In June 2010, the President directed agencies to review their preaward and prepayment procedures and ensure that a thorough review of applicable databases occurs before the release of any federal funds to help verify eligibility and prevent certain improper payments. The Presidential Memorandum listed five databases for review and directed OMB to develop a plan for integrating these databases so that agencies could access them through a single point of entry. In response to the memorandum, OMB and Treasury established the DNP working system in 2011. In April 2012, OMB issued guidance on the DNP working system through OMB Memorandum M-12-11 (M-12-11), which required the chief financial officer of each agency to submit to OMB a plan for using the DNP working system. The Improper Payments Elimination and Recovery Improvement Act of 2012 (IPERIA), as amended by the Bipartisan Budget Act of 2013 and the Federal Improper Payments Coordination Act of 2015 (FIPCA), enacted into law elements of the Presidential Memorandum by requiring agencies to ensure that a thorough review of available databases occurs prior to the release of federal funds. IPERIA, as amended, requires (1) the DNP working system to include six databases, as well as other databases designated by the Director of OMB in consultation with agencies, and (2) agencies to review—at a minimum—those six databases as appropriate before issuing any payment or award to help verify eligibility. The required databases are listed in table 2. In August 2013, OMB issued guidance through OMB Memorandum M-13- 20 (M-13-20) to help agencies protect privacy while reducing improper payments with the DNP Initiative. According to OMB, the DNP Initiative encompasses multiple databases and analytics resources to support agencies as they verify entity eligibility for awards or payment. This includes centralized data portals (such as the DNP working system) and agency-specific initiatives that serve particular program needs (such as the Centers for Medicare & Medicaid Services’ (CMS) Fraud Prevention System). According to OMB, the DNP working system is one element of the DNP Initiative that agencies can use to meet the requirements set out in IPERIA. The DNP working system offers user agencies four different functionalities by which they can perform searches of databases at various times during the award or payment process. The payment integration functionality matches agency payment files that are sent to Treasury at the time of payment. The payment files are matched against two databases—the Death Master File (DMF) and the System for Award Management (SAM) exclusion records— and matching results are sent back to the agencies. When agencies receive matches through the payment integration functionality, they are required to adjudicate each match (i.e., verify the match to determine whether the corresponding payment is improper) and record the results in the DNP working system. The other three functionalities are online single search, batch matching, and continuous monitoring. Through online single search, an agency can match a single entity against the authorized and available databases for that agency in the DNP working system. Batch matching is a similar process in which an agency can match multiple entities against the authorized and available databases at one time. Online single search and batch matching can be conducted either before or after a payment is made, as decided by the agency. Continuous monitoring matches an agency’s file of entities against the authorized and available data sources on an ongoing basis whenever the data are updated. For these three functionalities, an agency receives matches through the DNP working system but does not record adjudication results for these matches in the system. M-13-20 splits responsibilities related to the DNP Initiative—and the DNP working system—among four entities: (1) OMB, (2) Treasury, (3) original- source agencies, and (4) payment-issuing agencies. These entities’ responsibilities include the following. OMB is responsible for implementing the DNP Initiative—including establishing a working system for prepayment and preaward review—and providing guidance, oversight, and assistance to agencies. IPERIA requires OMB to submit annual reports to Congress regarding the operation of the DNP Initiative. These reports should include an evaluation of whether it has reduced improper payments or improper awards and provide the frequency of data corrections or identification of incorrect information. OMB directed Treasury to host the DNP working system. In doing so, Treasury is responsible for developing memorandums of understanding (MOU) with original-source agencies and entering into computer matching agreements with payment-issuing agencies, as appropriate. OMB guidance states that Treasury must also periodically reassess whether all of the data in the DNP working system are relevant and necessary and delete any data that are not. Additionally, Treasury is responsible for preparing and submitting to OMB a written assessment documenting the suitability of any commercial databases that could be designated for use in the DNP working system. Further, Treasury is responsible for taking steps to ensure that records in the DNP working system are sufficiently accurate, complete, and up-to-date; coordinating with original-source agencies to allow individuals to request data corrections; and submitting periodic reports to OMB. Original-source agencies provide records (e.g., databases) to Treasury for the DNP working system. These agencies are responsible for entering into MOUs with Treasury that describe how Treasury may use the records and provide rules for protecting and correcting the information and for retaining and destroying the records. Additionally, original-source agencies are responsible for ensuring that they have sufficient legal authority and specific designation from OMB (except as provided by law) to share the records and that Treasury has the appropriate level of security controls before providing records to the DNP working system. Payment-issuing agencies are responsible for making determinations about the disbursement of payments or awards, consistent with legal authority. In using the DNP working system, these agencies are responsible for ensuring that they only match against data sources that are relevant and necessary for the specific matching purpose. Payment- issuing agencies are responsible for ensuring that they have sufficient legal authority to engage in a matching program and, when appropriate, entering into computer matching agreements with Treasury. Treasury’s Do Not Pay User Guide states that each agency should verify match results received from the DNP working system against a secondary data source to ensure that match information received from the DNP working system is accurate. M-13-20 states that payment-issuing agencies should comply with all applicable requirements in the Privacy Act, which may include verifying match results and providing individuals an opportunity to contest match results prior to taking adverse action. Although OMB and Treasury have developed the DNP working system, the system does not offer full access to three of the six databases required by law. For example, the DNP working system offers access to the more limited DMF, but access to SSA’s full death file is not available. OMB has not formally evaluated user-agency suggestions for additional databases for the DNP working system, in part because it has not developed a formal process for obtaining the suggestions. The DNP working system offers full access to three of the databases required by IPERIA: the System for Award Management exclusion records, the Debt Check database, and the List of Excluded Individuals and Entities (LEIE). However, it offers either partial or no access to the remaining three: the Credit Alert Interactive Voice Response System, SSA’s prisoner data, and SSA’s death records. Availability of data through the DNP working system is shown in table 3. According to Treasury officials, the process for obtaining access to databases for the DNP working system is extensive and requires coordination with original-source agencies to establish MOUs and to revise system of records notices (SORN) to include routine uses that allow disclosure of the data through the DNP working system. Treasury officials stated that Credit Alert Interactive Voice Response System (CAIVRS) data inputs from the Departments of Agriculture (USDA) and Education (Education) are not currently available through the DNP working system because of delays in negotiating MOUs with these agencies and revising SORNs. As efforts to finalize these documents continue, Treasury officials stated that they estimate that the DNP working system will offer access to CAIVRS data from USDA by the end of fiscal year 2016 and from Education in early fiscal year 2017. Additionally, the DNP working system does not offer access to SSA’s prisoner data. According to agency officials, Treasury and SSA have negotiated a permanent MOU to allow (1) the Internal Revenue Service (IRS) access to SSA’s prisoner data for tax administration through the DNP working system and (2) Treasury access to the data for planning and analysis purposes related to the DNP working system. The MOU allows Treasury to evaluate the prisoner data and determine whether it will be useful in the DNP working system, although SSA officials noted that disclosure of the prisoner data to other agencies for matching purposes through the DNP working system will be limited until the relevant SORN is revised to include this matching as a routine use of the prisoner data. Although Treasury continues to work with relevant agencies, until access to all of the required databases is offered, agencies may face a higher risk of not preventing or identifying improper payments, particularly those to prisoners and individuals that are delinquent on federal nontax debt. Further, Treasury has not obtained SSA’s more complete death records for the DNP working system. SSA shares two sets of death data: its full death file and DMF. DMF is a subset of the full death file, as it contains about 10 percent fewer death records than the full death file and does not include state-reported death data. Initially, IPERIA listed DMF as a required database for the DNP working system. FIPCA amended IPERIA by replacing the reference to DMF with “death records maintained by the Commissioner of Social Security.” SSA officials stated that the Social Security Act limits sharing of SSA’s full death file to federal benefit-paying agencies, which does not include the DNP working system. These officials stated that the Social Security Act would need to be amended to allow the agency to share its full death file with Treasury for the DNP working system. The President’s Budget for fiscal year 2017 included a proposal for such an amendment, but no amendment providing this authority has been enacted. Consequently, the DNP working system offers access to only DMF and not the full death file. In November 2013, we reported that SSA’s processes for collecting and maintaining death reports could result in untimely or erroneous death information, such as including living individuals or not including deceased individuals. For example, we identified about 500 instances in which death reports submitted to SSA in early 2013 listed dates of death in 2011 or earlier. This is of concern because—if the dates of death are accurate—SSA and other agencies may have been at risk of paying benefits to these individuals for long periods after they died. We also reported that SSA’s Office of Inspector General found that data for about 182,000 deceased Supplemental Security Income recipients and about 1.2 million deceased Old Age and Survivors Insurance beneficiaries were not included in SSA’s death data. To help improve the accuracy of its death data, we recommended that SSA conduct a risk assessment and assess the feasibility and cost-effectiveness of addressing various types of errors given the risk they pose. We found that since fiscal year 2014, SSA has been taking steps to redesign how the agency processes death reports and compiles data for dissemination. As part of that redesign, SSA completed a risk assessment and a data quality assessment in June 2014. SSA has completed the first two phases of its redesign project and developed a business process description for the third phase. According to SSA, the agency is taking care to ensure that improvements made to the death data processing system are cost-effective. Although we have not assessed the extent to which SSA’s efforts have improved the quality of its death data, we are encouraged that SSA plans to continue the redesign project in future years. SSA’s efforts will be critical to addressing the risk of errors in its death data. However, it is important to note that SSA does not guarantee the accuracy of the death information it provides to agencies. SSA reported that users of its death data must agree to independently verify the information before taking action based on an individual’s death report. Such verification—if completed—should help reduce the effect of erroneous death data. While there is a continued need for SSA to address the risk of errors in its death data, sharing the full death file through the DNP working system would provide agencies with additional information and enhance efforts to identify and prevent improper payments to deceased individuals. As we previously reported, because the deaths reported by states are generally more accurate, and these reports are included in the full death file, it is likely that agencies using SSA’s full death file would encounter fewer errors than agencies using the DMF. IPERIA provides the Director of OMB, in consultation with agencies, the authority to designate additional databases that substantially assist in preventing improper payments. However, OMB has not formally evaluated user agencies’ suggestions for additional databases or designated any additional databases to be included in the DNP working system. OMB staff stated that they consulted with data analytic centers regarding potential databases and services, and the President’s Budget for fiscal year 2017 included proposals to obtain access to additional databases. Nevertheless, certain user agencies we reviewed identified additional databases that could be beneficial if included in the DNP working system. OMB has not developed a formal process for user agencies to suggest additional databases to be included in the DNP working system. OMB staff stated that they expect user agencies to suggest additional databases to be included in the DNP working system through their AFRs. However, neither M-13-20 nor OMB Circular No. A-136 financial reporting requirements communicate these expectations. Further, OMB staff acknowledged that some user agencies made suggestions for additional databases through their AFRs but stated that the suggestions were not communicated through “formal requests.” OMB guidance does not clarify how agencies should formally suggest additional databases for inclusion in the DNP working system or how OMB should communicate its decisions to agencies. Because a formal process for obtaining suggestions for additional databases—whether from the AFRs or other means—has not been fully developed and communicated, OMB may not be identifying or considering additional relevant databases that could improve the effectiveness of the DNP working system. Nine of the 10 agencies we reviewed used the DNP working system’s payment integration functionality, despite limitations in its effectiveness and the lack of OMB and Treasury guidance for key aspects of the payment integration process. For example, this process matches against only two databases, and agencies generally receive results after payments are made. Further, certain agencies reported confusion regarding whether they were required to use the payment integration process, especially those agencies with other—and potentially duplicative—data matching processes. Aside from the payment integration process, 6 of the 10 agencies we reviewed used the DNP working system in limited ways, and 9 of the 10 agencies accessed the databases through means other than the DNP working system. OMB staff stated that they expect agencies to leverage the DNP working system to complement existing, non-DNP data matching processes, but OMB guidance does not reflect this approach, and OMB has not developed a strategy for how this should be carried out. The policies and procedures for using the DNP working system at the agencies that we reviewed generally lacked specific processes for (1) determining whether DNP matches were actually improper payments and (2) verifying matches against a secondary data source. These shortcomings were due in part to unclear and inconsistent guidance from OMB and Treasury. Nine of the 10 agencies we reviewed used DNP’s payment integration functionality—despite limitations in its effectiveness—because it is built into Treasury’s payment process. In part because OMB and Treasury guidance does not address key aspects of the payment integration process, understanding of the process varied across selected agencies, and in some cases, the process was potentially duplicative of existing agency procedures. DNP’s payment integration functionality is limited because of the timing of the matching performed and the scope of databases and payments reviewed. Moreover, certain limitations are not fully communicated through existing guidance. Timing of matching. The payment integration process is not consistent with the requirement in IPERIA to review databases prior to award or payment. While matching is conducted at the time of payment, agencies generally receive the results after payments have been made. As such, use of the payment integration process does not assist agencies in preventing improper payments before they occur. While Treasury’s Do Not Pay Agency Implementation Guide states that payment integration matching happens at the time of payment, the agencies we reviewed reported inconsistent interpretations of the timing of the process. Because the guide is not clear that the results are generally received after payments have been made, about half of the agencies we reviewed considered the payment integration process to be a prepayment function, whereas others considered it to be a postpayment activity. Further, OMB guidance does not specifically reference the payment integration functionality or its timing. Databases used in matching. The payment integration process matches against only two databases, DMF and SAM exclusion records. Any other database available through the DNP working system must be accessed outside of the payment integration process. Some agencies we reviewed did not know which databases were included in the payment integration process, which may be a result of unclear guidance. While agency officials confirmed that it was their understanding that the objective of the process is to match against only DMF and SAM exclusion records, Treasury’s Do Not Pay Agency Implementation Guide states that the objective of the payment integration process is to match all payment files against the data sources identified in IPERIA. The guide does not acknowledge that the process matches payments against only two of the data sources identified in IPERIA, DMF and SAM exclusion records. Payments reviewed. Because the payment integration functionality is part of Treasury’s payment issuance process, payments that are made through other means—such as non-Treasury disbursing offices or contractors—are not automatically matched. Examples of these types of payments include Department of Defense payments disbursed through the Defense Finance and Accounting Service ($477 billion in fiscal year 2015) and Medicare Fee-for-Service payments ($351 billion in calendar year 2014). Further, certain federal payments flow through various entities—such as state or local governments—before ultimately being spent for their intended purposes. For example, benefits for USDA’s Supplemental Nutrition Assistance Program are funded by the federal government, but states are responsible for determining individual and household eligibility for the program, calculating the amount of monthly benefits, and issuing benefits on an electric benefit transfer card. In these cases, only the payment from the federal agency to the first recipient is matched against DMF and SAM exclusion records, and subsequent payments—those to the ultimate recipients, for example—are not matched through DNP’s payment integration process, though they may go through other agency-specific reviews. Figure 1 illustrates the payments reviewed through the payment integration process. Standards for Internal Control in the Federal Government states that management should externally communicate the necessary quality information to achieve the entity’s objectives. Without clear guidance on the limitations of the payment integration functionality, there is an increased risk that agencies will not use the DNP working system effectively to reduce improper payments. Eight of the 10 agencies we reviewed considered use of the payment integration functionality required because it is built into Treasury’s payment process, though neither OMB nor Treasury guidance sets out this requirement. OMB staff stated that they do not consider use of the process to be a requirement. However, OMB’s actions (as noted below) could give the opposite impression. Two agencies we reviewed—SSA and IRS—requested and received permission exempting them from using the payment integration functionality for at least some of their payments. For example, OMB specifically determined that SSA is not required to use the payment integration functionality because it is the source agency for two relevant databases (death and prisoner data) and has access to SAM exclusion data and the Department of Health and Human Services’ Office of Inspector General’s LEIE outside of the DNP working system. Similarly, IRS officials stated that they worked with OMB to receive permission exempting IRS from using the payment integration process for its tax refunds given its existing data matching processes and confidentiality restrictions. Had the payment integration functionality been clearly optional, explicit OMB exemptions would not be necessary. Two other agencies we reviewed—the Railroad Retirement Board (RRB) and the Department of Veterans Affairs’ (VA) Veterans Benefits Administration (VBA)—had procedures to review SSA’s full death file for certain programs prior to implementation of the DNP working system. Officials at these agencies stated that they requested an exemption from OMB from the payment integration process—which they considered duplicative of their existing procedures—but were denied. OMB staff stated that they did not recall these agencies’ requests but that they would be willing to work with them to avoid duplication. Standards for Internal Control in the Federal Government states that management should externally communicate the necessary quality information to achieve the entity’s objectives. Given the limitations of the payment integration functionality, clear guidance is critical to help ensure that agencies fully understand the process and whether its use is required. Without clear guidance on whether the payment integration process is required, there is an increased risk that agencies may not effectively or efficiently use the DNP working system to reduce improper payments. Only 6 of the 10 agencies we reviewed used the DNP working system for purposes outside of payment integration, and their uses of the system were limited to certain programs or databases and often were not part of payment or award eligibility determinations. Two of the agencies we reviewed—the National Science Foundation and USDA—used the DNP working system on a preaward or prepayment basis for certain types of payments. Officials at the National Science Foundation stated that the agency uses the DNP working system to review grant proposals against SAM (both exclusion records and entity registration records) and LEIE simultaneously, streamlining and automating a process that was previously performed manually for one application at a time. USDA officials stated that the Commodity Credit Corporation and Risk Management Agency use the DNP working system on a preaward or prepayment basis for certain payments. According to officials, the Commodity Credit Corporation uses the DNP working system to review secure payments against DMF and SAM exclusion records. Similarly, the Risk Management Agency uses the DNP working system to review payments for reinsurance funds to entities other than approved insurance providers against DMF. The other four agencies use the DNP working system to periodically review certain of their databases, though the reviews are not necessarily tied to a payment or award. For example: CMS officials reported using the working system to review provider enrollment information from its Provider Enrollment, Chain and Ownership System against SAM exclusion records on a monthly basis. Officials at the General Services Administration reported using the DNP working system to review its vendor database against SAM exclusion records on a monthly basis. While some of the agencies we reviewed used the DNP working system for purposes beyond payment integration, 9 of the 10 agencies we reviewed accessed certain IPERIA-specified databases outside of the DNP working system. For example: Most agencies reported that they use SAM exclusion records when awarding contracts, as required by the Federal Acquisition Regulation. These agencies generally accessed SAM exclusion records through SAM.gov or by using systems integrated with SAM data. As previously noted, RRB and VBA reported that they use SSA’s full death file outside of the DNP working system. For example, VBA reported matching its Compensation and Pension programs’ master records against SSA’s full death file on a weekly basis, while RRB reported matching its master benefit payment file against SSA’s full death file on a monthly basis. Officials at the Veterans Health Administration reported that it reviews LEIE outside of the DNP working system when adding non-VA medical providers to its vendor database. Agencies are using the DNP working system in limited ways in part because of a lack of OMB strategy and guidance. OMB has not developed or documented a strategy for how it expects agencies to use the DNP working system. Instead, OMB staff informed us that OMB expects agencies to determine how best to use the DNP working system to complement existing data matching processes. According to M-13-20, OMB is responsible for providing agencies guidance on the DNP Initiative, but key aspects of OMB’s stated approach are not addressed by its existing guidance. Specifically, the memorandum does not indicate that agencies should determine how to use the DNP working system or whether agencies should consider using the system to streamline existing data matching processes. Because the DNP working system offers a single point of access to multiple databases, agencies may be able to streamline existing processes by using the DNP working system rather than accessing these databases separately. While it required agencies to develop plans for using the DNP working system through M-12-11 in 2012, OMB has not followed up with agencies to determine whether the plans were implemented or updated as the capabilities of the DNP working system evolved. Further, OMB guidance does not address other key aspects of the program, including how agencies should demonstrate that their data matching processes meet the requirements of IPERIA, whether agencies can decide on their own which specific databases to use, or how agencies should use the specific data matching functionalities offered through the DNP working system. Standards for Internal Control in the Federal Government states that management should externally communicate the necessary quality information to achieve the entity’s objectives. Without a strategy communicated through guidance, agencies may not effectively use the DNP working system to help prevent improper payments and, when possible, streamline data matching processes. Most of the agencies we reviewed did not have documented policies and procedures for determining whether a DNP match represented an improper payment (i.e., the adjudication process), including verifying a DNP match against a secondary data source and providing individuals an opportunity to contest the matching results prior to taking adverse action. OMB and Treasury guidance is inconsistent and unclear regarding agencies’ responsibilities for verifying DNP matches. M-13-20 provides requirements for agencies conducting matching programs under the Privacy Act, which include verifying matches and providing individuals an opportunity to contest. However, agencies we reviewed did not consider the majority of their matching through the DNP working system to meet the definition of a matching program per the Privacy Act, and M-13-20 does not state what is required if an agency concludes that its use of the DNP working system does not constitute a matching program. In contrast to OMB guidance, Treasury’s Do Not Pay User Guide states that agencies should verify all DNP matches against a secondary source. However, aside from Treasury’s Quick Reference Card for SAM, neither OMB nor Treasury guidance explains how an agency should verify a DNP match, including the use of a secondary source. Standards for Internal Control in the Federal Government states that management should externally communicate the necessary quality information to achieve the entity’s objectives. Without clear and consistent guidance, agencies may not effectively develop and document processes to help ensure that DNP matches are accurate and that, when appropriate, individuals are given an opportunity to contest adverse actions. Further, if agencies do not verify DNP matches, they face an increased risk that they may not effectively use the DNP working system to reduce improper payments. Although OMB collects relevant information, it has not evaluated agency use of the DNP working system. OMB has not established specific goals or performance measures by which to evaluate agency use of the DNP working system, in part because it has not developed a strategy for how agencies should use the system. In its first annual report to Congress on the overall DNP Initiative, OMB reported that the DNP Initiative prevented $2 billion in improper payments in fiscal year 2014. While the report highlighted the DNP working system and four other agency-specific efforts, all of the reported $2 billion in prevented improper payments resulted from use of the agency-specific efforts, not the DNP working system. Further, several agencies we reviewed reported little benefit from their use of the DNP working system. The 10 agencies under our review reported in their AFRs a total of only $725 in improper payments that were prevented through use of the DNP working system during fiscal year 2015, although concerns regarding the reliability of these data are discussed later in this report. The 24 Chief Financial Officers Act agencies collectively reported in their AFRs about $680,000 in improper payments prevented through use of the DNP working system in fiscal year 2015. Although OMB considers it to be one part of the overall DNP Initiative, it is important for OMB to specifically monitor agency use of the DNP working system—as part of its responsibility to oversee the DNP Initiative—to determine whether its use is effective. Standards for Internal Control in the Federal Government states that management should establish and operate monitoring activities, evaluate the results, and remediate identified deficiencies on a timely basis. To do so, management can establish baselines or benchmarks against which to measure program performance. Without monitoring mechanisms, OMB may not effectively evaluate the DNP working system or identify performance issues. Further, OMB may be unable to provide complete information on the DNP working system to Congress as part of its annual report on the overall DNP Initiative. While OMB staff stated that they collect and review agency-reported data on use of the DNP working system, the information may be limited and unreliable. Specifically, OMB staff stated that they use information in agencies’ AFRs to monitor the DNP Initiative, which includes agencies’ use of the DNP working system. OMB staff stated that they reviewed draft AFRs for fiscal year 2015 against OMB guidance in OMB Circular No. A-136 and found no issues with the information. However, among the 10 agencies we reviewed, we identified instances in which certain reporting in the fiscal year 2015 AFRs was inconsistent with OMB guidance or monthly adjudication reports generated by the DNP working system, calling into question the reliability of the information. Certain agencies we reviewed did not include all required elements in the AFR narrative or complete the results summary table in accordance with OMB guidance, resulting in potentially inaccurate data. For example: One agency overstated its false positives in its results table by reporting the payments reviewed that did not receive matches, instead of payments with matches that were reviewed and the payment determined to be proper (i.e., false positives). One agency did not use the most up-to-date template for its results table, leading it to report results of its matching inconsistent with the reporting of other agencies. Specifically, the agency reported on matches identified as improper payments instead of false positives. One agency reported on its use of the DNP working system for fiscal year 2014 instead of fiscal year 2015 in its fiscal year 2015 AFR. In addition, certain agencies we reviewed included information in the AFR results summary table that conflicted with reports generated by the DNP working system. For example: One agency reported no false positives in its summary table, but its DNP working system adjudication reports indicated over 60 false positives for fiscal year 2015. One agency reported identical information as both payments stopped and false positives in its summary table, calling into question the accuracy of these data. Further, these results did not agree with the agency’s DNP working system adjudication reports and were inconsistent with the agency’s AFR narrative, which stated that reviews were conducted after payments had been made. Because reviews were performed on a postpayment basis, the payments could not have been stopped. Given the issues we identified, OMB’s process for reviewing information on agency use of the DNP working system reported in AFRs may not be effective. Further, OMB Circular No. A-136 notes that Treasury will provide OMB summary information on use of the DNP working system on behalf of user agencies. However, this information is limited to results of the payment integration functionality. Although the DNP working system offers agencies four different methods for conducting data matching, the system only tracks results for the payment integration process. Treasury officials stated that the decision to track only payment integration results was made for ease of use by agencies. Agencies using the other three functionalities—online single search, batch matching, and continuous monitoring that can be used for prepayment reviews, such as eligibility determinations—must track their results manually, which may be more inefficient and susceptible to human error. Additionally, OMB guidance does not indicate whether agencies should report on all uses of the DNP working system, including those outside payment integration that the DNP working system does not track. Standards for Internal Control in the Federal Government states that management should use quality information to achieve the entity’s objectives. Without complete and reliable data and clear guidance on what information agencies should report, OMB cannot effectively monitor and evaluate the use of the DNP working system. Improper payments are a significant problem in the federal government, and the DNP working system is one tool that agencies can use to help reduce them. However, the lack of certain data limits the effectiveness of the DNP working system. For example, SSA’s more complete set of death data is not offered through the DNP working system, and OMB has not developed a formal process to obtain suggestions of additional databases from user agencies for data matching. While the most common use of the DNP working system is its payment integration process, OMB guidance is unclear as to whether use of the process is required, and Treasury’s Do Not Pay Agency Implementation Guide does not clearly describe the limitations of the process, including the data sources used and the timing of matching. Further, the agencies we reviewed used the DNP working system in limited ways in part because OMB has not developed a strategy for how agencies should use it. Without a strategy that is communicated through guidance, agencies may not use the DNP working system to effectively and efficiently reduce improper payments. Finally, OMB does not sufficiently monitor use of the DNP working system. OMB has not developed performance measures or other monitoring mechanisms, in part because it lacks a strategy for use of the system, and the information OMB collects on agencies’ use of the DNP working system may be unreliable. Because the DNP working system does not track matches obtained through all of the available functionalities, the information OMB collects may also be incomplete. Without monitoring mechanisms and reliable and complete data, OMB will not be able to effectively evaluate agencies’ use of the DNP working system or remediate any issues identified. To provide agencies access to SSA’s more complete set of death data, Congress should consider amending the Social Security Act to explicitly allow SSA to share its full death file with Treasury for use through the DNP working system. We recommend that the Director of OMB take the following seven actions. To reasonably assure that additional relevant databases are identified and evaluated for inclusion in the DNP working system, the Director of OMB should develop, document, and communicate a formal process that user agencies can use to identify, suggest, and receive feedback on additional databases to be evaluated for inclusion in the DNP working system. To reasonably assure that the DNP working system is used effectively and consistently, the Director of OMB should develop guidance that clarifies whether the use of DNP’s payment integration functionality is required and—if required—the circumstances and process in which agencies may obtain an exemption from this requirement. To reasonably assure that agencies use the DNP working system effectively, the Director of OMB should develop a strategy—and communicate its strategy through guidance—for how agencies should use the DNP working system to complement existing data matching processes and whether and how agencies should consider using the DNP working system to streamline existing data matching. Such guidance may cover how agencies should demonstrate that their data matching processes meet the requirements in IPERIA, whether agencies can decide on their own which specific databases to use, and how agencies should use the functionalities available through the DNP working system. To reasonably assure that agencies develop consistent policies and procedures to verify DNP matches, the Director of OMB should provide additional guidance that outlines when and how agencies should verify DNP matches against a secondary source and provide individuals an opportunity to contest before taking adverse actions as a result of DNP matches. To better monitor agency use of the DNP working system once a strategy has been developed, the Director of OMB should develop and implement monitoring mechanisms—such as goals, benchmarks, and performance measures—to evaluate agency use of the DNP working system. To reasonably assure that agency-reported information on use of the DNP working system is reliable, the Director of OMB should develop a process for comparing agency reporting on the use of the DNP working system to available sources, such as OMB guidance and DNP working system adjudication reports. To reasonably assure that agency-reported information on use of the DNP working system is complete, the Director of OMB should revise its guidance to clarify whether agencies should report on their uses of all of the functionalities of the DNP working system in their AFRs. In addition, we recommend that the Secretary of the Treasury take the following two actions: revise Treasury’s Do Not Pay Agency Implementation Guide to clearly describe the limitations of the payment integration process, including the data sources used and the timing of matching, and modify the DNP working system to track adjudication of matches obtained through all functionalities. We provided a draft of this report to each of the agencies we reviewed for comment. OMB, Treasury, and SSA provided written comments, which are reprinted in appendixes II through IV, respectively. USDA, HHS, Department of the Interior, Department of Labor, VA, GSA, National Science Foundation, and RRB had no formal comments on the draft report. In addition, Treasury, HHS, Department of Labor, SSA, and National Science Foundation provided technical comments, which we have incorporated as appropriate. In its written comments, OMB stated that it agreed with our first two recommendations and cited plans to consider or implement them. OMB stated that it agreed or generally agreed with the concepts behind the remaining five recommendations, as discussed below, but did not state whether it agreed with the recommendations themselves or planned to implement them. In response to our third recommendation, OMB stated that it generally agreed with the concept of developing a strategy for how agencies should use the DNP working system to complement existing data matching processes and will explore the concept further. In response to our fourth recommendation, OMB stated that it agreed with the concept of consistent policies and procedures and will work with agencies so that their policies and procedures for verifying DNP matches are developed consistently. In response to our fifth recommendation, OMB stated that it agreed with the concept of monitoring mechanisms and will continue to work with agencies to reduce improper payments and encourage agencies to establish goals to improve payment accuracy that will be monitored and evaluated by OMB. In response to our sixth recommendation, OMB stated that it agreed with the concept of ensuring that data are reliable and will consider the feasibility of a process to compare agency submissions to available sources to reasonably assure that agency-reported information on use of the DNP working system is reliable. In response to our seventh recommendation, OMB stated that it agreed with ensuring the completeness of data and will continue to work with agencies and the Chief Financial Officer community to ensure that agency-reported information on use of the DNP working system is complete. While OMB stated that it agreed or generally agreed with the concepts behind the recommendations and in some cases identified steps it would take in response, it is too soon to determine whether OMB’s approach will fully address these recommendations. We continue to believe that implementing the recommendations would help ensure that agencies use the DNP working system as intended. In its written comments, Treasury agreed with our two recommendations to it and stated that it plans to take action to implement them. Although there were no recommendations made to SSA, the agency noted in its written comments that it appreciates the matter for congressional consideration regarding amending the Social Security Act to explicitly allow the sharing of SSA’s full death file through the DNP working system, stating that it aligns with a similar proposal in the President’s Budget for fiscal year 2017. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to relevant congressional committees; the Director of the Office of Management and Budget; the Secretaries of Agriculture, Health and Human Services; the Interior; Labor, the Treasury; and Veterans Affairs; the Administrator of the General Services Administration; the Director of the National Science Foundation; the Railroad Retirement Board; the Commissioner of the Social Security Administration; and other interested parties. In addition, this report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions on matters discussed in this report, please contact me at (202) 512-2623 or davisbh@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix V. This review examines the extent to which (1) the Office of Management and Budget (OMB) and the Department of the Treasury (Treasury) developed the Do Not Pay (DNP) working system and obtained access to relevant databases, (2) selected agencies used the DNP working system to help review eligibility, and (3) OMB monitored the use of the DNP working system. In addition to OMB and Treasury’s DNP Business Center, we selected 10 agencies and relevant components for review. To do so, we reviewed budgetary outlays, net cost information, and improper payment estimates from fiscal year 2014 (the most recent information available at the time of the review), as well as information about agencies’ use of the DNP working system obtained from the DNP Business Center. We determined that these data were sufficiently reliable for the purposes of selecting agencies and components for review. The agencies and relevant components selected for review are included in table 4. To select the 10 agencies for review, we first split agencies into two groups (large and small agencies) based on fiscal year 2014 budgetary outlays. Within these groups, we analyzed fiscal year 2014 improper payment estimates to select agencies with high improper payment estimates and information on agencies’ use of the DNP Business Center to select agencies capable of using the different functionalities offered by the DNP working system. We also selected the Social Security Administration because, while it is the source of certain data in the DNP working system, the agency does not use the system. Five of the selected agencies delegated use of the DNP working system to agency components. For 4 of these agencies, we selected relevant components for review based on analysis of information on net costs by components in agencies’ fiscal year 2014 agency financial reports and fiscal year 2014 improper payment estimates. We used this information to identify large components and those with high reported improper payment estimates. Because net cost information does not capture Treasury’s custodial activities relating to tax administration (i.e., tax collections and refunds/tax credits), we used improper payment estimates and interviews with agency officials to select relevant Treasury components for review. To address our first objective, we obtained documentation from OMB and Treasury regarding the availability of required databases and other relevant databases through the DNP working system. We compared this documentation to relevant laws and guidance. We also interviewed officials at Treasury’s DNP Business Center, OMB, and the 10 user agencies selected for review regarding database availability and suggestions for additional databases for inclusion in the DNP working system. To address our second objective, we interviewed officials at the selected agencies regarding their use of the DNP working system. Additionally, we met with officials at shared service providers used by certain of our selected agencies and components as these shared service providers may use the DNP working system on behalf of the selected agencies. We analyzed OMB and Treasury guidance on the DNP working system. We also reviewed the 10 selected agencies’ policies and procedures for using the DNP working system to determine if they were effectively designed to meet requirements in relevant laws, guidance, and federal internal control standards. Our review focused on the design of internal controls, and as such, we did not test the implementation of the agencies’ policies and procedures. To address our third objective, we analyzed agency reporting on the use of the DNP working system in the 10 selected agencies’ fiscal year 2015 agency financial reports and OMB’s first annual report on the DNP Initiative; obtained relevant documentation regarding OMB’s monitoring of the DNP working system; and compared this information to relevant laws, guidance, and federal internal control standards. We also interviewed officials at Treasury’s DNP Business Center and OMB. We conducted this performance audit from April 2015 to October 2016 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact named above, Phillip McIntyre (Assistant Director), James M. Healy (Auditor in Charge), Stephanie Adams, Daniel Flavin, Maxine Hattery, Christopher R. Klemmer, Diana Lee, Kevin McAloon, David Plocher, and Coleman Williams made key contributions to this report.

Summary: Improper payments are a long-standing, significant problem in the federal government, estimated at nearly $137 billion in fiscal year 2015. GAO previously reported that one strategy to help prevent improper payments is up-front verification of eligibility through data sharing and matching. Established by OMB in 2011 and hosted by Treasury, the DNP working system is a web-based, centralized data matching service. GAO was asked to review the DNP working system. This report examines the extent to which (1) OMB and Treasury developed the DNP working system and obtained access to relevant databases, (2) selected agencies used the DNP working system to help review eligibility, and (3) OMB monitored the use of the system. GAO reviewed relevant laws and guidance; interviewed officials at OMB, Treasury, and 10 user agencies selected in part based on size and reported improper payment estimates, including those with the largest reported estimates; and analyzed DNP working system documentation. The Office of Management and Budget (OMB), in coordination with the Department of the Treasury (Treasury), developed the Do Not Pay (DNP) working system as a data matching service for agencies to use in preventing improper payments, but GAO found that the DNP working system offers either partial or no access to three of the six databases required by the Improper Payments Elimination and Recovery Improvement Act of 2012, as amended. Specifically, the DNP working system offers no access to the Social Security Administration's (SSA) prisoner records and partial access to the Credit Alert Interactive Voice Response System and SSA's death records. The death records offered through the DNP working system do not include state-reported death data. SSA officials stated that sharing its full death file—which includes state-reported death data—would require an amendment to the Social Security Act. Sharing the full death file through the DNP working system would enhance efforts to identify and prevent improper payments. The 10 agencies GAO reviewed have used the DNP working system in limited ways, in part because of a lack of clear OMB strategy and guidance. The most common way these agencies used the DNP working system is through its payment integration process, whereby Treasury compares disbursements it makes with DNP databases. However, Treasury matches against only two databases, and because the matching is performed simultaneously with disbursement, agencies generally do not receive the results in time to prevent improper payments. Further, because the payment integration process is built into Treasury's payment process, it does not compare payments disbursed through other means, such as payments made by the Defense Finance and Accounting Service ($477 billion in fiscal year 2015). OMB and Treasury guidance do not fully address the limitations of the payment integration process or whether its use is required. Aside from payment integration, 6 of the 10 agencies GAO reviewed used the DNP working system in limited ways, and 9 of the 10 agencies used some of the databases outside the DNP working system. OMB has not developed a strategy or communicated through guidance how it expects agencies to use the DNP working system. As a result, agencies may not effectively and efficiently use the system to help reduce improper payments. Although OMB collects certain information about the use of the DNP working system, it has not developed monitoring mechanisms, such as goals or performance measures. Reported savings from use of the DNP working system have been minimal. OMB reported that the overall DNP Initiative (which encompasses the DNP working system and other agency-specific efforts) prevented over $2 billion in improper payments in fiscal year 2014, but none of these savings resulted from use of the DNP working system. Further, while OMB has not reported on fiscal year 2015 results, the 24 Chief Financial Officers Act agencies reported about $680,000 in improper payments prevented through use of the system in fiscal year 2015. However, GAO identified instances in which such agency-reported information was not consistent with reports generated by the system. Without monitoring mechanisms and reliable data, OMB cannot effectively evaluate the DNP working system or identify and address performance issues. Congress should consider amending the Social Security Act to allow SSA to share its full death file through the DNP working system. GAO is making two recommendations to Treasury and seven to OMB, including for OMB to develop and communicate a strategy and guidance and develop monitoring mechanisms. Treasury agreed. OMB agreed with two and agreed or generally agreed with the concepts behind the remaining five. GAO believes that it is important to fully implement all of the recommendations.