Congress established NFIP in the National Flood Insurance Act of 1968 to provide an alternative to disaster assistance that would reduce the escalating costs to the federal government of repairing flood damage. FEMA, within DHS, administers NFIP and is responsible for its management and oversight. Under NFIP’s WYO program, FEMA enters into an arrangement with individual private-sector insurance companies licensed by states to provide property insurance. The arrangement allows these companies—using their customary business practices—to offer flood insurance coverage to eligible property owners. Figure 1 provides an overview of the WYO companies and other key participants in NFIP. A private insurance company becomes a WYO company by entering into an agreement with FEMA known as the Financial Assistance / Subsidy Arrangement. Under the arrangement, private insurance companies agree to issue flood policies in their own name. The WYO companies adjust flood claims as well as settle, pay, and defend all claims arising from the flood policies. Participating WYO companies are to comply with FEMA’s NFIP WYO Program Financial Control Plan Requirements and Procedures (Financial Control Plan), which outlines WYO insurance companies’ responsibilities for underwriting, claims adjustments, cash management, and financial reporting. Selling policies. NFIP coverage is available to all owners of insurable property (a building or its contents, or both) in a community participating in NFIP. Builders of buildings in the course of construction, condominium associations, and owners of residential condominium units in participating communities may also purchase flood insurance. Insurance agents under contract to one or more WYO insurance companies are the main point of contact for approximately 97 percent of policyholders. Based on information the insurance agents submit, the WYO insurance companies issue policies, collect premiums from policyholders, deduct an allowance for expenses from the premium, and remit the balance to the National Flood Insurance Fund. The remaining 3 percent of policies are written directly by the federal government through a FEMA contractor known as the Direct Servicing Agent. The Direct Servicing Agent provides an alternative, for example, when a WYO company is unable or unwilling to write a flood insurance policy. Adjusting claims. Insurance companies employ certified flood adjusters to settle NFIP claims. When flood losses occur, policyholders report them to their insurance agent, who notifies the WYO insurance company. The WYO insurance company assigns a flood adjuster who is responsible for assessing damage, estimating losses, and submitting required reports, work sheets, and photographs to the WYO insurance company, where the claim is reviewed and, if approved, processed for payment. NFIP’s claims payment policy states that FEMA will pay only that part of the loss that exceeds the deductible amount, subject to the applicable limit of liability (i.e., the amount of insurance coverage). FEMA provides funds to the WYO insurance companies from the National Flood Insurance Fund for the amounts paid for approved claims and related expenses. As of December 2008 the fund was over $18 billion in debt. About 68 FEMA Mitigation Directorate employees, assisted by approximately 105 to 110 Bureau and Statistical Agent (BSA) contractor employees, are responsible for managing and overseeing NFIP and the National Flood Insurance Fund into which premiums are deposited and claims and expenses paid. FEMA and its contractor (the BSA) are responsible for monitoring and overseeing the quality of the performance of the approximately 90 WYO insurance companies to assure that NFIP is administered properly. Their management responsibilities include establishing and updating NFIP regulations and flood insurance rates, offering training to WYO company insurance agents and adjusters, and implementing the Financial Control Plan. The NFIP financial reporting process begins at the WYO company level when the companies provide summary-level financial data and transaction-level statistical data to the BSA. The WYO Financial Control Plan requires the WYO companies to submit a monthly financial statement reporting package to the BSA, which is to include financial, reconciliation, and certification statements, and statistical transactions. The BSA uses the detailed transaction-level data in the reporting package for statistical purposes that include information on claims, losses, and premiums (such as claim payment and coverage amounts, data on buildings and contents, and policy effective dates). The BSA uploads the summary-level financial information to its financial system which is used for financial reporting purposes. After the BSA receives the reporting package, it performs front-end balancing—a process intended to ensure the WYO company data are consistent with the WYO companies’ reconciliation statements. After BSA personnel complete the front-end balancing process they use manual processes to upload financial data into the Focus system from a spreadsheet. The consolidated financial data in Focus is then downloaded to a database to prepare journal entries that are then uploaded into the Traverse financial reporting system. The BSA uses the Traverse system to prepare the financial statement booklets and ultimately produce four financial statements—for the Direct Servicing Agent, WYO companies, BSA, and a consolidated report that includes all three entities. The BSA sends the financial statement booklets consisting of these four sets of consolidated—but unaudited—financial statements to FEMA’s Office of the Chief Financial Officer (OCFO) monthly. The OCFO prepares journal vouchers based on line items from the NFIP consolidated financial statements that the BSA provides. OCFO personnel enter these journal vouchers into the Integrated Financial Management and Information System (IFMIS), which is FEMA/NFIP’s official accounting system of record. After the journal voucher entries are loaded into IFMIS, OCFO personnel produce trial balance data and load it into the Treasury Information Executive Repository (TIER), which is a data warehouse for DHS’ components’ data. See figure 2, which depicts NFIP’s financial reporting processes. Control weaknesses impaired FEMA’s ability to maintain effective transaction-level accountability. Consequently, NFIP had limited assurance that its financial data for fiscal years 2005 to 2007 were accurate. This impaired data reliability resulted from weaknesses at all three levels of the NFIP transaction accountability and financial reporting process: at the WYO companies, BSA, and FEMA. At the WYO level, WYO companies did not adhere to policies and procedures regarding required claims file documentation, and therefore almost one third of the claims loss files we reviewed were missing supporting documents. This deficiency undermined assurances regarding the reliability of the claims loss financial data the WYO companies reported. Further, incomplete BSA premium data files, such as missing insureds’ names and addresses, prevented our assessment of the reliability of reported premium amounts. BSA-level controls were ineffective in verifying the accuracy of WYO- submitted data. At the FEMA level, financial reporting process controls were not based on transaction-level data—instead FEMA relied primarily on summary data compiled using error-prone manual data entry. The WYO companies did not provide complete documentation to FEMA for claims paid to insureds during fiscal years 2005 to 2007. According to NFIP policies and procedures, claim loss files are to contain adequate documentation relevant to the adjustment of a claim to support claim payments. Our detailed testing of claim losses paid during fiscal years 2005 through 2007 showed that 20 percent (36 out of 177) of the claim files reviewed were missing adjuster-prepared preliminary reports and 20 percent (36 out of 177) did not contain adjuster-prepared final reports required by the NFIP Adjuster Claims Manual. In addition, for the claim files we reviewed, WYO companies did not file 42 percent (74 out of 177) of the preliminary and 34 percent (61 out of 177) final reports within the required 15 and 45 days, respectively, from the date of loss in accordance with NFIP policy. Our findings are consistent with prior audit findings. Specifically, DHS’ auditor for its financial statement audit for fiscal year 2006 reported that preliminary and final reports were not filed within the required time frames. Similarly, almost 71 percent (125 out of 177) of the statistically sampled claim losses paid files we reviewed failed at least one internal control test. These included tests such as determining whether claim file documents were missing and whether adjusters filed required reports on time or late. Although FEMA officials pointed to the unprecedented severity, frequency, and complexity of flood claims during this period, these internal control issues identified raise concerns that the claim payment amounts were not adequately supported. Over 50 percent of the transactions in the NFIP databases for the insurance premium policies for fiscal years 2006 and 2007 that the BSA extracted for our testing either lacked or had incomplete insured names, addresses, or policy effective dates. Consequently, we were unable to test the accuracy of reported insurance premium amounts or whether policy premium information was complete. Officials from the BSA attributed the missing or incomplete insurance premium information to their extraction process and difficulties they encountered (programming errors) when extracting the data into a separate database specifically for our use. Furthermore, the fact that BSA officials could not readily produce reliable or complete data poses questions regarding their capacity to analyze data and the NFIP program officials’ ability to identify appropriate managerial actions based on what is reported to them by WYO companies through their own BSA contractor. We developed alternative procedures that we planned to use to make conclusions about the reliability of reported insurance premiums written amounts. These alternative procedures involved testing the premium and policy information from the sample we selected for claims losses paid. However, we were unable to verify information in the premiums database for many sample items because of the missing information described previously and because of limitations in the quality of the data. We found weaknesses in two key controls outlined in the Financial Control Plan for the BSA to ensure the accuracy of WYO company- submitted data. These controls include front-end balancing, which is a process intended to ensure the WYO company data are consistent with the WYO companies’ reconciliation statements, and variance reporting, which analyzes WYO-submitted transaction-level (statistical) data in comparison with summary-level financial data submitted by WYO companies. These features do offer some assurances regarding the consistency of data provided by WYO companies and recorded by the BSA. However, neither offers any assurances that the WYO company-provided information accurately reflects actual transactions. Consistent with Standards for Internal Control, an agency must have sufficient controls in place to provide reliable information to run and control its operations. Such controls generally include procedures to verify the validity and accuracy of the recorded transactions or events. Every month, after receiving summary financial and transaction-level statistical data from WYO companies, the BSA performs front-end balancing. As provided by the Financial Control Plan, front-end balancing is a process intended to ensure the WYO company data are consistent with the WYO companies’ reconciliation statements that compare the statistical transaction data to selected financial exhibit entries. This process is intended to validate that the BSA has recorded the same information that individual WYO companies have transmitted. The BSA’s front-end balancing, while helping to verify that the number of records and dollar amounts agree to the reconciliation documents and the timeliness of the WYO-submitted data, does not verify or validate the data’s accuracy. Although WYO companies submit statistical transaction-level data for claims losses paid and premiums written, which are the primary sources of financial activity for NFIP, the BSA does not base its financial reporting on this transaction-level data, but instead compiles the financial exhibits submitted by the WYO companies, and therefore reduces assurances that activity reported to FEMA represents actual transactions between WYO companies and policyholders. The BSA’s monthly variance reporting was also not designed to ensure WYO company data accuracy. The Financial Control Plan requires the BSA to analyze WYO-submitted transaction-level (statistical) data in comparison with summary-level financial data submitted by WYO companies and produce a report identifying any differences. BSA personnel told us that various parties, such as the Standards Committee, use the Consolidated Variance Report to monitor the statistical data and financial information reported by the WYO companies. However—much like front-end balancing—the usefulness of the variance reporting process was limited because the BSA review was not designed to check the underlying NFIP transaction data submitted by WYO companies against an independent source for accuracy or completeness. Along with the internal control weaknesses discussed previously, the design of FEMA’s NFIP financial reporting process increased the risk of inaccurate or incomplete data because it did not include a process of analyzing the detailed data for accuracy or analyzing the financial reports in relation to the transaction-level data currently submitted by WYO companies for statistical purposes. Finally, the process places an overreliance on manual procedures for processing and entering data. The design weaknesses increase the likelihood of incomplete or inaccurate NFIP financial information. As FEMA’s NFIP financial reporting process was designed, approximately 90 WYO insurance companies submit summary financial information in e- mails to the BSA for consolidation and submission to FEMA. Throughout the entire process, the BSA captures and processes key financial information such as net written premiums on the financial statements prepared by the WYO companies. By presenting the net written premium amount, a WYO company does not show how much of its earned premiums went to pay premium refunds. This process limits management and audit visibility into identifying and resolving any underlying transaction reliability issues because it does not show different components of transactions. Furthermore, even when detailed transaction- level financial data were available, we found that supporting documentation was missing. Absent supporting transaction information, it was not practical for FEMA to reconstruct or validate NFIP amounts reported. FEMA’s reliance on unverified WYO data and manual processing as described in the background section of this report greatly increases the chances of errors or misstatements. Similarly, a reliance on net (aggregated) data increases the risk of undetected data errors at the FEMA level. As a result, in fiscal year 2006, for example, FEMA OCFO officials had to correct over 100 journal vouchers totaling an estimated $260 billion. These errors occurred because FEMA OCFO officials erroneously recorded NFIP financial activity during fiscal year 2006. According to Standards for Internal Control implementation guidance, excessive adjustments to numbers or account classifications should not be necessary prior to finalization of financial reports. Proper classification and recording of transactions or events should take place throughout the entire life cycle of each transaction or event, including authorization, initiation, processing, and reporting. Weaknesses in the broad oversight structures that FEMA relies on to monitor NFIP financial activity in three key areas limited the effectiveness of FEMA’s oversight: (1) FEMA did not have processes to monitor WYO company audits by independent public accountants and other parties, including required biennial audits, state insurance department audits, and audits for cause; (2) FEMA did not perform triennial operational reviews of all WYO insurance companies; and (3) FEMA’s claims reinspection program used flawed sampling procedures. These weaknesses are consistent with issues identified in our prior reports. As a result of these oversight deficiencies, FEMA’s ability to identify and address NFIP financial transaction control breakdowns when processing transactions related to the 2005 Gulf Coast hurricanes was limited. FEMA did not have any mechanism for tracking completion and reviewing the results of required biennial financial statement audits of WYO companies, did not collect results of state insurance department audits related to flood insurance activity, or conduct audits for cause. According to the Financial Control Plan, biennial audits are FEMA’s primary oversight mechanism for obtaining assurance that it receives complete and accurate financial management information from WYO insurance companies. The plan provides that such audits are intended to reduce or eliminate the need for FEMA auditors to conduct on-site visits to WYO insurance companies to oversee their financial activities; specifies that biennial financial statement audits are a required condition of an insurance company’s participation in the WYO program; and states that they must be conducted by an independent Certified Public Accountant. According to the Financial Control Plan, these audits are to include an opinion on the fairness of the financial statements, the adequacy of the internal controls, and the extent of compliance with laws and regulations. In 2007, we reported that 5 out of 94 (about 5 percent) WYO companies had biennial audits completed for the 2-year period covering fiscal years 2005 and 2006. In response to findings that FEMA had failed to consistently enforce the biennial audit requirement, FEMA officials told us that they had exempted from this requirement companies that said that they were overwhelmed with administering flood claims after the 2005 hurricane season. The Financial Control Plan also requires FEMA to consider the results of other audits of the WYO companies such as state insurance department audits, as appropriate. Based on our testing of FEMA’s compliance with the Financial Control Plan, we reported in August 2009 that FEMA rarely or never reviewed state insurance department audits. FEMA officials clarified that state departments of insurance audits require a “trigger.” For such audits, a financial officer of the insurer is to “trigger” an alert to FEMA of any state audit involving NFIP activities. A more independent way for FEMA to learn of these audits would be to have contact directly with the states. According to FEMA, during our review period, FEMA did not receive any such notices. These audits are typically in response to company-specific concerns—they are not routine. The Financial Control Plan outlines criteria that, in combination or independently, may prompt FEMA to perform an audit for cause. Based on our testing of FEMA’s compliance with the Financial Control Plan, we reported in August 2009 that FEMA rarely or never implemented audits for cause. According to FEMA officials, the last audits for cause were done in the late 1990s. Because FEMA did not systematically track and centrally store all required evaluations, inspections, audits, or reviews, FEMA management had no basis for timely access to them or effectively overseeing the 90-plus participating insurance companies, and therefore had no reasonable basis for determining whether any audits for cause were necessary. FEMA told us that based on our August 2009 recommendations, it now plans to implement such a system. It will be important for FEMA to maintain ongoing awareness of state audit initiatives identified through an independent information source. FEMA did not perform operational reviews for all WYO companies on a triennial basis as required and used a flawed sampling methodology to select underwriting files at the WYO companies that it did review. The Financial Control Plan calls for conducting the following types of operational reviews: underwriting/policy administration; claims; marketing; customer services; and litigation. These reviews are intended to provide FEMA with an effective mechanism to monitor, identify, and resolve problems related to how WYO companies sell and renew NFIP policies and adjust claims. According to Standards for Internal Control implementation guidance, information should be available on a timely basis to allow effective monitoring of events, activities, and transactions and to allow prompt action. Given that operational reviews are FEMA’s primary method to monitor the WYO insurance companies for the two most significant areas of the program—underwriting and claims processing—it is important for FEMA to conduct these reviews on a regular basis. Without the timely information regarding how WYO companies sell and adjust claims gained through operation reviews, FEMA cannot be certain that the WYO companies provide appropriate financial information to NFIP program managers. Policies and procedures specify that all WYO companies are to be reviewed at a minimum every 3 years. Therefore, we expected that FEMA would have done an operational review of all the WYO companies during the 3-year period covering 2005 to 2007. However, as shown in figure 3, we found that FEMA had completed operational reviews on only 71 percent (82 out of 116) of WYO companies during this period. Further, as previously reported, FEMA did not use a statistical sampling methodology to select files for operational reviews—instead it uses nonprobability sampling processes. In nonprobability sampling, staff are to select a sample based on their knowledge of the population’s characteristics. The major limitation of this type of sampling is that the results cannot be generalized to a larger population. A nonprobability sample is therefore not appropriate to use if the objective is to generalize about the population from which the sample is taken. According to FEMA’s Financial Control Plan, the claims reinspection program is to serve as a mechanism supporting FEMA’s oversight of WYO insurance companies. The objectives of the claims reinspection program were to (1) keep FEMA and the BSA informed, (2) assist in the overall claims operation, and (3) provide necessary assurances and documentation for dealing with external parties. The BSA is to conduct all reinspections and prepare a report documenting the appropriateness of the original claims adjuster’s work. However, we found that FEMA did not use a statistical sampling basis for selecting claims for reinspection. Specifically, adjusters selected claims to reinspect based upon judgmental criteria including, among other items, the size and location of loss and complexity of claims. Further, FEMA only required testing for a selection of claims for flood events with over 400 claims per a single flood event for a particular WYO company. Also, the actual number of claim losses selected for reinspection only represents a very small percentage of the total number of claim losses processed. Using this flawed methodology for selecting samples for claims reinspections, the percentage of claims reinspected by flood event for fiscal years 2005 and 2006 was 1.8 percent for Katrina, 3.6 percent for Rita, and 5.0 percent for Wilma. By using a statistical sampling methodology for selecting claim reinspections, FEMA would be able to use this oversight mechanism to make conclusions about the accuracy of the total amount of claims losses paid, with a similar level of effort. These findings are consistent with findings from previous audits. Specifically, we previously reported in October 2005 that neither FEMA nor its program contractor used a statistically valid method for selecting files for reinspections of claims adjusted after each flood event because FEMA guidance did not include procedures on the sample selection process. Without a statistically valid sampling methodology that represents the population, the agency cannot project the results of these reinspection oversight activities to confidently determine the overall accuracy of claims settled for specific flood events or assess the overall performance of insurance companies and their adjusters in fulfilling their NFIP responsibilities. In December 2006, we again reported that FEMA neither used a random sample of claims for its reinspections nor analyzed the overall results of those reinspections to determine the total number of payment errors and their potential causes. FEMA has revised its draft Financial Control Plan (dated August 2009) to require selection of a statistically representative sample of claim files for its reinspection reviews. However, the modified policy continues to cover only those claims associated with single flood events with over 400 claims per WYO company. Substantial claims activity may still be excluded from reinspection. For fiscal years 2005 and 2006, almost $1.5 billion of the $16.5 billion in claims filed would not have been considered for reinspection under this criterion. Until processes are modified to make all cases eligible for reinspection, FEMA will not be able to effectively determine whether the case population is complete as well as whether the total amount of claims losses paid is reasonable. Available data indicate that the number of biennial financial audits has increased since FEMA began tracking the results in fiscal year 2008. Figure 4 shows that few audits were conducted for fiscal years 2005 and 2006, but that there was considerable improvement for fiscal years 2006 and 2007. Prior to fiscal year 2008, FEMA had not tracked and reviewed these audit results because FEMA did not follow NFIP policies and procedures requiring it to receive and analyze such information. Accordingly, FEMA could not determine whether it received and reviewed all required audit reports, nor have a basis for monitoring implementation of necessary corrective actions. In response to our previous recommendation regarding this long-standing concern, FEMA is now using a tracking mechanism to document audit reports received and those reviewed by FEMA staff. According to FEMA, once the financial audit reports are received, staff and management now review the audit reports and document the results of their review on the tracking schedule. While improvements have been made with regard to tracking and reviewing the results of biennial audits, this is only one component of FEMA’s oversight structure and, as discussed in this report, we continue to note weaknesses in the other areas. FEMA has a system development and implementation effort, referred to as NextGen, under way. This effort has experienced delays and it is too soon to determine whether planned program efficiencies—such as confirmation of insured’s property address—will be achieved under the new system. According to FEMA, the NextGen system implementation effort is designed to be an insurance system that links key data elements like claims and policies through shared processes. Under the current system, the BSA maintains claim losses paid and premium policies data in separate databases. FEMA officials have expressed concern about the readiness of the NextGen system to support NFIP program operations. As currently designed and implemented, FEMA’s internal controls over NFIP offer limited transaction-level accountability and assurances that financial reporting is accurate or that insurance company operations conform to program requirements. Transaction-level accountability and reporting to administer NFIP are fundamental to attaining accountability over program resources. Internal controls are also critical to ensure that claim payments are adequately supported, and FEMA was missing key documentation to support claims. Given the involvement of multiple private entities participating in this insurance program, establishing and implementing effective policies and procedures to thoroughly implement required audits and overall operational and targeted reviews will be critical for FEMA to exercise its managerial responsibilities. FEMA has taken some steps to strengthen NFIP internal controls such as overseeing WYO companies by tracking and reviewing the results of their required biennial financial audits. The enormous potential financial burden on the federal government that flood events pose, coupled with the risks of inaccurate and incomplete NFIP financial information described in this report, serve to underscore that effective NFIP controls are critical. As such, it will be important to take immediate actions to improve these controls over NFIP transactions, financial reporting, and oversight. To improve the financial reporting process and strengthen internal controls, we recommend that the Secretary of Homeland Security direct the Acting Assistant Administrator, FEMA Mitigation Directorate, to take the following seven actions: Augment NFIP policies to require the BSA to develop procedures to analyze financial reports in relation to the transaction-level information that WYO companies submit for statistical purposes. Revise required internal control activities for the BSA to provide for verifying and validating the reliability of WYO-reported financial information based upon a review of a sample of the underlying transactions or events, or obtain verification that these objectives have been met through independent audits of the WYO companies. Determine the feasibility of integrating and streamlining numerous existing NFIP financial reporting processes to reduce the risk of errors inherent in the manual recording of accounting transactions into multiple systems. Establish and implement procedures to require reviewing available information such as the results of biennial audits, operational reviews, and claim reinspections to determine whether the targeted audits for cause managerial tool should be used. Establish and implement procedures to require maintaining and considering current information from an independent source regarding state audit results to gather pertinent information such as customer service issues and inform determinations about when to conduct audits for cause. Establish and implement procedures to schedule and conduct all required operational reviews within the prescribed 3-year period. Establish and implement procedures to select statistically representative samples of all claims as a basis for conducting reinspections of claims by general adjusters. We requested comments on a draft of this report from the Secretary of Homeland Security. Comments received from the DHS Departmental GAO/OIG Liaison Office on behalf of FEMA are reprinted in appendix II. In its comments, FEMA concurred with two of our recommendations, stated that two recommendations were unnecessary in that the recommended procedures were already in place, and disagreed with the remaining three recommendations. We reaffirm all seven recommendations. With respect to the recommendations for which FEMA concurred regarding (1) streamlining financial reporting processes and (2) conducting operational reviews, FEMA noted it has actions under way to integrate and streamline numerous existing financial reporting processes in the design of a new NFIP system, and stated that its new operational review process will address our recommendation to schedule and conduct all required operational reviews within the prescribed 3-year period. Regarding our recommendation for establishing and implementing procedures for reviewing all available audit and other reports, FEMA stated that it already had a process in place to review WYO company performance and trigger audits for cause. FEMA further commented that the Standards Committee considers the results of biennial audits, operational reviews, and claims reinspections when it reviews company performance and considers whether to recommend audits for cause. We disagree that the process FEMA has in place is sufficient to address our recommendation. As discussed in our draft report, during the period of our review, FEMA management, including the Standards Committee, lacked timely access to all audit and other reports because FEMA did not systematically track and centrally store all required evaluations, inspections, audits, or reviews. Therefore, without further action to establish additional procedures directed at ensuring access and a systematic review of WYO company performance, FEMA will continue to be unable to effectively oversee the 90-plus participating insurance companies or determine whether any audits for cause are necessary. Also, regarding our recommendation concerning selecting statistically representative samples of claims for reinspections, FEMA stated that the reinspections are not intended to be a definitive audit of the NFIP’s claims handling process, and cited the random sample of claims it currently has in place. We disagree. As discussed in our draft report, adjusters selected claims to reinspect based upon judgmental criteria, not on a random sample. Further, FEMA only required reinspection when there were more than 400 claims per flood event for a particular WYO company. Because reinspections are conducted principally on open claims files to document the appropriateness of the original claims adjuster’s work, the lack of a statistically representative sample not only precludes FEMA from projecting the results of these reinspections to determine the overall accuracy of claims, it also limits FEMA’s ability to continuously assess the overall performance of insurance companies and adjusters in fulfilling their NFIP responsibilities. FEMA also noted that claims operational reviews are designed to provide feedback on claims settlements and ascertain compliance by WYO companies. The claims operational reviews that FEMA cited, while an important oversight mechanism, do not allow for continuous feedback concerning the overall insurance company performance. We also continue to reaffirm our three recommendations for which FEMA disagreed in its comments on our draft report. First, with respect to our recommendations that FEMA develop financial reports using the transaction-level information that WYO companies currently submit for statistical purposes, FEMA stated that implementing our recommendation would be onerous and burdensome because of the number of transactions involved. We subsequently adjusted our recommendation to have NFIP augment its policies to require the BSA to develop procedures to analyze financial reports in relation to the transaction-level information that WYO companies submit for statistical purposes. Such a procedure would help compensate for the risks introduced by the current approach of entering summary-level information to its financial reporting system. Because WYO companies already submit transaction-level data on claims losses paid and premiums written and FEMA uses this information for statistical purposes, using these transaction-level financial data to increase the reliability of FEMA’s financial reporting should impose minimal additional burden. Also, with respect to FEMA’s nonconcurrence with our recommendation to verify and validate WYO-reported financial information, FEMA maintained that the form and structure of the transaction-level detail is audited at the source, including consideration of the relevance, reliability, and accuracy of the transaction-level detail. However, as discussed in our report, during the period of our review, we were not provided any evidence showing that FEMA obtained any assurances concerning the accuracy or validity of WYO company transaction-level financial data. Specifically, FEMA did not demonstrate that it had mechanisms in place during fiscal years 2005 through 2007 for receiving and reviewing the results of the required biennial financial statement audits of WYO companies, or for tracking completion of these audits. FEMA was unable to provide evidence of whether all WYO companies had completed biennial audits and had not reviewed the results of these WYO company biennial audits. Further, as discussed in our report, FEMA officials exempted certain WYO companies from the biennial audit requirement after the 2005 hurricane season. Therefore, FEMA had no assurance as to the accuracy or validity of WYO company transaction-level financial data. We reaffirm our recommendation that FEMA revise required internal control activities for the BSA to provide required procedures for verifying and validating the reliability of WYO-reported financial information based upon a review of a sample of the underlying transactions or events. We also adjusted our recommendation to include the option for FEMA to obtain assurance of the reliability of WYO company-reported financial data by verifying that those objectives were met through the independent audits of WYO companies. Finally, FEMA did not concur with our recommendation to maintain and consider information from an independent source regarding state audit results in determining whether to conduct audits for cause. FEMA contended that such sources do not focus on federal programs, such as NFIP. However, FEMA’s Financial Control Plan states that it is expected that audits of WYO companies by state insurance departments will include flood insurance activity. Further, FEMA acknowledges receiving information from a source independent of the WYO companies. Specifically, it acknowledged receiving correspondence from state insurance departments regarding issues of customer service with the WYO companies. It is important for FEMA to establish and implement procedures to require maintaining and considering all current information available from an independent source regarding state audit results. We found that FEMA rarely received or reviewed information from state insurance department audits. Consequently, we continue to reaffirm our recommendation to obtain and consider independent information on state audits of the WYO companies, rather than continuing to rely solely on the WYO company that underwrites policies and processes claims to alert FEMA of any state issues. FEMA also expressed concern over several points in our draft report’s narrative. We continue to affirm the process descriptions and the findings in our draft report but made several changes in the report to clarify the narrative. Our responses to other FEMA concerns with our draft’s narrative are provided following FEMA’s comments in appendix II. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Homeland Security, relevant congressional committees, and other interested parties. The report will also be available at no charge on our Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9095 or raglands@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO contact and staff acknowledgments are listed in appendix III. To assess whether controls were effective in providing accountability and reliable financial reporting for National Flood Insurance Program (NFIP) transactions during the 2005 to 2007 time frame, we obtained and reviewed available transaction data and financial reports for NFIP for fiscal years 2005 through 2007. We selected these years to identify transactions relevant to the 2005 Gulf Coast hurricanes and to capture more current financial information. We reviewed the Write Your Own (WYO) Financial Control Plan, WYO Accounting Procedures Manual, and other relevant NFIP policy guidance documents to determine the design of NFIP financial reporting processes and related internal controls. We reviewed NFIP transaction accountability in accordance with the guidelines of the Federal Financial Management Improvement Act of 1996 (FFMIA). We also interviewed Federal Emergency Management Agency (FEMA), FEMA contractors, and Department of Homeland Security (DHS) Office of Inspector General (OIG) officials to document and obtain an understanding of the financial reporting process and related internal controls for NFIP transactions. We conducted walkthroughs to understand the reporting process for financial transactions including the review of related evidentiary supporting documentation, including journal vouchers and adjusting journal entries. Further, to determine how the financial transactions were recorded, specifically insurance premiums written and claim losses paid, we reviewed NFIP financial reports and met with NFIP program and FEMA officials to obtain an understanding of the processing cycles for premiums written and claim losses paid. We interviewed FEMA personnel and contractors responsible for collecting and maintaining NFIP financial data to understand the available data. In addition, we obtained requested extracts of NFIP databases of the insurance premiums written and claim losses paid for these fiscal years to identify the total population including the number of transactions, and planned to select statistical samples of claims and policies to test from these databases. We reconciled the Bureau and Statistical Agent (BSA) extracts of net premiums written and claim losses paid databases to the BSA prepared financial statements based on the data provided to FEMA. Once we were able to successfully complete our reconciliation, but before selecting samples, we performed data reliability tests on the databases and determined that the claims losses paid database was sufficiently reliable for our purposes. We did not audit the data that WYO companies submit to FEMA’s contractor, CSC, nor did we audit the data produced by CSC or the information included by FEMA in DHS’ annual reports. We used the statistical samples of insurance claim losses paid as outlined below to perform detailed testing through verification of data fields such as coverage and deductible amounts, claim payment amounts, and policy effective dates against source documents. We also used these samples to further test internal controls over NFIP financial reporting. Results from the statistical samples were projected by fiscal year both individually and combined. See table 1 below for details related to the statistical samples. Using the above statistical samples, we also tested other NFIP program- oversight controls as deemed necessary and in accordance with our engagement objectives. In order to ensure efficient detailed testing, we conducted dual-purpose testing, which includes reviewing dollar amounts as well as the related internal controls. We found information in the premiums written database was not sufficiently reliable for our purposes. We were unable to perform detailed testing of the premiums written database due to a significant number of data-reliability issues that we discovered. To evaluate oversight structures in place to monitor NFIP financial activity for the 3-year period covering 2005 to 2007, we reviewed prior GAO and DHS OIG reports to identify and follow up on any previously reported weaknesses or concerns, including sample selection for claims reinspections and tracking results of biennial financial audits. We also interviewed FEMA personnel and contractors regarding the oversight structures in place. In addition, we identified and assessed significant oversight structures as outlined in the WYO Financial Control Plan, and analyzed the results of these controls. To assess whether recent and planned actions to improve NFIP controls and the overall control environment are likely to address identified financial control weaknesses, we reviewed NFIP policy and procedural guidance that has been issued subsequent to the 2005 Gulf Coast hurricanes. We also met with key program officials to discuss the NextGen system development effort. We also discussed recent and planned NFIP program changes to address the internal control weaknesses and oversight issues previously identified by GAO and the DHS OIG. The following section provides GAO’s comments on DHS’ letter dated December 4, 2009. 1. We deleted the footnote containing this estimate, although the draft report did not characterize it as an overpayment. We revised the text on page 5 in the Background section to clarify our description of FEMA's claims adjustment process. 2. Our report recognizes the unprecedented losses, but nevertheless the internal control issues we identified raise concerns that the amounts of the claims NFIP paid were not adequately supported even considering the expedited procedures in place at the time. 3. Because we used a statistical sample from the insurance claim losses paid databases, our sample allows us to make generalizations about the population. The larger WYO companies that processed more claims would constitute a larger number of claims in our statistical sample. 4. FEMA was unable to provide evidence of whether all WYO companies had completed biennial audits and had not reviewed the results of any biennial audits. Further, as discussed in our draft report, FEMA officials exempted certain WYO companies from the biennial audit requirement after the 2005 hurricane season. Therefore, FEMA had no assurance as to the accuracy or validity of WYO company transaction-level financial data. In addition to the contact named above, Chanetta Reed, Assistant Director; Sharon Byrd, Assistant Director—Audit Sampling; Kwabena Ansong; Gabrielle Fagan; Patrick Frey; Elizabeth Isom; Jason Kirwan; Jason Kelly; Chelsea Lounsbury; Mary Osorno; and Gabrielle Perret made significant contributions to this report. High-Risk Series: An Update. GAO-09-271. Washington, D.C.: January 2009. Flood Insurance: Options for Addressing the Financial Impact of Subsidized Premium Rates on the National Flood Insurance Program. GAO-09-20. Washington, D.C.: November 14, 2008. Flood Insurance: FEMA’s Rate-Setting Process Warrants Attention. GAO-09-12. Washington, D.C.: October 31, 2008. Information Technology: Management Improvements Needed on The Department of Homeland Security’s Next Generation Information Sharing System. GAO-09-40. Washington, D.C.: October 8, 2008. National Flood Insurance Program: Financial Challenges Underscore Need for Improved Oversight of Mitigation Programs and Key Contracts. GAO-08-437. Washington, D.C.: June 16, 2008. National Flood Insurance Program: Greater Transparency and Oversight of Wind and Flood Damage Determinations Are Needed. GAO-08-28. Washington, D.C.: December 28, 2007. Federal Emergency Management Agency: Ongoing Challenges Facing the National Flood Insurance Program. GAO-08-118T. Washington, D.C.: October 2, 2007. National Disasters: Public Policy Options for Changing the Federal Role in Natural Catastrophe Insurance. GAO-08-7. Washington, D.C.: November 26, 2007. Financial Management: Persistent Financial Management Systems Issues Remain for Many CFO Act Agencies. GAO-08-1018. Washington, D.C.: September 30, 2008. National Flood Insurance Program: FEMA’s Management and Oversight of Payments for Insurance Company Services Should Be Improved. GAO-07-1078. Washington, D.C.: September 5, 2007. National Flood Insurance Program: Preliminary Views on FEMA’s Ability to Ensure Accurate Payments on Hurricane-Damaged Properties. GAO-07-991T. Washington, D.C.: June 12, 2007. National Flood Insurance Program: New Processes Aided Hurricane Katrina Claims Handling, but FEMA’s Oversight Should Be Improved. GAO-07-169. Washington, D.C.: December 15, 2006. GAO’s High-Risk Program. GAO-06-497T. Washington, D.C.: March 15, 2006. Federal Emergency Management Agency: Challenges for the National Flood Insurance Program. GAO-06-335T. Washington, D.C.: January 25, 2006. Federal Emergency Management Agency: Improvements Needed to Enhance Oversight and Management of the National Flood Insurance Program. GAO-06-119. Washington, D.C.: October 18, 2005. National Flood Insurance Program: Oversight of Policy Issuance and Claims. GAO-05-532T. Washington, D.C.: April 14, 2005.

Summary: Due to the federal government's role as guarantor, floods impose an enormous potential financial burden on the federal government. Consequently, decision makers at the Department of Homeland Security (DHS), the Federal Emergency Management Agency (FEMA), and the Congress need accurate and timely financial information to assess the effectiveness of the National Flood Insurance Program (NFIP). This report assesses whether controls in place during the 2005 to 2007 time frame were effective and whether actions to improve controls are likely to address identified weaknesses. The Government Accountability Office (GAO) reviewed and analyzed FEMA/NFIP guidance, data, and financial reports, reviewed prior audit reports, interviewed FEMA officials and contractors, and selected a sample of claim losses paid to determine whether claim files contained key documents. Weaknesses in internal controls impaired FEMA's ability to maintain effective transaction-level accountability. These weaknesses limited FEMA's ability to assure accurate NFIP financial data during the 3-year period from fiscal year 2005 through 2007, which included the financial activity related to the 2005 Gulf Coast hurricanes. FEMA relies heavily on Write Your Own (WYO) insurance companies to carry out NFIP financial activities such as documenting and maintaining claim files. FEMA's Bureau and Statistical Agent (BSA) serves as a liaison between the government and WYO insurance companies. GAO identified weaknesses at three levels of the NFIP transaction accountability and financial reporting process. First, at the WYO level, our internal control testing of a statistical sample determined that almost 71 percent of WYO company claims loss files did not have the necessary documents to support the claims, or reports were filed late. Second, incomplete BSA-level premium data files (lacking key information such as insureds' names and addresses) prevented an assessment of the reliability of reported NFIP premium amounts. Further, BSA-level internal control activities were ineffective in verifying the accuracy of WYO-submitted data. Lastly, FEMA's financial reporting process uses summary data that is overly reliant on error-prone manual data entry. GAO found that FEMA's broader oversight structures were also of limited effectiveness. Specifically, GAO found weaknesses in three key structures FEMA relies on to provide oversight over NFIP and monitor financial activity: (1) WYO company audits--specifically, we found that FEMA did not collect the results of state insurance department audits related to flood insurance activity and did not perform any audits for cause; (2) triennial operational reviews of WYO insurance companies--we found that FEMA did not perform operational reviews at almost one third of all WYO companies over the 3-year period; and (3) FEMA's claims reinspection program--we found that FEMA used flawed sampling procedures in the claims reinspection program. These findings are consistent with weaknesses GAO has previously identified. These oversight weaknesses limited FEMA's ability to identify and address financial transaction control breakdowns resulting from the 2005 hurricanes. FEMA's initiatives to improve specific internal control weaknesses and the overall NFIP control environment since the 2005 Gulf Coast hurricanes have done little to address many of the NFIP financial data deficiencies highlighted by these catastrophic events. FEMA has made improvements such as revising its claim reinspection selection methodology to provide for review of a random selection of a statistically representative sample of claim files. However, the modified reinspection methodology still does not include all claims. FEMA has also implemented a tracking system to monitor the number of WYO biennial audits obtained and reviewed. Further, FEMA has a system modernization development and implementation effort under way. It is too soon to determine the extent to which these efforts will achieve program efficiencies.