IPIA was passed in November 2002 with the major objective of enhancing the accuracy and integrity of federal payments. IPIA requires executive branch agency heads to review their programs and activities annually and identify those that may be susceptible to significant improper payments. For each program and activity agencies identify as susceptible, the act requires them to estimate the annual amount of improper payments and to report those estimates to the Congress. The act further requires that for programs for which estimated improper payments exceed $10 million, agencies are to report annually to the Congress on the actions they are taking to reduce those payments. The act also requires the Director of OMB to prescribe guidance for agencies to use in implementing IPIA. OMB’s implementing guidance requires the use of a systematic method for the annual review and identification of programs and activities that are susceptible to significant improper payments. However, this guidance also allows for annual reviews (also known as risk assessments) to be conducted less often than annually for programs where improper payment baselines are already established, are in the process of being measured, or are scheduled to be measured by an established date—which is inconsistent with the express requirement of IPIA. In addition, OMB’s guidance defines significant improper payments as those in any particular program that exceed both 2.5 percent of program payments and $10 million annually. It requires agencies to estimate improper payments annually using statistically valid techniques for each susceptible program or activity. The guidance also allows agencies to use alternative sampling methodologies and requires agencies to report on and provide a justification for using these methodologies in their PARs. For those agency programs determined to be susceptible to significant improper payments and with estimated annual improper payments greater than $10 million, IPIA and related OMB guidance require each agency to annually report the results of its efforts to reduce improper payments. In August 2004, OMB established Eliminating Improper Payments as a new program-specific initiative under the President’s Management Agenda (PMA). This separate PMA program initiative began in the first quarter of fiscal year 2005. Previously, agency efforts related to improper payments were tracked along with other financial management activities as part of the Improving Financial Performance initiative of the PMA. The objective of establishing a separate initiative for improper payments was to ensure that agency managers are held accountable for meeting the goals of IPIA and are therefore dedicating the necessary attention and resources to meeting IPIA requirements. With this initiative, 15 agencies are to measure their improper payments annually, develop improvement targets and corrective actions, and track the results annually to ensure the corrective actions are effective. This list does not include USAID or NASA, which are nevertheless covered under IPIA and thus are required to address improper payments for their programs and activities. However, both USAID and NASA stated that they consulted with OMB, although infrequently, about procedures planned or under way for the first 3 years of IPIA implementation. In addition, applicable agencies are required by OMB guidance to report their efforts to recoup contract-related improper payments under section 831 of the National Defense Authorization Act for Fiscal Year 2002, commonly referred to as the Recovery Auditing Act. This legislation provides an impetus for applicable agencies to systematically identify and recover contract overpayments for executive branch agencies entering into contracts with a cumulative total value exceeding $500 million in a fiscal year. Furthermore, the law authorizes federal agencies to retain recovered funds to cover in-house administrative costs as well as to pay other contractors, such as collection agencies. Recovery auditing is a method that agencies can use to recoup detected (as opposed to estimated) improper payments. As such, recovery auditing is a detective control to help determine whether contractor payments were proper. Specifically, it focuses on the identification of erroneous invoices, discounts offered but not received, improper late penalty payments, incorrect shipping costs, and multiple payments for single invoices. Recovery auditing can be conducted in-house or contracted out to recovery audit firms. The techniques used in recovery auditing offer the opportunity for identifying weaknesses in agency internal controls, which can be modified or upgraded to be more effective in preventing improper payments before they occur during subsequent contract outlays. Agencies that are required to undertake recovery audit programs were directed by OMB to provide annual reports on their recovery audit efforts, along with improper payment reporting detailed in an appendix to their PAR. Specifically, OMB’s implementing guidance requires that agencies include in the PAR: a general description and evaluation of the steps taken to carry out a recovery auditing program; the total cost of the agency’s recovery auditing program; the total amount of contracts subject to review, the actual amount of contracts reviewed, the amounts identified for recovery, and the amounts actually recovered in the current year; a corrective action plan to address the root causes of payment error; a general description and evaluation of any management improvement program carried out; and a description and justification of the classes of contracts excluded from recovery auditing review by the agency head. For the first 3 years of IPIA implementation—fiscal years 2004 through 2006—both agencies performed various procedures to conduct their risk assessments. Many of these procedures are positive steps to address the requirements of IPIA. At the same time, we identified numerous deficiencies in the procedures that warrant further improvement. Specifically, we found that both agencies lacked a systematic method to determine if risk of improper payments existed in their programs or activities, what those risks were, or the potential or actual impact of those risks on operations. For example, USAID and NASA had not developed a standardized process to evaluate the results of their reviews, such as weighting and scoring the results of risk conditions to determine susceptibility. As such, the various procedures performed did not provide meaningful results or may not have adequately depicted the agencies’ risk of improper payments. In addition, we noted USAID and NASA had not assessed the effectiveness of internal controls relied upon and weaknesses existed in payment reviews performed at the agency component level. Furthermore, risk assessment documentation maintained by USAID and NASA was lacking or insufficient to support their conclusions that no programs or activities were susceptible to significant improper payments. Fiscal year 2004 marked the first year in which all executive branch agencies were required to report improper payment information in their PARs under IPIA. Both USAID and NASA conducted a review of their payment streams as part of their risk assessment process to identify significant improper payments. OMB’s implementing guidance includes a broad definition of programs and activities subject to IPIA, which encompasses a review of payment activities. We found during our review of fiscal year 2006 PARs that agencies generally used one of two approaches to conduct their risk assessments—a review of program operations or a review of payment streams. Although agencies are allowed under OMB’s implementing guidance to determine their program and activity inventory for the purposes of performing a risk assessment, the two approaches can produce different results. In particular, a review of payment streams identifies the susceptibility of improper payments for specific payment types that could relate to multiple programs within an organization. On the other hand, a review of distinct programs would identify the susceptibility of improper payments for the different payment types included in a particular program. Depending on the volume and dollar amount of payments or size of a program, an agency could determine based on OMB’s current definition of significant improper payments—exceeding $10 million and 2.5 percent of program payments— that it had significant improper payments using one approach but not with the other, greatly impacting its risk assessment results. Implementing a payment stream approach, USAID and NASA did not identify any risk-susceptible programs or activities for fiscal year 2004. This continued into fiscal year 2005 for both agencies. For fiscal year 2006, USAID identified two high-risk payment streams as part of its risk assessment—cash transfers and contracts, grants, and cooperative agreements. However, the identification of these two payment streams did not result from a systematic process in place to identify high-risk programs, but rather was due to the high ratio of disbursements for these two payment streams to total agency outlays (about 77 percent for fiscal year 2006). On the other hand, NASA continued to assert for fiscal year 2006 that it had no programs susceptible to significant improper payments although it did not perform a risk assessment for that year. The following is a description of USAID’s and NASA’s risk assessment processes for fiscal years 2004 through 2006. Details of the weaknesses we identified in these processes are included later in this section. At USAID, the Cash Management and Payment (CMP) division within the Office of the Chief Financial Officer (OCFO) has the responsibility of executing and meeting the requirements of IPIA for the agency. For fiscal year 2004, CMP identified a universe of 11 payment streams totaling about $7.6 billion as part of its IPIA risk assessment. See appendix II for a description of each payment stream. For fiscal year 2004, these payment streams consisted of program, operating, and other fund disbursements made from headquarters and its 38 accounting stations that conduct cash management activities for approximately 70 mission offices located overseas. Two of the 11 payment streams—cash transfers and contracts, grants, and cooperative agreements—totaled $6.8 billion, or 90 percent of total outlays. USAID’s payment streams are shown in figure 1. USAID’s risk assessment for fiscal year 2004 consisted of a two-pronged review—payments made from headquarters and payments from the 38 mission accounting stations. According to USAID, approximately 75 percent of payments are made at headquarters and 25 percent from the mission offices. For the headquarters’ risk assessment, USAID stated it performed a review of all 11 payment streams; however, it did not perform any risk assessment procedures for two of the payment streams—training and transportation—because each of these payment streams’ total outlays did not exceed $10 million, and therefore, would not have met OMB’s dual criteria for estimating and reporting improper payments. As part of its risk assessment process, USAID officials told us that they conducted interviews with management and various operation managers responsible for the payment types to determine internal controls over payment activity. USAID also stated it performed sampling of its fiscal year 2003 travel transactions and reviewed 25 percent of all travel transactions above $2,500 that had been identified as risk susceptible. In addition, USAID met with the OIG and stated that it reviewed certain OIG reports and external audit reports with recommendations, such as Defense Contract Audit Agency (DCAA) audit reports and Single Audit Act reports, to identify internal control weaknesses over grant funds. Lastly, USAID stated that it relied on routine prepayment and postpayment review activities which are designed to help ensure the accuracy and validity of payments made. For example, according to USAID policy, voucher examiners review and process vouchers that contractors submit to USAID for payment; the examiners determine that a valid obligation exists, check mathematical accuracy, and ascertain that proper approvals and authorizations have taken place. For the mission accounting stations’ risk assessment, USAID required that 4 of the 11 payment streams be reviewed since it had access to the payment activity for the remaining 7 payment streams and incorporated those payments into the headquarters risk assessment. Also, similar to headquarters, the mission accounting stations were not required to review payment streams with total outlays less than $10 million. USAID provided general guidance to the controllers of each mission accounting station on IPIA and OMB implementing guidance, and included a memorandum from the Deputy CFO to each controller explaining actions needed to conduct the risk assessment, along with a template for each mission accounting station to complete on their review of the payment transactions. USAID incorporated the results of these payment reviews in the headquarters’ risk assessment to determine overall risk for the agency. For the fiscal year 2005 and 2006 risk assessments, USAID leveraged the work completed for fiscal year 2004, its baseline year, and compared total outlays for each subsequent fiscal year to fiscal year 2004, to determine whether significant changes in reported outlays had occurred. USAID determined that there had been no significant changes and thus applied analytical procedures—consisting of multiplying fiscal year 2004 payment stream percentages of the total fiscal year 2004 net outlay and fiscal years 2005 and 2006 total outlay amounts—to estimate the dollar amount of each payment stream for each of the given years. Using this information, USAID stated that it relied on its reviews of OIG and external audit reports, prepayment and postpayment reviews, and A-123 internal control reviews to ensure the risk of improper payments was minimized. No payment reviews were performed at the mission accounting stations for fiscal years 2005 and 2006 because USAID had determined that payments made by the missions were not high-risk, based on the results of its fiscal year 2004 risk assessment and the quantitative and qualitative procedures performed. USAID officials also informed us that they reviewed various external audit reports and relied on the agency’s routine pre- and postpayment reviews. For example, USAID performs data mining of all payment transactions using vendor information and dollar value to identify potential duplicate payments. At NASA, the OCFO is responsible for executing and meeting the requirements of IPIA for the agency. For fiscal years 2004 through 2006, NASA identified six payment streams as part of its IPIA risk assessment— firm-fixed-price contracts, incentive-fee contracts, award-fee contracts, cost-plus-fixed-fee contracts, other contracts, and grants, totaling about $12 billion annually. See appendix III for a description of each payment stream. These payment streams represent procurement actions and grant awards made at NASA’s headquarters and its nine centers located around the country. For its risk assessment, NASA did not identify a universe of outlays for all types of payment streams such as travel, training, and payroll, for our period of review, fiscal years 2004 through 2006. NASA did provide us with a schedule of six payment streams representing procurement and grant data reported in NASA’s annual procurement reports. Figure 2 provides a breakdown of NASA’s major payment streams with fiscal year 2004 amounts. NASA’s risk assessment included a review of payments made from headquarters and the centers, although it did not include a review of all payment streams. Specifically, for fiscal years 2004 and 2005, NASA only performed a review of its firm-fixed-price payment stream, representing a small portion (about 12 percent for fiscal year 2004 and 20 percent for fiscal year 2005) of total reported payment streams. NASA stated that it excluded its various cost-type contracts because (1) these contracts are subject to interim and closeout audits performed by DCAA, (2) these contract payments may be adjusted in future billings to correct previous errors, and (3) 5 to 10 percent of the cost contract value is withheld until the closeout audit is completed. NASA officials told us that NASA will include cost-type contracts in its fiscal year 2007 risk assessment. Regarding the exclusion of grant payments, NASA stated that these payments are subject to Single Audit Act reviews as well as periodic reviews for compliance with cash management, financial management system, or financial reporting requirements. NASA’s review of its firm- fixed-price payment stream included selecting a sample of firm-fixed-price payment transactions made during one quarter, at headquarters, and each center. NASA provided its centers instructions, consisting of an e-mail from the improper payments coordinator, on the scope of payment transactions to be reviewed. On the basis of the results of each center’s review, NASA reported in its fiscal years 2004 and 2005 PARs that it had no programs and activities susceptible to significant improper payments. For fiscal year 2006, NASA OCFO officials told us that it did not perform a risk assessment of all of its programs and activities due to turnover of its headquarters staff responsible for IPIA and recovery auditing. Instead, NASA relied on its recovery auditing work for fiscal year 2006 to determine that no programs and activities were susceptible to significant improper payments. We found numerous deficiencies in USAID’s and NASA’s procedures. Both agencies lacked a systematic method to determine if risk of improper payments existed in their programs or activities, what those risks were, or the potential or actual impact of those risks on operations. As such, the various procedures performed did not provide meaningful results or may not have adequately depicted the agencies’ risk of improper payments. In addition, we noted USAID and NASA had not assessed the effectiveness of internal controls relied upon and weaknesses existed in payment reviews performed at the agency component level. A lack of detailed written guidance may have contributed to the deficiencies we identified. Although USAID had general guidance in its payables management directive that reiterated IPIA requirements, no procedures existed on how to conduct a risk assessment and evaluate those results. In addition, NASA had not developed any guidance that could direct steps performed to ensure it met applicable IPIA requirements. OMB guidance provides that agencies annually perform risk assessments of their programs and activities, but offers limited information on how to conduct a risk assessment, thus allowing agencies broad flexibility for determining a methodology to employ to meet IPIA requirements. In our November 2006 report, we recommended, and OMB agreed, that the IPIA implementing guidance be expanded to describe in greater detail factors that agencies should consider when conducting their annual risk assessments. The OMB guidance, though, has not yet been updated to describe risk factors agencies should consider when conducting their annual risk assessments. While OMB does not require agencies to develop agency-specific guidance related to IPIA, during our review of agencies’ internal IPIA guidance, we noted that nine agencies had developed either guidance or a tool, such as a schedule, survey, or questionnaire, to facilitate their compliance with IPIA. As the risk assessment is a key step in gaining assurance that programs and activities are operating as intended and that they are achieving expected outcomes, it is critical that agencies develop a comprehensive approach for determining the extent and level of risk of improper payments in order to identify the nature and type of corrective action needed. For the first 3 years of IPIA implementation, significant flaws existed in USAID’s and NASA’s processes to identify risk in their payment activities. For example, neither agency had established or considered risk factors to assist them in identifying programs and activities vulnerable to improper payments, such as assessments of internal control, audit report findings, and human capital risks related to staff turnover, training, or experience. We noted that some agencies have developed factors or risk conditions that directly or indirectly affect the likelihood of improper payments within a program or activity. We noted from our review of fiscal year 2006 PARs or annual reports that 13 agencies reported that one of the risk factors they considered during the assessment included internal and external reviews, such as results from identified system or program weaknesses, and OIG and Single Audit Act reports. Similarly, 13 agencies reported that an assessment of internal controls was another type of risk factor used during their process. Although there is no requirement for agencies to identify risk factors as part of their risk assessment process, this type of identification is consistent with our previous recommendation that OMB establish risk factors in its guidance for agencies to consider and consistent with our Standards for Internal Control in the Federal Government and executive guide on strategies to manage improper payments, which provides a framework for conducting a comprehensive risk assessment. Our executive guide identifies the following four strategies that should be considered when determining the nature and extent of improper payments: institute a systematic process to estimate the level of improper payments being made by the organization; based on this process, determine where risks exist, what those risks are, and the potential or actual impact of those risks on program operations; use risk assessment results to target high-risk areas and focus resources where the greatest exposure exists; and reassess risks on a recurring basis to evaluate the impact of changing conditions, both external and internal, on program operations. While USAID and NASA did perform procedures that addressed some of the common risk factors identified by other agencies, there was no established process in place to identify the types of risk specific to the payment streams reviewed during the assessment process. Had both agencies made a more concerted effort to identify particular risk factors, additional procedures may have been considered, facilitating a more in- depth review and analysis of their payment streams or program operations. We also found that USAID and NASA had not developed a standardized process to evaluate the results of actions they completed as part of their risk assessments, such as weighting and scoring the results of risk conditions to determine susceptibility. As such, the various procedures performed did not provide meaningful results or adequately depict the agencies’ risk of improper payments. For example, both agencies reported performing one or more of the following steps—assessing internal controls, reviewing external audits, and conducting payment reviews—yet neither agency developed a process that identified the potential or actual impact of those results, and ultimately risks, on their agency operations. Assessing the results or risk conditions identified during the risk assessment plays a major role in determining the overall risk level of an agency’s operations as risk conditions do not have an equal effect on all programs or activities. Some risk conditions may affect a program or activity to a greater or lesser degree. Likewise, not all risk conditions may be relevant to each program or activity. Therefore, assigning a weight to each risk condition would accurately reflect the level of importance and influence each risk condition has on a specific program or activity. We view findings from OIG and external audits as valuable information that agencies can use to identify areas vulnerable to improper payments. OIG and external audits, such as performance audits, provide an objective and systematic examination of evidence for the purpose of providing an assessment of the performance of a government organization, program, activity, or function. As part of its risk assessment, USAID reported conducting a review of OIG and external audits, while NASA did not. Yet, as previously stated, USAID did not have a process in place to evaluate the potential or actual impact of those risks on operations. For both USAID and NASA, we identified various GAO, OIG, and Single Audit Act audit reports as well as Department of Justice (DOJ) investigation reports that highlighted fraud, questioned costs, and internal control weaknesses, that may not have been adequately considered during the risk assessment process. Some examples of findings from investigations and audits for fiscal years 2004 through 2006 follow. USAID could not provide a complete accounting of $405 million primarily used to support maternal and child health efforts in Africa, Asia, Latin America, and the Caribbean. A vendor agreed to pay $1.2 million to settle potential claims that it overcharged USAID in three contracts for overseas economic development work. Two vendors agreed to pay a total of $1.31 million to settle allegations that they knowingly submitted more than 100 false claims for reimbursement, overstating the charges actually incurred for freight and insurance. A contractor paid the government $615 million, including $106.7 million to NASA, to resolve criminal and civil allegations that the company improperly used another contractor’s information to procure contracts for launch services worth billions of dollars. A contractor paid a former NASA electrical subcontractor up to $2 million in unsupported costs. In addition, two of the contractor’s senior procurement officials admitted to soliciting and receiving kickbacks from the subcontractor in exchange for bid information and assistance in the approval of change orders. A civil settlement amount of $1.4 million was reached between NASA and the contractor. NASA’s OIG found various weaknesses in NASA’s acquisition and contracting processes such as a lack of a reliable financial management system to track contract spending, inadequate control over government property held by contractors, and procurement process abuses by NASA employees and contractors. As part of their risk assessments, USAID and NASA reported that they relied on pre- and postpayment controls over payment transactions to identify risk. Although USAID and NASA provided us with some general internal controls over various payment streams, neither had documented the controls or the effectiveness of those controls to ensure proper reliance for purposes of conducting a risk assessment. In addition, USAID officials told us that they had interviewed management and various program managers to assess internal controls. However, USAID had not developed a list of, or series of questions—such as a standard questionnaire—to ensure consistency regarding the types of questions asked across agency operations and that focused discussions on specific issues related to improper payments and internal controls. Similarly, NASA told us that it relied on postpayment controls over its various cost- type contracts, thus excluding over 80 percent of its procurement dollars, and ultimately the related contract payments. Yet, NASA performed no independent assessments of these postpayment controls and was not knowledgeable of specific procedures DCAA performed during its contract audits. As previously mentioned, NASA officials told us that they will include cost-type contracts in NASA’s fiscal year 2007 risk assessment. Although USAID and NASA performed select payment reviews as part of their risk assessment, we found no established criteria for conducting these reviews and the reviews were limited in scope in some instances, as well as inconsistently performed. Because of the lack of guidance and insufficient review, USAID and NASA cannot be certain that these payment reviews adequately support that payments made were not susceptible to significant improper payments. For its fiscal year 2004 risk assessment, USAID instructed its 38 mission accounting stations to perform payment reviews of their payroll, travel, allowances, and other payment streams totaling about $159 million. Although USAID provided its mission accounting stations with general guidance regarding IPIA and a template to use when performing their payment reviews, there were no detailed instructions on specific characteristics or attributes of the payment transactions that the mission accounting stations should review to identify improper payments. USAID told us that the mission accounting stations had flexibility in tailoring the extent of their risk assessments and sampling methodology because they collectively represent only 25 percent of USAID’s total disbursements and each mission (1) differs based on the nature of its programs and the volume of payment activity and (2) performs 100 percent of payment reviews as part of its normal course of business. Therefore, some mission accounting stations may have conducted statistical or nonstatistical sampling while others performed 100 percent payment reviews. As a result, such payment review results may not be comparable among mission accounting stations or representative of their payment activity. USAID stated that it was not possible to verify or validate any of the information received from the mission accounting stations since they used stand-alone accounting systems that were not integrated with headquarter’s accounting system during our period of review. From these payment reviews, the mission accounting stations collectively identified about $258,973 in improper payments for fiscal year 2004. On the basis of the fiscal year 2004 mission risk assessment results and other quantitative and qualitative analysis performed, USAID determined that payments made from mission accounting stations were low-risk and therefore it did not conduct separate payment reviews for fiscal years 2005 and 2006. For its fiscal years 2005 and 2006 payment reviews at headquarters, USAID stated it relied on its reviews of OIG and external audit reports, pre- and postpayment reviews, and A-123 internal control reviews. However, we were unable to verify that all payment streams were included in the reviews and could not evaluate any procedures performed as USAID was unable to provide documentation that supported these actions or their results. We identified similar weaknesses in NASA’s payment reviews. For example, NASA also lacked established criteria for payment transaction reviews conducted by its centers for purposes of IPIA, including specific characteristics or attributes of the payment transactions that the centers should review to identify improper payments. This led to inconsistent application of the methodology that centers were asked to use to conduct their payment reviews. For example, one NASA center selected payment transaction amounts of $100,000 or greater rather than the 15 percent of its first quarter payments consistent with the other centers and as requested by NASA headquarters. The same center also noted that it reviewed documentation to determine whether or not the payments complied with Prompt Payment Act provisions, rather than IPIA requirements. When we brought it to their attention, NASA OCFO officials said that the center could have erroneously tested according to the wrong act. On the basis of its testing of transactions, NASA reported that it identified $70,599 in improper payments for fiscal year 2004 from its examination of $14.6 million in firm-fixed-price contract payments and identified $617,442 in improper payments for fiscal year 2005 based on its examination of $82.5 million of those same types of contract payments. However, we noted that NASA did not verify the results of its centers’ payment reviews. Furthermore, NASA’s independent auditor reported in fiscal year 2004 that the agency may not have fully complied with IPIA requirements because NASA did not consider payments other than firm-fixed-price contract payments as part of the risk assessment process or prepare an estimate of improper payments. Therefore, the total improper payment amounts reported may not be accurate, especially given the inconsistencies we identified. For fiscal year 2006, according to OCFO officials, NASA did not conduct any payment reviews or overall risk assessment of its payment activities due to headquarters staff turnover responsible for IPIA. Instead, it relied on its recovery audit work performed during the year to conclude it had no programs and activities susceptible to significant improper payments. The adequacy of such a determination is questionable because the scope of review under the Recovery Auditing Act targets a specific type of payment—contracts—whereas the scope of review under IPIA includes a review of all programs and activities that are subject to different reporting requirements if they are found to be susceptible to significant improper payments. Furthermore, OMB guidance under the Recovery Auditing Act allows agencies to exclude certain classes of contracts from consideration, which is not permitted under IPIA. Under IPIA, all programs and activities are subject to review. Although NASA reported its payment reviews were statistically based, its minimal coverage of the firm-fixed-price payment stream was inconsistent with OMB guidance that directs that agencies use a 12-month period to report improper payment information. Specifically, for fiscal years 2004 and 2005, NASA identified a small universe of firm-fixed-price procurement payments as the basis for each year’s payment reviews. Already representing a small percentage of total reported payment streams—12 percent for fiscal year 2004 and 20 percent for fiscal year 2005—NASA OCFO further narrowed the scope of dollars to be reviewed by instructing its centers to select statistical samples of only 15 percent of its firm-fixed-price contract payments made during a 3-month period, January 1 to March 31 of each year. NASA was unable to provide an explanation for the basis of these limited reviews. Despite NASA’s reported use of statistical sampling to conduct its payment reviews, its small sample population and minimal coverage of the firm-fixed-price payment stream compared to total procurement dollars does not adequately represent NASA’s total contract activity, which accounts for about 85 percent of NASA’s annual budget. Furthermore, NASA excluded grant program payments, totaling about $630 million for fiscal year 2004, from its risk assessment review. OMB guidance requires that agencies include federal awards subject to the Single Audit Act, as amended, as part of their review to address IPIA reporting requirements. In its fiscal year 2004 audit report, NASA’s auditors reported that the agency may not have fully complied with IPIA requirements as it did not explicitly consider payments other than firm- fixed-price as part of the risk assessment process or prepare an estimate of improper payments. The auditors also reported that NASA noted that audit efforts by nonfederal auditors with respect to grantees and by government auditors with respect to certain NASA contracts aid in identifying and mitigating improper payments. While single audits could be a source of improper payment information, we previously reported that single audits, by themselves, may lack the level of detail necessary for achieving IPIA compliance. Specifically, single audits generally focus on the largest dollar amounts in an auditee’s portfolio. Thus, all programs identified as susceptible to improper payments at the federal level may not receive extensive coverage under a single audit. Consequently, both the depth and level of detail of single audit results are, generally, insufficient to identify improper payments, estimate improper payments, or both. While OMB guidance requires agencies to maintain documentation of their risk assessment, USAID and NASA were unable to support a majority of the actions highlighted earlier in this report regarding their risk assessment processes. Given the lack of documentation and deficiencies we found relating to USAID’s and NASA’s risk assessments, we have no basis to determine whether steps performed supported both agencies’ conclusions that no programs and activities were susceptible to significant improper payments. Our Standards for Internal Control in the Federal Government provides that internal control and all transactions and other significant events need to be clearly documented and readily available for examination. The documentation should appear in management directives, administrative policies, or operating manuals. Also, all documentation and records should be properly managed and maintained. At USAID, we noted a documentation requirement in its policy directive related to IPIA reporting, yet the agency was unable to provide us the following for each of the 3 fiscal years: documentation to support interviews of program managers regarding program operations and internal control; testing of headquarters payment transactions, including sampling plans of statistical samples used to test travel and other payment transactions, a list of sample transactions selected, key attributes tested, and evaluation of those results; and a list of external audit reports reviewed, their findings, and impact on the risk assessment process. Furthermore, we found discrepancies when tracing lead schedules to supporting documentation and inadequate documentation of USAID’s duplicate payment reviews. For example, as part of its duplicate payment reviews, USAID did not document the search criteria used to identify potential duplicate payments, the range of payments reviewed to prevent overlapping or reviewing the same payments in subsequent reviews, and the potential duplicate payments flagged and their resolutions. Similarly, NASA provided us minimal supporting documentation of its payment reviews for fiscal year 2004 and could not provide almost half of the documentation for fiscal year 2005. NASA told us that each year’s payment reviews were based on a statistical sample of payments made at headquarters and its centers. However, NASA could not provide us a copy of its sampling plans, list of transactions selected, sample results, and subsequent evaluation. NASA relied almost entirely on these payment reviews to support its conclusion that it had no programs and activities susceptible to significant improper payments for fiscal years 2004 and 2005, yet could not provide documentation to support its conclusions. For fiscal year 2006, NASA acknowledged that it did not perform a risk assessment due to staff turnover, and thus no documentation existed. Nevertheless, NASA still reported that it had no programs and activities of significant risk based on recovery audit work performed on its research and development contracts. Had NASA adequately documented its IPIA efforts from the previous fiscal years, it would have been better positioned to address IPIA requirements for fiscal year 2006. Thus, documentation becomes even more essential during periods of staff transition. The magnitude of the lack of documentation issue was evident in the NASA auditor’s report on compliance with laws and regulations for fiscal year 2006. In that report, the auditor raised concerns about the lack of documentation to support the agency’s IPIA efforts. Specifically, the auditor reported that NASA had potentially violated certain requirements of IPIA as management was unable to provide sufficient documentation to support performance of an annual review of all programs and activities it administers to identify those that may be susceptible to significant improper payments. Although USAID and NASA have reported on steps taken to recoup improper contract payments, we found several weaknesses in their recovery auditing procedures for fiscal years 2004 through 2006. In particular, USAID and NASA did not report recovery auditing information for each fiscal year, documentation was lacking or not adequately supported, and neither agency adhered to all of the reporting requirements outlined in OMB’s implementing guidance. Due to a lack of, or insufficient, documentation, along with identified weaknesses, the validity and accuracy of the reported recovery amounts are questionable. USAID and NASA did not fully report on recovery audit activities for each of the 3 fiscal years under review. Specifically, USAID and NASA did not report recovery audit information in their fiscal year 2004 PARs. NASA reported that it was in the process of awarding a recovery audit contract, while USAID reported on the dollar amount of contracts reviewed, but for the sole purpose of addressing IPIA reporting requirements and concluding that its grant and contract payment activities were not susceptible to significant improper payments. Consequently, OMB did not recognize USAID or NASA as reporting fiscal year 2004 recovery audit information when it reported on governmentwide recovery audit efforts for that year. For fiscal year 2005, USAID again leveraged the work used to address IPIA requirements to satisfy the requirements of the Recovery Auditing Act. USAID reported about $5.9 million in questioned costs identified through OIG audits of grants and contracts. Of this amount, about $5.8 million (98 percent) had been recovered. While USAID reported this information in its PAR, the agency was unable to provide us a list of the audit reports reviewed and specific findings that supported the amounts identified and actually recovered, raising questions about their validity and accuracy. Likewise, NASA leveraged the results of its IPIA work to address the recovery auditing requirements. However, as we stated earlier, the scope of review was limited in nature as NASA only tested 15 percent of its firm- fixed-price contract payments over a 3-month period and could not provide almost half of the documentation to support the dollar value sampled. On the basis of its limited testing, NASA identified and recovered only $617,442 in contract overpayments. For fiscal year 2006, USAID reviewed questioned costs identified through OIG audits of grants and contracts as it had done in the previous fiscal year. USAID reported about $9.1 million in questioned costs identified through OIG audits of grants and contracts and DCAA contract audits. Of this amount, about 99 percent had been recovered. Again, USAID was unable to provide documentation of the specific audit reports and findings to support the recovery audit amounts. In addition to the lack of documentation for both fiscal years 2005 and 2006, the audit reports used may not have been designed to identify the types of payment errors that would be identified through a recovery audit, as USAID stated that some of the audit findings resulted from DCAA contract audits. OMB guidance differentiates procedures performed under a recovery audit versus a contract audit. OMB guidance defines a recovery audit as a review and analysis of the agency’s books, supporting documents, and other available information supporting its payments that is specifically designed to identify overpayments to contractors that are due to payment errors. On the other hand, contract audits are normally performed for the purpose of determining if amounts claimed by the contractor are in compliance with the terms of the contract and applicable laws and regulations and are not designed to specifically identify payment errors as described under recovery audits. If the DCAA and OIG audit reports used by USAID to identify the recovery auditing amounts were not specifically designed to identify payment errors, as defined by OMB, the reported recovery audit amounts for fiscal years 2005 and 2006 may not accurately reflect payment errors for purposes of recovery auditing and thus, may be misstated. NASA used a recovery audit firm for fiscal year 2006 to review contract payments made from fiscal years 1997 through 2005, totaling $57.4 billion. Of this amount, the recovery audit firm identified over $121 million in potential contract overpayments. However, based on NASA’s review and conclusion that most of the potential contract overpayments identified by the recovery audit firm were not erroneous, it reported significantly lower recovery audit amounts—$256,255 in contract overpayments identified for recovery and $139,420 in actual recoveries. See table 1 for recovery audit amounts reported by USAID and NASA for fiscal years 2004 through 2006. We asked NASA officials about the significant difference in its reported recovery audit amounts when compared to the recovery auditor’s reported amounts. According to NASA, the firm’s recovery auditing work covered all contract types from fiscal years 1997 through 2005. Upon further review of the contractor’s submitted claims, NASA determined that a vast majority of the claims submitted by the contractor were not erroneous as they related to cost-type contracts with provisional billing rates included in the contract terms, which were subject to a final or closeout audit that would likely have identified those improper payments reported by the contractor. Thus, NASA officials stated that only a small portion ($256,255) of the $121 million in potential contract overpayments represented “valid contract claims” or contract overpayments that would be pursued for recovery. OMB guidance for recovery auditing allows agencies to exclude classes of contracts and contract payments from recovery audit activities when they have determined that recovery audits are “inappropriate or are not a cost-effective method for identifying and recovering erroneous payments.” Examples OMB provides as classes of contracts and contract payments that may be excluded include cost-type contracts that have not been completed where payments are interim, provisional, or otherwise subject to further adjustment by the government in accordance with the terms and conditions of the contract; cost-type contracts that were completed, subjected to a final contract audit and, prior to final payment of the contractor’s final voucher, all prior interim payments made under the contract were accounted for and reconciled; and other contracts that provide for contract financing payments or other payments that are interim, provisional, or otherwise subject to further adjustment by the government in accordance with the terms and conditions of the contract. Although NASA’s exclusion of the bulk of the recovery audit firm’s potential contract overpayments (primarily related to cost-type contracts) was consistent with OMB guidance, which allows agencies to exclude these classes of contracts, limiting its universe to firm-fixed-price contracts may not be the best use of resources. These types of contracts typically provide the least amount of risk of improper payments as firm- fixed-price contracts are generally not subject to fluctuations in contractor costs, thereby decreasing the risk level of improper payments made by agencies. However, NASA officials told us that because its cost-type contract payments are subject to extensive reviews via contract audits and internal reviews, further examination under a recovery auditing program would not provide any additional value and could be, to some extent, duplicative in nature. There are several reporting requirements that agencies are required to follow when reporting recovery auditing information, such as a description and justification of the classes of contracts excluded from recovery auditing and a corrective action plan to address the root causes of any payment errors. Agencies are also required to report, in table format, various amounts related to contracts subject to review and actually reviewed, contract amounts identified for recovery and actually recovered, and prior-year amounts. From our review, we found that USAID’s and NASA’s reporting of recovery auditing information did not meet the OMB reporting requirements. Although we noted improvement in both agencies’ fiscal year 2006 reporting of recovery auditing information when compared to the previous fiscal year, USAID and NASA still had not addressed all key elements. For example, both USAID and NASA provided a general description of the steps taken to carry out their recovery auditing program for fiscal year 2006 and presented, in table format, the various recovery auditing amounts on contracts subject to review, identified for recovery, and actually recovered. However, we found no description of a corrective action plan to address the root causes of payment error. In addition, for fiscal year 2005, NASA only reported on recovery audit results for its firm- fixed-price contract overpayments, but this information and its exclusion of other contract types were not disclosed in NASA’s PARs. Without adequate disclosure, this type of presentation may lead to a mischaracterization of the extent to which contract overpayments exist. While USAID and NASA have experienced significant challenges in their first 3 years of IPIA implementation, both agencies have taken steps to strengthen their risk assessment processes and ultimately, IPIA reporting. Actions are also under way to improve recovery auditing efforts. However, improvements are still needed to address some of the weaknesses related to conducting risk assessments and performing recovery auditing procedures. USAID has taken several steps to strengthen its process for identifying programs and activities that may be susceptible to improper payments, but additional steps are needed to adequately address IPIA reporting requirements. USAID has developed a new IPIA database that is intended to compile all of its payment disbursements made worldwide. The new, interactive tool will interface with its core accounting system, Phoenix, which will enable USAID to annually identify its payment streams and corresponding volume and dollar amounts by mission or geographic location, data mine for duplicate payments, research other payment anomalies, and perform tests of transactions. USAID told us that since August 2006, when Phoenix was fully implemented agencywide, its monitoring capabilities and testing of payment transactions had increased significantly now that its headquarters staff has access to all disbursement activity regardless of where the payments were made. Going forward, USAID also stated it plans to work more closely with the OIG, including working with the OIG to develop a statistical sampling methodology for testing its payment streams agencywide as part of its risk assessment process. USAID also stated that it will periodically contact OMB for input and feedback related to its risk assessment process and results. Other steps USAID plans to implement include (1) leveraging the agency’s assessment of internal control under OMB Circular No. A-123 requirements to determine whether control activities in place are effectively preventing improper payments; (2) increasing accountability among managers responsible for addressing IPIA reporting requirements by including IPIA responsibilities in their work plans, which are tied to the managers’ performance assessments; and (3) improving its documentation of steps performed to comply with OMB guidance and internal policy. If these actions are properly implemented, we believe these actions will address some of our concerns related to conducting an assessment of internal control and testing of payment transactions. Specifically, these actions will better position USAID to identify and target high-risk areas, determine the effectiveness of control activities to reduce the risk of improper payments, and provide accountability among managers responsible for executing IPIA activities. With regard to manager accountability, we noted that no specific standards have been developed for rating employee performance against responsibilities related to IPIA and that no performance awards or disciplinary actions exist as incentives for reducing improper payments, which may not achieve the desired effect. Lastly, USAID still lacks a systematic method to determine if risk of improper payments exists, what those risks are, and the potential or actual impact of those risks on operations. For example, while USAID has developed various quantitative and qualitative procedures as part of its risk assessment process, it still has not taken the first step of identifying and documenting risk factors that should be considered to ensure that the procedures performed adequately address areas within the agency that may be susceptible to improper payments. Furthermore, USAID has not developed an overall approach to then evaluate the work performed, including weighting and scoring the results of its quantitative and qualitative analysis, and thus provide a basis for making a final determination of its risk level for assessing improper payments under IPIA. We believe that implementation of these types of strategies to identify the nature and extent of improper payments is consistent with our framework for conducting risk assessments and will provide a comprehensive review and analysis of program operations. NASA has made significant strides since its first year of IPIA implementation to improve its approach for conducting risk assessments and other IPIA reporting requirements. NASA hired a consulting firm for 2 months (February 2007 through March 2007) to develop a methodology for conducting its fiscal year 2007 risk assessment. The consultant categorized the agency’s fiscal year 2006 disbursements, including cost-type contracts and grant payments, by programs instead of by payment streams, as was done by NASA in previous years. On the basis of its review of disbursements, the consulting firm established a materiality level of $80 million. All programs with total disbursements greater than $80 million were included in the program universe for further review. The consultant identified 30 programs with approximately $10.8 billion in disbursements to include in the scope of review for determining risk level. To assess the risk level of the programs, the consultant examined agency documentation and conducted (1) site visits; (2) interviews of program managers, other agency personnel, and NASA OIG; and (3) walk-throughs of program operations. On the basis of these steps, the consultant identified seven risk conditions and developed a risk matrix to evaluate and score each risk condition, using a 5 point scale—with 1 point indicating low risk and 5 points indicating high risk. Following a calculation of the key risk factors that considered the frequency of risk, severity of risk, and the overall risk score, 5 of the 30 programs were deemed to be at risk for being susceptible to significant improper payments. The 5 programs are (1) Mars Exploration, (2) Solar System Research, (3) Space Shuttle Program, (4) International Space Station Program, and (5) Institutions and Management. NASA subsequently hired another consulting firm to conduct statistical sampling from April 2007 through September 2007 of the 5 programs to determine if the programs are susceptible to significant improper payments and thus would need to estimate and report on the amounts of improper payments and actions to reduce them. Within each of these 5 programs, the consulting firm identified five payment categories that were subject to detailed testing; they were travel expense reimbursement, payroll and employee benefits, grant payments, government purchase cards, and procurement and contracts. From its review, the consulting firm found approximately $884,243 of improper payments during the period of October 1, 2005, through September 30, 2006. Although the consulting firm reported that no significant improper payments were found, it recommended various actions for NASA to take, including continuing to ensure that internal controls—automated and manual—are operating effectively relating to the receipt and processing of vendor invoices to ensure timely payment. The consulting firm submitted its final report with recommendations for improvement on October 23, 2007, in time for inclusion in NASA’s fiscal year 2007 PAR. During our review, NASA acknowledged weaknesses in its IPIA reporting for fiscal years 2004 through 2006 and stated that its risk assessment procedures did not adequately address OMB guidance. However, NASA felt confident that it had made significant gains with its IPIA reporting for fiscal year 2007. Although we did not perform a detailed review of its methodology—the work was ongoing during our fieldwork—NASA, with the assistance of outside contractors, appears to have developed an extensive methodology for conducting a risk assessment to identify programs and activities susceptible to significant improper payments. The steps taken thus far appear to align with our framework for conducting a risk assessment to determine the nature and extent of improper payments. In June 2006, USAID engaged the services of a recovery auditing firm to perform recovery auditing activities for its fiscal year 2007 PAR reporting. For the fiscal year 2007 reporting period, the recovery auditor’s scope of review included payments made at headquarters for fiscal years 2003 through 2005. For payments made from mission accounting stations that were captured in USAID’s core accounting system, the recovery auditors performed analytical procedures and concluded that no further work was warranted. The recovery auditors developed a three-tier process to identify the following types of potential contract overpayments: first tier—potential duplicate payments, second tier—amounts paid that exceeded the obligation or any adjustments not properly accounted for, and third tier—invoices and payment vouchers with errors, including general and administrative rate variances. From its review, the recovery auditor identified 300 contracts, comprising 2,900 invoices, that warranted further review. The recovery auditor also reported that it randomly sampled an additional 900 invoices for review, but did not identify the number of contracts. On the basis of its work, the auditors referred $3 million of potential contract overpayments to USAID for review. From its review, USAID determined that of the $3 million, approximately $11,000 constituted actual overpayments related to discount claims that had not been taken and decided it would initiate collection efforts. However, we were provided no documentation of the resolution of remaining contract payments determined not to be improper. After completing a limited review of fiscal year 2005 payments, the recovery auditor decided to discontinue its recovery auditing work at USAID as the results of its limited review revealed that the continuation of audit work would not be economically feasible or profitable. For its fiscal year 2007 PAR reporting, USAID stated it will report on the work performed by the recovery auditor. Going forward, USAID plans to conduct an in-house recovery auditing program as done in previous years, but stated it would work with the OIG to enhance procedures and address requirements in OMB’s guidance. While the hiring of a recovery auditor did not identify a significant amount of contract overpayments, additional steps would help USAID ensure that its in-house recovery auditing program is consistent with the requirements of the Recovery Auditing Act and specifically designed to identify overpayments to contractors that are due to payment error. For fiscal year 2007, NASA recompeted its contract for recovery auditing services and hired another recovery auditing firm in August 2007. NASA stated that the scope of review will include only fiscal year 2006 fixed price contract payments valued at $1,000 or more. Although consistent with OMB guidance, NASA’s universe of contract dollars subject to a recovery auditing program continues to remain relatively small, less than 20 percent of the total value of its contracts. As part of its recovery auditing procedures, the contractor will interview agency personnel and review applicable documentation to gain an understanding of NASA’s payment processes. NASA anticipates reporting interim results of initial recoveries of contract overpayments in its fiscal year 2007 PAR. Because the recovery auditor had just begun work to develop and execute an approach for conducting the recovery audit, we were unable to determine the reasonableness of its methodology by the end of our fieldwork. Measuring improper payments and designing and implementing actions to reduce them are not simple tasks and will not be easily accomplished. USAID and NASA, under the umbrella of OMB’s leadership, are working on this issue. Further, while internal control should be maintained as the front-line defense against improper payments, recovery auditing holds promise as a cost-effective means of identifying contractor overpayments. Preventing, identifying, and recovering improper payments in that order are what is needed across government. Both USAID and NASA have taken positive steps towards better implementation of improper payments and recovery auditing requirements for fiscal year 2007. Fulfilling the requirements of IPIA and the Recovery Auditing Act will require sustained attention to implementation and oversight to monitor whether desired results are being achieved. We are making a total of 10 recommendations to USAID and NASA to help improve their efforts to implement IPIA and the Recovery Auditing Act by focusing on performing risk assessments and reporting on efforts to recover improper payments. Specifically, we recommend that the Administrator, USAID, expand existing IPIA guidance to include detailed procedures for addressing the four key steps—perform risk assessment, estimate improper payments, implement a corrective action plan, annually report—that OMB requires agencies to perform in meeting the improper payment reporting requirements; develop a risk assessment tool, such as a risk assessment matrix, to determine if risks exist, what those risks are, and the potential or actual impact of those risks on program operations; use the risk assessment tool to institute a systematic approach to identify programs and activities susceptible to significant improper payments under IPIA; maintain documentation of actions performed to address IPIA and the Recovery Auditing Act requirements; develop a comprehensive recovery auditing program that is specifically designed to identify overpayments to contractors that are due to payment errors; and adhere to OMB’s guidance for reporting recovery auditing information in the annual PAR. We recommend that the Administrator, NASA, develop IPIA guidance to include detailed procedures for addressing the four key steps—perform risk assessment, estimate improper payments, implement a corrective action plan, annually report—that OMB requires agencies to perform in meeting the improper payment reporting requirements; as part of this guidance, incorporate the risk assessment methodology developed by NASA’s consulting firm to determine if risks exist, what those risks are, and the potential or actual impact of those risks on program operations; maintain documentation of actions performed to address IPIA and Recovery Auditing Act requirements; and adhere to OMB’s guidance for reporting recovery auditing information in its annual PAR. We requested comments on a draft of this report from the Administrators of USAID and NASA or their designees. These comments are reprinted in their entirety in appendixes IV and V of this report. USAID did not specifically respond to our recommendations. However, USAID suggested expanding the definition of its Credit-Financing payment stream to provide more details on the purpose and use of this funding mechanism, which we incorporated as suggested. NASA concurred with all four of our recommendations and indicated that it would develop IPIA guidance to include detailed procedures to address the four key steps of IPIA, including incorporating the risk assessment methodology developed by its consulting firm. NASA noted that it has centralized its IPIA and Recovery Auditing Act activities at the NASA Headquarters OCFO (which will include responsibility for maintaining documentation to support its activities) and stated that it will report recovery auditing information in its PAR in accordance with OMB guidance. NASA also provided technical comments on the draft, which have been incorporated as appropriate. As agreed with your offices, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after its date. At that time, we will send copies of this report to the Administrators of USAID and NASA and other interested parties. Copies will also be available to others upon request. In addition, the report is available at no charge on GAO’s Web site at http://www.gao.gov. If you or your staffs have any questions regarding this report, please contact me at (202) 512-9095 or at williamsm1@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Major contributors to this report are listed in appendix VI. The objectives of this review were to determine (1) the extent to which USAID and NASA performed the required risk assessments to identify programs and activities that were susceptible to significant improper payments for fiscal year 2004 through fiscal year 2006, (2) steps USAID and NASA have taken to recoup improper payments through recovery audits, and (3) actions USAID and NASA have under way to improve their IPIA and recovery audit reporting. The scope of our review included two agencies, USAID and NASA. To determine the extent to which USAID and NASA performed the required risk assessments for fiscal years 2004 through 2006, we reviewed improper payment legislation and OMB implementing guidance. For both agencies, we reviewed their PARs for fiscal years 2004 through 2006; reviewed internal guidance consisting of policies and procedures to address cash disbursements, accounts payable, and contract management; interviewed agency officials about the risk assessment process; and, when available, obtained and reviewed supporting documentation. In addition, we reviewed criteria for conducting risk assessments in our Standards for Internal Control in the Federal Government and executive guide on Strategies to Manage Improper Payments: Learning from Public and Private Sector Organizations. We also reviewed other agencies’ PARs and internal IPIA guidance to identify examples of risk factors used and procedures followed when conducting their risk assessment process. To determine steps USAID and NASA took to recoup improper payments through recovery audits, we reviewed the Recovery Auditing Act and Appendix C to OMB Circular No. A-123, Requirements for Effective Measurement and Remediation of Improper Payments. For both agencies, we reviewed their PARs for fiscal years 2004 through 2006 and internal guidance over contract management and debt collection activities. We also interviewed agency officials and their recovery audit contractor about recovery auditing efforts and when available, obtained and reviewed supporting documentation for recovery auditing amounts reported in the PARs. To determine actions USAID and NASA had under way to improve their IPIA and recovery audit reporting, we interviewed agency officials and when available, obtained supporting documentation of plans for fiscal year 2007 reporting. We also reviewed the agencies’ fiscal year 2006 PARs, Request for Proposal documents, and Statements of Work documents for hired contractors. To assess the reliability of USAID’s and NASA’s IPIA and recovery auditing reporting, we talked to agency officials about data quality control procedures and reviewed relevant documentation. For example, to determine the reliability of USAID’s payment inventory data for fiscal year 2004, we tied USAID’s total payment streams to the Statement of Budgetary Resources included in the financial section of the agency’s PAR. For NASA, we applied alternative analytical procedures to assess the reliability of NASA’s payment data, as we did not receive a breakout of the payment streams to tie directly to the Statement of Budgetary Resources. We compared procurement obligations contained in the annual procurement reports with NASA’s net outlays in the Statement of Budgetary Resources for fiscal year 2006. We matched the percentage of obligations with information contained in our fiscal year 2007 High-Risk Series, and found that fiscal year 2006 net outlays comprised approximately 85 percent of obligations. We determined the data were sufficiently reliable for the purposes of this report. We requested comments on a draft of this report from the Administrators of USAID and NASA or their designees. Written comments were received from the Counselor to the Agency, USAID, and Deputy Administrator, NASA, on October 26, 2007. USAID’s and NASA’s comments are reprinted in appendixes IV and V. We conducted our work from September 2006 through August 2007 in accordance with generally accepted government auditing standards. For fiscal years 2004 through 2006, USAID based its improper payment risk assessments on 11 payment streams—(1) Payroll, (2) Mission Allowances, (3) Cash Transfers, (4) Travel, (5) Transportation, (6) Training, (7) Other Operating Expenses, (8) Payments to Other Agencies, (9) Credit-Financing Funds, (10) Revolving Funds, and (11) Contracts, Grants, and Cooperative Agreements. A description of the 11 payment streams, along with a definition of each, follow. 1. Payroll. This payment stream consists of all U.S. direct hire base pay and related expenses, foreign national direct hire payroll, retirement and benefits, all personal services contractor’s payroll, and all foreign national personal services contractor’s payroll, retirement, and benefits. 2. Mission Allowances. This payment stream consists of employee allowances, cost of living, educational allowances, and home service transfer allowances. 3. Cash Transfers. This payment stream consists of the agency’s cash transfers to the benefiting foreign countries as well as foreign organizations. These payments are made and deposited via the U.S. Treasury and/or the Federal Reserve Bank into the foreign government’s account as designated in the official agreement or treaty between the U.S. and the foreign government. 4. Travel. This payment stream represents all travel expenses, including travel costs incurred for educational language training, evacuation, postassignment travel to field, home leave and rest and relaxation, site visits to mission offices, conferences, seminars, and meetings, and other operational travel. 5. Transportation. This payment stream consists of all transportation and freight costs incurred to missions or headquarters and from missions or headquarters. 6. Training. This payment stream consists of all costs incurred to obtain technical and professional training, such as language training, certification training for contract, project, and financial offices, training support costs, and other technical and professional training. 7. Other Operating Expenses. This payment stream consists of other expenses incurred by USAID to perform its work. Examples of other operating expenses are supplies, local travel, conferences, and other miscellaneous expenses that are deemed necessary for the successful performance of USAID’s work. 8. Payments to Other Agencies. This payment stream consists of all payments made to other federal agencies for services and/or goods received. Outlays include rental payments to the General Services Administration for office and warehouse rent, payments to the Office of Personnel Management for background investigation services, and payments to the Defense Contract Audit Agency for federal audit services. 9. Credit-Financing Funds. This payment stream is principally intended for credit enhancement purposes and may be used where (a) the agency’s sustainable development objectives may best be achieved effectively using credit, and (b) the risks of default may be reasonably estimated and managed. It is a financing tool to be used in addition to or in lieu of grant funding where appropriate. Credit financing funds agreements will be utilized only when the partner is a non-sovereign entity. No sovereign loan guarantees are permissible under existing credit financing authorities. Credit financing shall be a demand-driven initiative, with operating units having primary responsibility for designing, authorizing, and implementing activities in support of approved strategic objectives and within administration and congressional priorities for assistance. Credit financing operations require a clear separation of responsibility for assessing the developmental soundness and the financial soundness of each activity, with the latter responsibilities entrusted to a credit review board within the agency. Credit financing shall not be used unless it is probable that the transaction would not go forward without it, taking into consideration whether such financing is available for the term needed and at a reasonable cost. 10. Revolving Funds. This payment stream was created for a one-time purchase of land and a building in fiscal year 2004. There were no payments made from this account in either fiscal year 2005 or fiscal year 2006. 11. Contracts, Grants, and Cooperative Agreements. Contract. A mutually binding legal relationship obligating the seller to furnish the supplies or services (including construction) and the buyer to pay for them. It includes all types of commitments that obligate the government to an expenditure of appropriated funds and that, except as otherwise authorized, are in writing. In addition to bilateral instruments, contracts include (but are not limited to) awards and notices of awards; job orders or task letters issued under basic ordering agreements; letter contracts; orders, such as purchase orders, under which the contract becomes effective by written acceptance or performance; and bilateral contract modifications. Contracts do not include grants and cooperative agreements. Grant. A financial support to accomplish a public purpose in the form of money, or property in lieu of money from the federal government to an eligible recipient. Cooperative Agreement. A financial support to accomplish a public purpose in the form of money, or property in lieu of money, from the federal government to an eligible recipient. For fiscal years 2004 and 2005, NASA based its improper payment risk assessments on six payment streams—(1) firm-fixed-price contracts, (2) incentive-fee contracts, (3) award-fee contracts, (4) cost-plus-fixed-fee, (5) other contracts, and (6) grants. NASA did not conduct a risk assessment for fiscal year 2006. Instead, NASA relied on its recovery auditing work to determine that no programs and activities were susceptible to significant improper payments. A description of the six payment streams, along with a definition of each, follow. 1. Firm-fixed-price contracts provide for a price that is not subject to any adjustment on the basis of the contractor’s cost experience in performing the contract. This contract type places upon the contractor maximum risk and full responsibility for all costs and resulting profit or loss. It provides maximum incentive for the contractor to control costs and perform effectively and imposes a minimum administrative burden upon the contracting parties. The contracting officer may use a firm-fixed-price contract in conjunction with an award-fee incentive and performance or delivery incentives when the award fee or incentive is based solely on factors other than cost. The contract type remains firm-fixed-price when used with these incentives. a. Cost-plus-incentive-fee is a cost-reimbursement contract that provides for an initially negotiated fee to be adjusted later by a formula based on the relationship of total allowable costs to total target costs. This contract type specifies a target cost, a target fee, minimum and maximum fees, and a fee adjustment formula. After contract performance, a fee payable to the contractor is determined in accordance with the formula. The formula provides, within limits, for increases in the fee above the target fee when total allowable costs are less than target costs, and decreases in the fee below the target fee when total allowable costs exceed target costs. This increase or decrease is intended to provide an incentive for the contractor to manage the contract effectively. When total allowable cost is greater than or less than the range of costs within which the fee-adjustment formula operates, the contractor is paid total allowable costs, plus the minimum or maximum fee. b. Fixed-price incentive contract is a fixed-price contract that provides for adjusting profit and establishing a final contract price by application of a formula based on the relationship of total final negotiated cost to the total target cost. The final price is subject to a price ceiling, negotiated at the outset. There are two types of fixed- price incentive contracts—firm target and successive target contracts. a. Cost-plus-award-fee is a cost-reimbursement contract that provides for a fee consisting of (a) a base amount fixed at inception of the contract, and (b) an award amount that the contractor may earn in whole or in part during performance and that is sufficient to provide motivation for excellence in such areas as quality, timeliness, technical ingenuity, and cost-effective management. The amount of the award fee to be paid is determined by the government’s judgmental evaluation of the contractor’s performance in terms of the criteria stated in the contract. This determination and methodology for determining the award fee are unilateral decisions made solely at the discretion of the government. b. Fixed-price contracts with award fees (FP-AF), a fixed price consisting of all estimated costs and profit is established at contract award along with an additional, separate award fee amount. The fixed price is paid for satisfactory performance; the award fee, if any, is earned, for performance beyond that required. Procurement officer approval is required for this type of contract. FP-AF combinations are used when the government, although wanting to provide an incentive to the contractor to deliver at an excellent or outstanding technical level, is unable to define that level in quantitative terms, or when metrics are not available or their use is not practical. 4. Cost-plus-fixed-fee is a cost-reimbursement contract that provides for payment to the contractor of a negotiated fee that is fixed at the inception of the contract. The fixed fee does not vary with actual cost, but may be adjusted as a result of changes in the work to be performed under the contract. This contract type permits contracting for efforts that might otherwise present too great a risk to contractors, but it provides the contractor only a minimum incentive to control costs. a. Fixed-price redetermination provides for both a firm fixed price for an initial period of contract deliveries or performance, and prospective redetermination, at a stated time or times during performance, of the price for subsequent periods of performance. b. Fixed-price contracts with economic price adjustment provide for upward and downward revision of the stated contract price upon the occurrence of specified contingencies. Economic price adjustments are of three general types: adjustments based on established prices, adjustments based on actual costs of labor or material, and adjustments based on cost indexes of labor or materials. c. Cost, or cost-no-fee, is a contract where the contractor is reimbursed allowable, allocable, and reasonable costs but receives no fee. Generally, cost contracts are used for research and development work performed by nonprofits and educational institutions, for facilities contracts, and for research and development or production contracts with for-profit contracts when they expect to derive some commercial benefit from the contracts. These contracts provide little incentive to the institution or contractor to control costs. d. Cost-sharing contracts are cost-reimbursement contracts in which the contractor receives no fee and is reimbursed only for an agreed- upon portion of its allowable costs. e. Labor-hour contracts are a variation of the time-and-materials contract, differing only in that materials are not supplied by the contractor. f. Time-and-materials contracts provide for acquiring supplies or services on the basis of (a) direct labor hours at specified fixed hourly rates that include wages, overhead, general and administrative expenses, and profit, and (b) actual cost for materials. g. Other is a designation for any other contract types that are not separately listed in the NASA annual procurement report. It is not a federal acquisition regulation-recognized contract type. h. Combination is not a separate contract type; it notes that a particular contract consists of more than one contract type, e.g., a cost-plus-award-fee contract and a cost-incentive-fee contract. 6. Grant is an award of financial assistance, including cooperative agreements, in the form of money or property in lieu of money, by the federal government to an eligible grantee. The term does not include technical assistance which provides services instead of money, or other assistance in the form of revenue sharing, loans, loan grantees, interest subsidies, insurance, or direct appropriations. Also, the term does not include assistance, such as a fellowship or other lump sum award, which the grantee is not required to account for. In addition to the contact named above, Carla Lewis, Assistant Director; Francine DelVecchio; Lisa M. Galvan-Trevino; Estela Guerrero; James Maziasz; Christina Quattrociocchi; Heather Rasmussen; Donell Ries; Chris Rodriguez; and Viny Talwar made key contributions to this report.

Summary: Agencies are required to report improper payment information under the Improper Payments Information Act of 2002 (IPIA) and recovery auditing information under section 831 of the National Defense Authorization Act for Fiscal Year 2002, commonly known as the Recovery Auditing Act. Since the first year of implementation, fiscal year 2004, limited improper payments reporting by the United States Agency for International Development (USAID) and the National Aeronautics and Space Administration (NASA) and concerns raised by NASA's auditors about its risk assessment process prompted scrutiny from the Senate Subcommittee on Federal Financial Management, Government Information, Federal Services, and International Security, during several oversight hearings. Because the subcommittee noted that USAID's and NASA's performance and accountability report (PAR) reporting on improper payments and recovery auditing was minimal, GAO was asked to review both agencies' IPIA risk assessment methodologies, recovery auditing procedures, and actions under way to improve their IPIA and recovery audit reporting. For the first 3 years of IPIA implementation, fiscal years 2004 through 2006, USAID and NASA performed various procedures to conduct their risk assessments. Many of these procedures are positive steps to address the requirements of IPIA. At the same time, GAO identified numerous deficiencies in the procedures that warrant further improvement. For example, neither USAID nor NASA had developed a systematic process to (1) identify risks that exist in their payment activities or (2) evaluate the results of their payment stream reviews, such as weighting and scoring the effectiveness of existing internal control over payments made and results from external audits. Furthermore, risk assessment documentation maintained by USAID and NASA was lacking or insufficient to support their conclusions that no programs or activities were susceptible to significant improper payments. A lack of detailed written guidance for both agencies may have contributed to the deficiencies identified. Due to inadequacies in their risk assessment process, USAID and NASA cannot be certain that they had no programs or activities susceptible to significant improper payments, and ultimately, had effectively implemented IPIA. Although USAID and NASA have reported on steps taken to recoup improper contract payments, GAO found several weaknesses in their recovery auditing procedures for fiscal years 2004 through 2006. In particular, USAID and NASA did not report recovery auditing information for each fiscal year, documentation was lacking or not adequately supported, and neither agency adhered to all of the reporting requirements outlined in Office of Management and Budget's (OMB's) implementing guidance. Other weaknesses noted were agency-specific. For example, USAID recovery auditing procedures were comprised of reviews of certain Office of Inspector General and external audit reports over USAID grant and contract programs. However, the methodology used for conducting those audits may not have constituted a recovery auditing program as defined by OMB guidance, and thus may be insufficient for this purpose. NASA, on the other hand, used IPIA contract payment review results to report amounts recovered for fiscal year 2005. However, the payment reviews were limited in scope and did not provide an adequate representation of the extent of contract overpayments. Due to a lack of, or insufficient, documentation, along with identified weaknesses, the validity and accuracy of the reported recovery amounts are questionable. While USAID and NASA have experienced significant challenges in their first 3 years of IPIA implementation, both agencies have taken steps to strengthen their risk assessment process and, ultimately, IPIA reporting. For example, USAID has developed an agencywide payment database that will be used to research and data mine for potential improper payments. NASA hired two different contractors to develop a methodology for conducting a risk assessment and testing of payment transactions. Actions are also under way to improve recovery auditing efforts. However, improvements are still needed to address some of the weaknesses identified related to conducting risk assessments and performing recovery auditing procedures.