediately eliminated. This drop in participation could result both in lower premium revenues and lower losses, so the net effect on the program of eliminating subsidies would be unclear. FEMA officials stated that increased rates likely resulted in some property owners forgoing flood insurance when FEMA began charging full-risk rates for properties that previously would have qualified for subsidized rates (in the short time after the Biggert-Waters Act was implemented and before HFIAA was enacted). Had FEMA substantially increased subsidized rates in earlier years, it likely would not have collected the total amount of forgone premiums we estimate in this report. Considering these limitations, we relied on FEMA’s statements in producing our estimates because they provide the only information available about the relationship of subsidies and full-risk rates for the period we reviewed. We estimated the range of forgone premiums using three different calculations to illustrate the potential magnitude of forgone premiums associated with subsidized policies. Table 1 summarizes the estimated forgone premiums and forgone premiums net of expenses from each calculation using FEMA’s statements, as discussed above. For the first estimate, we used FEMA’s statement about the impact of eliminating subsidies on aggregate premiums. For the second estimate, we used the percentage of long-term expected losses covered by subsidized premiums. For the third, we used the percentage of long-term expected losses covered by subsidized premiums to estimate forgone premiums for only the policies that remained subsidized after HFIAA. We estimated forgone premiums at $16–25 billion during 2002–2013, using FEMA’s statement that eliminating subsidies would increase NFIP premiums 50–75 percent after expenses. As discussed previously, some program expenses increase as premiums increase. Therefore, FEMA also would have incurred additional expenses if the agency had been able to collect the forgone premiums. We estimated that FEMA might have had $11–17 billion in premiums net of expenses. This amount—as much as $1 billion a year—could have been available for losses or debt repayment. Figure 7 shows the estimated annual aggregate NFIP premiums had subsidies been eliminated. The low bar assumes a 50 percent increase in aggregate NFIP premiums and the high bar assumes a 75 percent increase. We estimated $18–23 billion in forgone premiums during 2002–2013, using FEMA’s second statement that subsidized premiums cover 45–50 percent of long-term expected losses. As FEMA also would have incurred additional expenses if it had been able to collect the forgone premiums, we estimated that FEMA might have had $13–16 billion in premiums net of expenses. This amount could have been available for losses or debt repayment. These ranges fall within those estimated in our first approach. In this approach, we estimated the difference between premiums for subsidized policies and their assumed full-risk premiums based on FEMA’s stated percentage ranges. Figure 8 shows the estimated full-risk premiums for subsidized policies. Each bar depicts the annual subsidized premiums actually collected and the estimated forgone premiums, assuming the low and high ends of FEMA’s statements about the percentage of losses covered by subsidized premiums. Finally, we estimated forgone premiums attributable to policies that would remain subsidized after HFIAA. We refer to remaining subsidized policies as those with subsidized premiums not subject to FEMA’s 25 percent annual increases. As discussed earlier, FEMA is phasing out subsidies— through 25 percent annual increases—including for nonprimary residences, severe repetitive loss properties, and business properties, as required by the Biggert-Waters Act. Under HFIAA, FEMA also generally must increase premium rates on other subsidized policies by 5–15 percent annually. See figure 9 for a comparison of estimated forgone premiums for subsidies subject to 25 percent annual increases and remaining subsidies. We estimated forgone premiums for the remaining subsidized policies would have been $11–14 billion during 2002–2013, again using FEMA’s statement that subsidized premiums cover 45–50 percent of long-term expected losses. As FEMA also would have incurred additional expenses if it had been able to collect the forgone premiums, we estimated that FEMA might have had $8–9 billion in premiums net of expenses. This portion could have been available for losses or debt repayment. This estimate is lower than our estimates from the second calculation because it includes only a subset of the subsidized policies—those that remained subsidized after the Biggert-Waters Act and HFIAA changes. FEMA did not proactively validate or monitor implementation of data system changes, which resulted in unreliable premium data that were unable to be used for a fourth estimation of forgone premiums. FEMA needed to modify its data system to implement the changes required in the Biggert-Waters Act, but did not have sufficient controls in place to validate that the changes made were complete and accurate. FEMA provided the contractor that maintains its policy data system instructions for changes in the system, including adding new data fields (such as the date of purchase), adding new risk-rating methods to calculate premiums for policies affected by the Biggert-Waters Act, and developing new edit checks. For example, because FEMA had to charge full-risk rates for policies that previously would have qualified for subsidized rates, changes had to be programmed into the system to identify and require elevation certificates for the affected policies (both new and renewing). Software vendors that WYOs and FEMA’s direct agent use to assist them with servicing flood insurance policies also received these instructions. FEMA also published a new Flood Insurance Manual that included updated rate tables and instructions on rating these policies. According to its usual process, FEMA released instructions for most of the changes 6 months before changes were to be effective. FEMA also issued three additional sets of changes at 5 months, 3 months, and 2 months before changes were to be effective. In total, FEMA released more than 350 pages of instructions to the contractor and vendors, the most changes released in the last several years. The changes became effective on October 1, 2013. In an attempt to illustrate forgone premiums, we analyzed over 260,000 pre-FIRM policies for primary residences sold between the date these changes were effective (October 2013) and the enactment of HFIAA (March 2014) and found discrepancies in premium data for some of these policies. To illustrate how forgone premiums could be measured accurately if flood risk information were available for subsidized policies, we planned to compare the reported full-risk premiums in the data system with hypothetical subsidized premiums we could calculate based on policy information in the data. However, our preliminary results revealed discrepancies in FEMA’s reported premiums for some of these policies. These discrepancies, as well as limited monitoring of the contractor’s progress toward completion of data system changes, called into question the reliability of the reported premium data in the system and prevented completion of our analysis. Specifically, Some policyholders who should have paid full-risk rates after the Biggert-Waters Act were inaccurately charged subsidized rates. According to our analysis, 49 percent of the new policies that should have paid full-risk rates from October 1, 2013, through February 28, 2014, were charged subsidized rates instead. We found that more than 20 WYOs inaccurately charged subsidized rates for policies rather than full-risk rates, but most of the policies were sold by a few WYOs and FEMA’s direct agent. FEMA also found these errors during its annual operational review of the direct agent about 6 months after the changes were effective. According to FEMA, no corrections were made to the affected policies because by that time HFIAA had been enacted which reinstated subsidies for this category of policies. FEMA officials stated that most of these errors were attributable to software provided by the company that is both the direct agent to FEMA and a software vendor for WYOs. FEMA officials stated that the vendor subsequently made the necessary corrections to its software. Although FEMA officials said that they did not suspect problems with additional vendors, we could not verify this because we did not have information on which vendor software was used by each WYO. FEMA’s standard controls for its data system did not detect or report erroneous premium rates submitted by WYOs and FEMA’s direct agent and policyholders were under- or overcharged. Typically, FEMA’s data system, which is administered by a contractor, automatically checks the premiums submitted by WYOs or its direct agent when rating a new or renewed policy. If a discrepancy is detected, an error code is generated and sent to the WYO or the direct agent for correction. However, for one class of policies in our analysis—new policies that were rated using one of the new Biggert- Waters Act-related risk-rating methods to calculate premiums—our preliminary results showed that about 28 percent of these policyholders paid at least 5 percent more in premiums than they should have, or paid at least 5 percent less in premiums than they should have based on the rates available in FEMA’s data. Additionally, for another class of policies—those rated tentatively or provisionally (about 4,400 policies—about 2 percent of policies in our analysis)—about 45 percent of policies analyzed had premiums that were off by more than 5 percent based on the rates available in FEMA’s data. Including both of these groups, more than 30,000 policies were affected. FEMA officials acknowledged these errors. Automatic edit checks were not performed on these policies, so the system did not detect or report these errors. After we discussed these discrepancies with FEMA officials, they conducted an inquiry with the contractor in August and September 2014. As a result, the contractor informed FEMA that it had not implemented all the required system changes before the effective date and that it had disabled some automatic edit checks. According to documentation from the contractor, the contractor did not sufficiently communicate either issue to FEMA. Because the edit checks were inoperative, FEMA did not receive complete error reports and its controls, such as monitoring data system error rates and reviewing error reports, did not identify any problems. In response, FEMA required the contractor to implement the changes within 10 days or be in violation of the contract. Changes included implementing automatic checks on premiums calculated using the new Biggert-Water Act rating methods and enabling error checks on new data fields (such as the date of purchase). According to contractor documentation, the contractor implemented most of the changes as of September 2014. As of October 2014, FEMA had not yet verified these changes. FEMA’s monitoring was not sufficient to identify problems with the contractor’s implementation of system changes before changes were effective. FEMA has processes in place to monitor contractor performance, but monitoring reports provided minimal information on the progress of the data system changes. For example, the contractor submits weekly performance reports and presents information from these reports in monthly reports that are reviewed by FEMA contracting office staff and the contracting officer’s representative. The reports also are available to management. The monthly reports track risks and issues associated with selected objectives, key milestones, and the progress toward completion of these objectives. We reviewed the reports from April 2013 through June 2014 and found that the weekly contractor performance reports included documentation of FEMA providing the contractor clarifications. However, the reports included minimal information on the progress of the implementation of the data system changes—stating, for example that programming changes were continuing—with many weeks passing without updates. Furthermore, the monthly reports that are available for management to review did not track the status of the data system changes. Following FEMA’s inquiry about the data discrepancies described previously, the contractor informed FEMA that 50 percent of the changes scheduled to be effective on October 1, 2013, had been implemented by the required date and 70 percent of the changes scheduled to be effective on June 1, 2014, had been implemented by the required date. Federal internal control standards and FEMA’s data system manual and contracting officer’s representative handbook provide guidelines for controls and monitoring. For example, the internal control standards and data system manual state that error checks should be implemented to help ensure the accuracy of data being entered and that changes should be verified. Specifically, according to federal internal control standards, data validation and edit checks should be performed at all interfaces with other systems to identify erroneous data. Erroneous data should be captured, reported, investigated, and promptly corrected, according to internal controls and FEMA’s data system manual. In addition, controls should be in place to determine whether changes to technology have been made properly. This may involve reviewing changes and testing results. Further, FEMA’s data system manual states that a system check (to verify the premium) is to be performed for all policies that have the data required to calculate the premium. Errors associated with this verification should be noted on the file. Regarding monitoring, FEMA’s handbook for contracting officer’s representatives states that these representatives are responsible for monitoring the contractor’s compliance with all requirements of the statement of work and reporting any potential or existing problems. Such monitoring enables the agency to ensure progress toward completion of the contractor’s specific requirements. One objective in the data contractor’s statement of work is implementing data system changes as required. FEMA provided the contractor, WYOs, and vendors with instructions for implementing changes, including adding edit checks for new data elements, but its controls were not sufficient to identify problems with the contractor’s and vendors’ implementation of the changes before the changes were effective. FEMA did not verify the contractor’s implementation of programming changes and edit checks before the rating changes became effective. FEMA officials told us they provided the contractor and vendors the requirements 6 months before they were to be effective—which is the typical process—and that regular reports from the contractor and other correspondence with the contractor to provide clarifications did not indicate any problems or delays with implementation of the changes. Further, FEMA did not take any additional steps to ensure that the contractor had implemented the data system changes until August after we identified a number of discrepancies. FEMA does not verify that changes in vendors’ software that assists agents in generating rates are correctly implemented before the changes are effective. FEMA officials said that the WYOs and FEMA’s direct agent are responsible for monitoring their software vendors and that FEMA does not have direct oversight. FEMA officials noted that they rely on processes such as data system monitoring and error report reviews to identify errors from the contractor or vendors, and that they did not identify these errors sooner because edit checks were inoperable. Documentation from the contractor in response to FEMA’s August and September 2014 inquiries states that it revised the edit check strategy without FEMA’s approval. In addition to insufficient controls, FEMA’s monitoring reports did not contain sufficient information to identify problems with the implementation of the changes before the changes were effective. FEMA maintained documentation of change requests and responses provided to the contractor’s questions and has regular reports from the contractor to monitor performance, but these documents did not capture critical information needed to oversee the contractor’s progress toward completion of the data system changes. For example, the template for monthly monitoring reports includes tracking of key milestones and status of the percentage complete, but FEMA did not direct the contractor to track the progress of implementing data system changes in these reports, even though the number of required data system changes was the most changes released in the last several years. As a result of not proactively monitoring or verifying the implementation of data system changes, premium data for the policies between the implementation of the Biggert-Waters Act and enactment of HFIAA were unreliable and some policyholders were charged inaccurate rates. We determined that the premium data for these policies did not meet GAO reliability standards for our planned analysis to illustrate forgone premiums. In addition, FEMA officials stated that they used the data from this time period to characterize policies that previously qualified for subsidies but were charged full-risk rates. Because of inaccuracies in these data, FEMA cannot rely on these data for business planning or other purposes. Furthermore, because WYOs and FEMA’s direct agent did not consistently apply rating changes between the implementation of the Biggert-Waters Act and enactment of HFIAA, our analysis shows that subsidized rates were incorrectly applied to at least 50,000 policies that should have been charged full-risk rates, and at least 30,000 other policyholders were over- or undercharged. The financial impact to NFIP of these inaccurate rates may have been negligible because HFIAA repealed many of the Biggert-Waters Act immediate subsidy removal provisions and required refunds to policyholders who again qualified for subsidized rates. However, the errors demonstrate that FEMA lacks sufficient controls over implementing changes to its data system. Without validating that the contractor and vendors have fully implemented changes and edit checks before processing refunds (scheduled for October through December 2014) and making additional changes associated with HFIAA (scheduled for April 2015), FEMA risks further inaccuracies in its data. In addition, without monitoring progress toward completion of data system changes, FEMA may not be aware of the full extent of problems its typical error reports may identify and would have inadequate information to oversee the performance of the contract. Our analysis shows that forgone premiums associated with subsidies could be as much as $1 billion dollars a year, but our estimates are imprecise because of the lack of information on policies’ flood risk. FEMA agreed with our previous recommendation (from July 2013) that it develop and implement a plan to obtain information on the relative risk of flooding and property elevations for subsidized policies. We acknowledge the difficulty and expense involved in obtaining precise flood risk information, but maintain the position that our recommendation is valid and should be fully implemented because the number of subsidized policies could grow under HFIAA. Flood risk information (such as from elevation certificates) is needed to correctly charge full-risk rates to an increasing number of policies as FEMA phases out subsidies, but FEMA continues to rely on policyholders to voluntarily submit it. In addition, such information could help FEMA provide policyholders information about their flood risk as required by HFIAA. FEMA did not proactively validate or monitor the implementation of large- scale changes to its data system before the rating changes became effective, and the reliability of premium data and other information submitted to its system was compromised. In addition, FEMA was unaware of the extent of delays and errors in its data system. Federal internal control standards call for agencies to have controls in place to help ensure the accuracy of all transactions and to determine if data system changes have been made properly. FEMA’s contracting officer’s representative handbook also states that a contractor’s performance should be monitored to ensure progress toward completion of specified requirements. However, FEMA lacked sufficient controls to oversee its contractor’s and software vendors’ implementation of data system changes before the changes were effective and therefore premium data and other information on policies subject to full-risk rates between October 1, 2013, and March 21, 2014 (the enactment of HFIAA) are unreliable. The consequences of the data unreliability are broad, affecting programmatic decision making (such as rate setting), accuracy of policyholders’ rates, and stakeholders that rely on the accuracy of FEMA’s data. Moreover, FEMA is planning further changes to its system in 2015. Monitoring progress toward completion and adding controls, such as data validation, as FEMA processes refunds and implements the additional changes can help ensure proactively that accurate data on policies are recorded, policyholders are charged appropriate rates, and inaccuracies are not further propagated in FEMA’s data system. To better ensure that future data system changes are fully and accurately implemented before they become effective, we recommend that the Secretary of the Department of Homeland Security (DHS) direct the FEMA Administrator to take the following three actions: Institute internal controls, such as testing a sample of policies, to validate that the data system contractor fully implemented changes and edit checks before program changes become effective. Obtain information verifying the status of software vendors’ implementation of program changes in their systems before program changes become effective. For example, this could include instructing WYOs and the direct agent to include controls or status updates in the terms of work or contracts with their software vendors. Require the data system contractor to include detailed information on the progress toward completion of major data system changes in regular monitoring reports, such as weekly status updates and monthly reports. We provided a draft of this report to FEMA within DHS for its review and comment. DHS provided written comments that are presented in appendix II. In its letter, DHS concurred with our three recommendations and has begun taking actions to address two. First, to respond to the recommendation for internal controls to validate system changes, FEMA has instituted a test plan that will be used to validate the October 2013 and June 2014 system changes as well as future changes. Second, to respond to the recommendation for enhanced reporting by the data system contractor, FEMA has been developing a standard operating procedure to monitor progress toward completion of major data system changes. In addition, DHS stated that FEMA will work with the WYOs to obtain information on the status of their vendors’ implementation of system changes beginning with changes scheduled for April 2015. FEMA also provided technical comments, which we have incorporated in the report, as appropriate. We are sending copies of this report to the appropriate congressional committees and the Secretary of Homeland Security. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you have any questions about this report, please contact me at (202) 512-8678 or cackleya@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. The Biggert-Waters Flood Insurance Reform Act of 2012 (Biggert-Waters Act) mandated that we conduct a number of studies about the National Flood Insurance Program (NFIP), including a study on the cost of forgone premiums of the properties that receive subsidized rates. This report discusses the estimated forgone premiums for subsidized policies during 2002–2013, and issues we identified surrounding modifications made to the Federal Emergency Management Agency’s (FEMA) data system to implement changes required under the Biggert-Waters Act. To estimate forgone premiums, we compiled information on premiums from the NFIP policy databases of FEMA, and information on expenses and published statements regarding the size of the subsidy from FEMA’s actuarial rate review documents. First, to obtain the number and premiums associated with all NFIP policies, all subsidized policies, and subsidized policies that would continue to receive subsidized premium rates (those not subject to 25 percent annual increases) after the Homeowner Flood Insurance Affordability Act of 2014 (HFIAA), we analyzed data from NFIP’s policy database. These data represent snapshots from the end of fiscal years 2002–2013. We applied the same algorithm that FEMA used to determine which policies were subsidized before the Biggert-Waters Act, and applied FEMA’s interpretation of the provisions in the Biggert-Waters Act that eliminated subsidies and the provisions in HFIAA that restored subsidies. We adjusted all premium amounts for each year into 2014 dollars by applying gross domestic product (GDP) price indexes provided by the Bureau of Economic Analysis. Second, to determine the percentage of NFIP premiums required for fixed and variable expenses for each year, we obtained historical information on NFIP expenses for 2002–2011, and projected expenses information for 2012–2013 from FEMA’s actuarial rate reviews. Third, to obtain FEMA-published information on the size of the subsidy, we compiled the percentage amounts for the following statements from FEMA’s actuarial rate reviews for 2002–2013: If subsidies were eliminated, aggregate NFIP premiums would increase by 50–75 percent after expenses. Subsidized premiums, on average, cover 45–50 percent of expected full-risk losses after expenses. With all information compiled, for each year, we selected the relevant premiums (premiums from all NFIP policies, all subsidized policies, and subsidized policies that would continue to receive subsidized premium rates after HFIAA), and applied the FEMA statements about the size of the subsidy to three calculations to estimate forgone premiums. First, we used aggregate NFIP premiums and FEMA’s statement that if subsidies were eliminated, overall NFIP premiums would increase by 50–75 percent after expenses. Second, we used all subsidized premiums and FEMA’s statement that subsidized premiums, on average, cover 45–50 percent of full-risk losses. Third, we used subsidized premiums for the portion of subsidized policies with characteristics that would have allowed them to receive subsidies after HFIAA and the same statement that subsidized premiums, on average, cover 45–50 percent of full-risk losses. Using the relevant premiums we performed the following: To estimate the high and low values of the range for forgone premiums net of expenses for each year for the first calculation, we subtracted expenses from the premiums collected and multiplied the result by the high and low values of the percentage range. To estimate the high and low values of the range for forgone premiums net of expenses for each year for the second and third calculations, we subtracted expenses from the premiums collected (premiums collected net of expenses) and divided the premiums collected net of expenses by the high and low values of the percentage range. We then subtracted premiums collected net of expenses from the result. To estimate the high and low values of the range for forgone premiums for each year for each calculation, we increased the high and low values of the range for forgone premiums net of expenses by the variable expense percentage. Finally, to estimate the high and low values of the range for forgone premiums and forgone premiums net of expenses for 2002–2013 for each calculation, for all years we added the low-range values together and the high-range values together. We assessed the reliability of FEMA’s policy and expense data by gathering and analyzing available information about how the data were created and maintained and performed electronic tests of required data elements of the policy data. We determined that these policy and expense data were sufficiently reliable to use for the three calculations described above. FEMA officials said that the statements about the size of the subsidy should not be considered precise or definitive. They stated they based their statements about the size of the subsidy for 2002 on their analysis of a 1999 PricewaterhouseCoopers (PwC) report that sampled structures around the nation that were built before flood insurance rate maps (FIRM) became available, determined their flood zones, elevations relative to base flood elevation (BFE), and full-risk rates, and then projected a nationwide distribution of the policies. FEMA officials stated that they used professional judgment to make adjustments to the statements about the size of the subsidy for 2003–2013 based on how rate increases for subsidized policies compared with inflation. FEMA officials stated that these statements were the only information available on the size of the subsidy. Therefore, we used them, but we added caveats to our estimate and noted the several limitations to using these statements to produce our estimates. First, as previously noted, FEMA officials said the statements should not be considered definitive or precise; therefore, our estimates also are not precise. Second, relying on these statements limited the scope of our analysis because FEMA did not include these statements before 2002. Therefore, we could not estimate the total historic forgone premiums of these subsidies and limited our scope to 2002–2013. In the past, FEMA had subsidized a much larger percentage of policies (about 76 percent in 1978, compared with 21 percent in 2013), so current estimates should not be applied to previous years. Third, FEMA’s statements do not account for any changes in program participation that could result from increasing the premium rates of subsidized policies to full-risk rates. Additionally, we attempted to calculate hypothetical subsidized premiums for primary residential policies that for a short, recent period paid full-risk rates but that would have qualified for subsidies before the Biggert- Waters Act. We planned to compare the hypothetical premiums with the full-risk premiums policyholders actually paid. FEMA began charging full- risk rates to new policies in this category on October 1, 2013, but HFIAA (enacted in March 2014) repealed the provision to charge full-risk rates to these policies. Therefore, for these calculations, we used FEMA’s policy rating methodology and obtained NFIP policy data as of February 28, 2014, and selected policy records with effective dates from October 1, 2013, through February 28, 2014. To select records that would have qualified for a subsidy before the Biggert-Waters Act, we applied a modified version of FEMA’s algorithm to determine which policies were pre-FIRM, primary residence policies in special flood hazard areas without consideration of elevation. We used two methodologies to determine which policies were new and therefore immediately subject to full-risk rates; however, changes affecting data fields we used in these methodologies were among those that had not been implemented by the contractor, thus impacting our ability to complete the analysis. First, we used FEMA’s rating method field that would indicate (according to FEMA documentation) that the policy was affected by the Biggert-Waters Act. Using this method, we found the policies that FEMA officials acknowledged had been erroneously charged subsidized rates. Second, at FEMA officials’ suggestion, we used a data field that would indicate a new policy and the new purchase date field. Similarly, we found that many policies had been charged subsidized rates and that the new purchase date field was unreliable because of either missing or invalid data for more than 95 percent of the policies. Therefore, without a valid methodology for selecting policies and without reliable premium data, we were not able to complete our analysis. To determine subsidized rates that each policy holder would have paid, we used FEMA’s premium rate tables and rating methodology for its flood insurance manual effective October 1, 2013, and variables in the data to select the proper basic and additional coverage rates for building and contents coverage for each policy. To calculate the subsidized premiums, we first added (1) the basic building rate multiplied by the amount of building coverage, up to the basic insurance limit; (2) the additional building rate multiplied by the amount of additional building coverage; (3) the basic contents rate multiplied by the amount of contents coverage up to the basic insurance limit; and (4) the additional contents coverage rate multiplied by the amount of additional contents. Second, we multiplied the result by the deductible factor and added the Increased Cost of Compliance (ICC) premium. Third, we subtracted the Community Rating System (CRS) discount, and added the probation surcharge and federal policy fee. To determine which policies were paying full-risk rates, for each record, we compared our determined building and contents basic rates to those assigned in the data. We considered those that matched to be subsidized and would have removed them from further analysis. However, we identified a number of discrepancies in the data and determined that the data were not sufficiently reliable to be used for this analysis. For example, using either methodology for selecting new policies resulted in more than 45 percent of policies receiving subsidized rather than full-risk rates. Additionally, some policies that had rate matches did not match on premium. We therefore calculated a premium based on FEMA’s rates and found additional problems with the premiums in the data. As policy selection and the reliability of the reported full-risk premiums were critical to our analysis, we determined the data to be unreliable for this analysis. We reported these and additional discrepancies to FEMA officials. FEMA conducted an inquiry with the data system contractor. As a result, the contractor informed FEMA that several requirements for changes that should have been in place by October 2013 had not been implemented, including system checks on new fields and checks on reported premiums for certain policies. Additionally, FEMA officials stated that they had found vendor issues in an operational review in April that showed that not all vendors had the October 2013 changes in place. We also analyzed recent NFIP legislation and examined FEMA’s implementation of legislative requirements authorizing subsidized rates for certain properties in high-risk locations. To calculate the number of annual rate increases required for subsidized premium rates to reach full-risk rates, we used FEMA’s building coverage rates for subsidized and full-risk rates effective March 21, 2014—FEMA’s most recent published rates for policies below BFE at the time of analysis. To adjust full-risk rates by inflation, we applied FEMA’s full-risk rate amounts for building coverage for properties in AE flood zones at BFE, at 2 feet below BFE, at 5 feet below BFE, and at 10 feet below BFE by the gross domestic product (GDP) price index for each of the next 30 years. To calculate the yearly subsidized rates after increases, we annually increased the subsidized rate amounts for building coverage by 5 percent, 15 percent, and 25 percent. To determine the number of years before the subsidized rate reached the full-risk rates at the same elevations, for each year we compared the increased subsidized rate with the inflation-adjusted full-risk rate, noting when the subsidized rate exceeded the full-risk rate at each elevation. In addition, to determine the extent that status information was required and present in contractor reports, we analyzed the statement of work for the contract and status documents prepared by the contractor and FEMA from April 2013 through June 2014. Finally, we interviewed FEMA actuaries, underwriters, and program management. We conducted this performance audit from May 2014 to December 2014 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact named above, Jill Naamane (Assistant Director); Karen Jarzynka-Hernandez (Analyst-in-Charge); Pamela Davidson; Catrin Jones; May Lee; Barbara Roesmann; Jessica Sandler; Jena Sinkfield; Frank Todisco; and Jack Wang made key contributions to this report.

Summary: As of September 30, 2013, FEMA, which administers NFIP, had more than 1.1 million subsidized flood insurance policies—about 21 percent of all of its policies. Because their premiums do not reflect the full risk of losses, subsidized policies have been a financial burden on the program. Due to NFIP's financial instability and operating and management challenges, GAO placed the program on its high-risk list in 2006. The Biggert-Waters Act mandated GAO to report on the forgone premiums from subsidies in NFIP. This report examines the forgone premiums associated with subsidies during 2002–2013 along with data reliability issues discovered in GAO's examination. Data for earlier periods were unavailable. GAO analyzed NFIP premium data, published statements about the size of the subsidies, and expenses associated with premiums. GAO also interviewed FEMA officials. The actual forgone premiums—the difference between subsidized and full-risk premiums—to the National Flood Insurance Program (NFIP) due to subsidies cannot be measured. The Federal Emergency Management Agency (FEMA) does not collect flood risk information for all subsidized policies, which is needed to calculate their full-risk premium rates. GAO recommended in July 2013 that FEMA develop and implement a plan to obtain this information. FEMA agreed with the recommendation, but has not yet fully implemented it. Although FEMA is phasing out subsidies through statutorily required rate increases, collecting this information remains important because the number of subsidized policies—and associated financial impacts—could grow over time with the restoration of certain subsidies under the Homeowner Flood Insurance Affordability Act of 2014 that previous legislation had eliminated. Working with available data and FEMA's published statements describing the size of the subsidies, GAO estimated forgone premiums in the range of $16–25 billion for 2002–2013 but estimates vary based on the calculation used. As FEMA would have incurred additional expenses if it had been able to collect the forgone premiums, GAO estimated that FEMA might have had $11–17 billion in premiums net of expenses, or as much as $1 billion a year, for losses or debt repayment. FEMA did not have sufficient controls or monitoring in place to validate system changes (made because of the Biggert-Waters Flood Insurance Reform Act of 2012 (Biggert-Waters Act)) before they became effective, and some premium data were unreliable. Federal internal control standards suggest that agencies have controls, such as validating implementation of changes, to help ensure the accuracy of transactions. A FEMA contracting handbook also calls for monitoring a contractor's progress toward completion of specified requirements. However, FEMA did not validate that its contractor fully implemented changes and system checks, or verify the changes in vendors' software, before program changes became effective in October 2013. FEMA's monitoring reports also did not capture critical information to oversee the contractor's progress toward completion of the required changes. As a result, premium data on policies GAO analyzed are unreliable in the time period studied, some policyholders were charged inaccurate rates, and the full extent of delays and errors went undetected for nearly a year. Without better monitoring and controls over future changes, FEMA risks further inaccuracies in its data system. GAO recommends that FEMA institute controls to validate implementation of data system changes and track progress toward completion in its monitoring reports. GAO also maintains its position that a recommendation made in July 2013 ( GAO-13-607 ) that FEMA develop and implement a plan to obtain flood-risk information needed to determine full-risk rates for properties with subsidized rates is valid and should be fully implemented. FEMA agreed with the new recommendations and discussed its approach for addressing the July 2013 recommendation.