I would now like to focus on agencies’ efforts to address select IPIA reporting requirements during the first 3 years of IPIA implementation, fiscal years 2004 through 2006. Generally, agencies must perform four key steps to address the improper payments reporting requirements— (1) perform a risk assessment, (2) estimate improper payments for risk- susceptible programs and activities, (3) implement a plan to reduce improper payments for programs with estimates exceeding $10 million, and (4) annually report improper payment estimates and actions to reduce them. OMB requires the results of these steps to be reported in the agencies’ PARs, in the Management Discussion and Analysis section and as a separate appendix, for each fiscal year ending on or after September 30, 2004. Today, I will touch on progress made and challenges that remain in these areas. Our past and current reviews of agencies’ reported risk assessments have raised questions regarding their adequacy. For fiscal years 2004 through 2006, we found that some agencies still had not instituted systematic methods of reviewing all programs and activities or had not identified all programs susceptible to significant improper payments. We also reported that certain agencies’ risk assessments appear questionable. Conducting a risk assessment is an essential part of agencies’ efforts to comply with IPIA. Risk assessment is a key step in helping to gain a reasonable level of assurance that programs are operating as intended and that they are achieving their expected outcomes. Done properly, it entails a comprehensive review and analysis of program operations to determine if risks exist, what those risks are, and the potential or actual effect of those risks on program operations. The information developed during a risk assessment forms the foundation or basis upon which management can determine the nature and type of corrective actions needed. It also gives management baseline information for measuring progress in reducing improper payments. For the first year of reporting under IPIA, we reported in March 2005, that of the 29 agencies reviewed, 23 had completed risk assessments for all programs and activities for fiscal year 2004. However, for 3 of these, agencies’ auditors raised noncompliance issues with the risk assessments. For example, agency auditors for the Department of Justice (DOJ) and the National Aeronautics and Space Administration (NASA) reported that the risk assessments did not consider all payment types or programs. The auditor for the Department of Homeland Security (DHS) reported that the agency did not institute a systematic method of reviewing all programs and identifying those it believed were susceptible to significant erroneous payments. Regarding the second year of IPIA reporting, we reported in November 2006, that the same number of agencies, 23, had performed risk assessments of all of their programs and activities based on our review of 35 agency PARs or annual reports for fiscal year 2005. Similar to the first year of IPIA reporting, we noted that auditors for DOJ and DHS again raised noncompliance issues regarding the adequacy of the agencies’ risk assessments. We noted other risk assessment deficiencies as well. For example, the Department of Agriculture (USDA) OIG reported that the agency’s risk assessments were not adequate to estimate the agency’s susceptibility to improper payments because the guidance from the USDA’s Office of the Chief Financial Officer (OCFO) was not sufficiently prescriptive and detailed to translate into meaningful results. As such, the OIG recommended that the USDA OCFO strengthen guidance over its IPIA risk assessments to provide reasonable assurance that the requirements of the act are met. Further, the OIG stated that USDA should identify risk factors that are discrete to the program being assessed and consider information from all sources, such as audit reports. For fiscal year 2006, the third year of IPIA reporting, we found that 30 of the 36 agencies had reported performing some type of assessment to identify programs and activities susceptible to significant improper payments. The remaining 6 agencies either did not report improper payments information in their PARs or annual reports, or did not report assessing for risk of improper payments for all of their programs and activities. Of the 30, 18 agencies reported reviewing all programs and activities as part of the risk assessment process, while the remaining 12 agencies provided enough details that indicated some level of review was performed. For example, 1 agency reported that it had evaluated its major programs based on its developed risk criteria. Although the major programs made up a significant portion of the agency’s outlays, the agency did not report that it had assessed the remaining programs and activities. We also found instances where an agency’s description of the risk assessment performed contradicted its assertion that all programs and activities had been reviewed. For example, 1 agency reported in its PAR that it had assessed all programs and activities, but also reported in the same PAR that assessments for two activities had not been conducted. Another agency reported that it had assessed all of its payment programs, but later stated in its PAR that its risk assessment only covered certain types of programs. Similar to the previous years, agency auditors continued to find inadequacies in agencies’ risk assessments for fiscal year 2006. The DHS auditor reported that the agency did not perform a risk assessment for all programs and activities. Further, the NASA auditor reported that the agency had potentially violated certain requirements of IPIA as NASA had been unable to provide the auditor with sufficient documentation to support performance of an annual review of all programs and activities that the agency administers. Other agencies reported improving and refining their risk assessment methodologies for fiscal year 2006. For example, USDA’s Farm Service Agency reported that it made improvements to its risk assessments and as a result, four additional programs were determined to be susceptible to significant improper payments. Two other agencies reported redefining their programs to conduct their risk assessments. DOJ reported that it addressed its noncompliance with IPIA by performing risk assessments in its U.S. Marshals Service component. Other agencies identified plans for improving future risk assessments. For example, the Office of Personnel Management (OPM) reported that it will assess in fiscal year 2007 whether any agency payment streams, other than its former OMB Circular No. A-11 programs, are susceptible to significant improper payments. The Department of Defense reported that it is developing a program to review its intergovernmental payments and payments for afloat and deployed forces. NASA reported that it plans to perform a risk assessment of the agency’s commercial and noncommercial disbursement activities. Finally, we noted that the number of agencies conducting risk assessments may decrease in future reporting, because OMB’s revised IPIA implementing guidance allows agencies to perform risk assessments every 3 years for those agency programs not deemed susceptible to significant improper payments. Prior to issuing its revised implementing guidance, OMB discussed the proposed changes with us. We advised OMB that the provision to perform risk assessments every 3 years for those programs not deemed risk-susceptible was inconsistent with the IPIA requirement for agencies to review all programs and activities annually. In its fiscal year 2006 PAR, the General Services Administration (GSA) reported that because it does not have any programs or activities susceptible to significant improper payments, GSA will perform the next risk assessment in fiscal year 2008. Additionally, several programs included in OMB’s former Circular No. A-11, reported that OMB had granted them a waiver from improper payments reporting because they did not have programs susceptible to significant improper payments. These programs included the Environmental Protection Agency’s Clean and Drinking Water State Revolving Funds, the National Science Foundation’s Research and Education Grants and Cooperative Agreements, and the Department of Veterans Affairs (VA) Insurance programs. OMB’s previous implementing guidance required agencies to annually estimate improper payments for their programs that were included in former Circular No. A-11, regardless of amount. Since fiscal year 2004, agencies have made progress in reporting improper payment information. For example, the number of programs reporting improper payment estimates for fiscal year 2004 totaled 41, as compared to 60 programs reporting for fiscal year 2006, a net increase of 19 programs. The total improper payments dollar estimate was $45 billion in fiscal year 2004, $38 billion in fiscal year 2005, and about $42 billion in fiscal year 2006. (See app. II for further details.) We have previously testified before this subcommittee regarding the decrease in the total improper payment estimate from $45 billion in fiscal year 2004 to $38 billion in fiscal year 2005. Specifically, we reported that the $7 billion decrease was primarily attributable to a decrease in the Medicare estimate that resulted from increased efforts to educate health care providers on the importance of responding to requests for medical records to perform detailed statistical reviews. Also, the Department of Health and Human Services (HHS) extended the time that providers have for responding to documentation requests from 55 days to 90 days. We further reported that these changes primarily affected HHS’s processes related to its efforts to perform detailed statistical reviews for the purposes of calculating an annual improper payment estimate for the Medicare program. While this represents a refinement, it may not reflect improved accountability over program dollars given that GAO continues to designate the Medicare program as a high-risk area. Specifically, in our January 2007 report, we reported that further action must be taken to refine Medicare’s payment methods and collection of data used as a basis for setting payment rates and address program integrity weaknesses, among others. Also, HHS’s OIG continued to report the integrity of Medicare payments as a top management challenge for fiscal year 2006. For fiscal year 2006, the total improper payment estimate increased to about $42 billion from the reported $38 billion for fiscal year 2005. The increase in improper payments was primarily attributable to 15 newly reported programs or activities totaling about $2.4 billion, and a $1.6 billion increase in USDA’s Marketing Assistance Loan program due to improvements in how it measured its improper payments. In addition, several programs experienced increases in their improper payment estimates as a result of lax upfront eligibility controls to facilitate rapid benefit delivery to victims devastated by Hurricane Katrina. According to OMB, the programs most directly affected included the Federal Emergency Management Agency’s Individuals and Households program (IHP), Department of Labor’s (Labor) Disaster Unemployment Insurance (UI) program, and the Small Business Administration’s Disaster Assistance Loan program. For example, Labor identified more than $100 million in improper payments related to Hurricane Katrina for the Disaster UI program. To respond to the challenges of the Gulf Coast hurricanes, on August 29, 2006, the President signed Executive Order 13411, Improving Assistance for Disaster Victims, which established a task force on disaster coordination responsible for recommending specific actions to improve the delivery of federal disaster assistance while strengthening controls designed to prevent improper payments and other forms of fraud, waste, and abuse. Mr. Chairman, I commend agencies’ efforts to decrease improper payment error rates. For example, from our review of agency programs initially reporting error rates in the first year of IPIA implementation, fiscal year 2004, we noted that of the 32 agency programs with changes in their error rates, 18 program error rates, or 56 percent, had declined when compared to fiscal year 2006. However, it should be noted that in this still-early stage of IPIA implementation, a decrease in the reported error rate may not signal improved accountability just as an increase may not necessarily indicate a greater number of control weaknesses. In some cases, these fluctuations may be attributed to changes in the estimating methodology used. For example, USDA’s Marketing Assistance Loan program did not report an estimate in fiscal year 2004 and reported a small estimate for fiscal year 2005. However, with improvements in how it measures improper payments, this program estimated an error rate of 20.3 percent for fiscal year 2006. The Marketing Assistance Loan program is now in a greatly improved position to identify the root causes of these errors and ultimately improve the integrity of its payments—the primary goal of IPIA reporting. Table 1 highlights improper payment error rates for the 8 major programs that accounted for 86 percent of the $42 billion total improper payment estimate for fiscal year 2006. Although they are not specifically required to do so by the act, some agency auditors have reported on noncompliance issues related to implementation of IPIA since the first year of IPIA reporting. For example, for fiscal years 2004 and 2005, we reported that agency auditors had identified instances of noncompliance, such as the lack of a systematic method for reviewing all programs and risk assessments that did not consider all payment types or programs. For fiscal year 2006, agency auditors reported instances of noncompliance such as an agency still being in its early stages of IPIA implementation or not yet having reported for all risk-susceptible programs. We found that the level of noncompliance and types of issues raised varied over the first 3 years of IPIA reporting. From our review of the agency auditors’ description of the noncompliance, we classified the findings into three categories—full noncompliance, partial noncompliance, and potential noncompliance. We noted that agency auditors reported problems related to agencies’ risk assessments, the definition of programs for IPIA purposes, sampling methodologies, lack of reporting for all risk- susceptible programs, and supporting documentation, as shown in table 2. Fully addressing these matters should lead to improved reporting under IPIA. Although IPIA does not include a separate reporting requirement for auditors to assess agencies’ compliance, we noted that those that included this assessment provided a valuable independent validation of agencies’ efforts to implement the act. From our analysis, we noted that four agencies had reported noncompliance issues for at least 2 of the 3 IPIA reporting years. For example, agency auditors for DHS have reported noncompliance issues for the first 3 years of IPIA reporting. As mentioned earlier in this testimony, the first 2 years of noncompliance were primarily caused by inadequate risk assessments. For fiscal year 2006, DHS auditors reported that the agency had not fully complied with IPIA due to several inadequacies related to sampling methodologies, trained staff, and monitoring of results to ensure testing was completed for all required programs. DHS auditors recommended that the agency follow OMB guidance for fiscal year 2007, including completing the necessary susceptibility assessments, testing for all material programs, and instituting sampling techniques to allow for statistical projection of improper payments testing results. While showing progress, agencies’ fiscal year 2006 reporting under IPIA does not yet reflect the full scope of improper payments across executive branch agencies. Major challenges remain in meeting the goals of the act and ultimately improving the integrity of payments. Specifically, some agencies have not yet reported for all risk-susceptible programs, and certain methodologies used to estimate improper payments do not result in reliable estimates. Also, we noted that management challenges related to agencies’ internal control weaknesses continue to plague programs susceptible to significant improper payments. The fiscal year 2006 total improper payment estimate of about $42 billion did not include any amounts for 13 risk-susceptible programs having fiscal year 2006 outlays totaling about $329 billion. The Medicaid program represents the largest program that has not yet reported, with reported outlays of about $183 billion. OMB had specifically required 9 of these programs, including the Medicaid program to report selected improper payment information for several years before IPIA reporting requirements became effective. After passage of IPIA, OMB’s implementing guidance required that these programs continue to report improper payment information under IPIA. See table 3 for more detailed information. Of these 13 programs, 11 reported that they would be able to estimate and report on improper payments in the next 2 fiscal years, but could not do so for fiscal year 2006. The remaining 2 programs were silent about when they would report estimates in the future. As a result, improper payment reporting of these programs susceptible to risk remain unknown. OMB reported that some of the agencies were unable to determine the rate or amount of improper payments because of measurement challenges or time and resource constraints, which OMB expects to be resolved in future reporting years. For example, since fiscal year 2002, HHS has conducted pilots at the state level to further its progress toward reporting a national improper payments estimate for its Medicaid program. Each state is responsible for designing and overseeing its own Medicaid program within the federal government structure. This type of program structure presents challenges for implementing a methodology to estimate improper payments as HHS must work with states to obtain applicable documentation used in the calculation. An additional challenge that HHS and other agencies with state-administered programs say they face is the ability to hold states accountable for meeting targets to reduce and recover improper payments in the absence of specific statutory authority. In April 2006, we reported on the need for federal and state coordination to report national improper payment estimates on federal programs as state-administered programs and other nonfederal entities receive over $400 billion annually in federal funds. Thus, federal agencies and states share a responsibility for the prudent use of these funds. We have previously noted that agencies employed different sampling methodologies to estimate improper payments, including statistical sampling, nonstatistical sampling, or a combination of the two. OMB’s implementing guidance requires that agencies generally use a statistical sample to estimate improper payments. Agencies may also use an alternative sampling approach provided they obtain OMB approval prior to implementation. The advantage of using statistical sampling is that sample results can be generalized to the entire population from which the sample was taken. Based on our review of fiscal year 2006 reporting, we found seven agencies that did not use statistical sampling to estimate improper payments for nine programs totaling about $202 million, with program outlays exceeding $88 billion. Given that total outlays for these nine risk- susceptible programs exceeded $88 billion for fiscal year 2006, the improper payment estimate for these programs would likely have been much greater had statistically valid methods been used. For example, Labor analyzed fiscal year 2004 audits done under the Single Audit Act, as amended, to identify questioned costs for its Workforce Investment Act program, which, in turn, were used as a proxy for reporting its improper payment estimate. Specifically, the improper payment rate was determined by calculating the projected questioned costs and dividing this total amount by the corresponding outlays. Using this methodology, Labor reported a $6.4 million improper payment estimate for fiscal year 2006. We do not believe this is a reasonable proxy for improper payment levels because single audits, by themselves, may lack the level of detail necessary for achieving IPIA compliance. Specifically, single audits generally focus on the largest dollars in an auditee’s portfolio. Thus, all programs identified as susceptible to improper payments at the federal level may not receive extensive coverage under a single audit. Consequently, both the depth and level of detail of single audit results are, generally, insufficient to identify improper payments, estimate improper payments, or both. We noted that Labor’s OIG reported the use of single audits as a major management challenge because serious deficiencies in single audits, including inadequate sampling methodologies have been reported, thus making them unreliable for purposes of estimating improper payments. We also found that five agencies used a combination of statistical and nonstatistical sampling methods to estimate improper payments totaling about $11.6 billion for ten programs. For example, VA reported that improper payment estimates for its Compensation and Pension programs are based on statistical sampling of its quality assurance program together with actual amounts of debt incurred that are referred to the VA Debt Management Center. In another example, the Railroad Retirement Board (RRB) reported that improper payment estimates for its Retirement and Survivors Benefits program and Railroad Unemployment Insurance Benefits program were based on a statistical sample of railroad retirement awards and unemployment and sickness insurance claims as well as special studies and audits that were not entirely statistically based. In its fiscal year 2006 PAR, RRB reported that in May 2005, its general counsel issued a legal opinion that since the levels of improper payments did not exceed OMB’s designated thresholds—exceeding $10 million and 2.5 percent of program payments—the agency was not required to conduct statistical sampling. We noted that both of these programs were required to report improper payment information for several years before IPIA reporting requirements became effective. After passage of IPIA, OMB’s implementing guidance required that these programs continue to report improper payment information under IPIA, including using statistical sampling to estimate improper payments. In addition, we noted instances where agencies estimated improper payments for only one component of the risk-susceptible program. For example, HHS’s Medicare program is the largest of the programs constituting the total improper payment estimate, with an estimate of $10.8 billion for fiscal year 2006. However, this estimate represents payment errors only for its fee-for-service program component. HHS has not yet begun to estimate improper payments for its managed care component (also known as Medicare Advantage), with outlays totaling about $55 billion, or 14 percent of Medicare program outlays. HHS’s auditor, an independent public accounting firm that audited its financial statements for fiscal year 2006, identified Medicare’s managed care benefits payment cycle as a reportable condition in its report on internal controls. The auditor found that HHS lacks a comprehensive control environment in which the risk of inaccurate payments is not sufficiently mitigated. Specifically, HHS had inadequate procedures to review and process managed care payments, lacked documentation and procedures to determine eligibility of new providers, and provided inadequate oversight of managed care organizations. In its fiscal year 2006 PAR, HHS reported that a methodology to estimate improper payments for the Medicare Advantage program was in the initial stage of development. During fiscal year 2007, HHS plans to perform a comprehensive risk assessment for the Medicare Advantage program to determine potential areas vulnerable to payment errors. HHS anticipates reporting on the measurement project and select findings in its fiscal year 2008 PAR. However, HHS has not yet provided a target date for reporting an improper payment estimate for its Medicare Advantage program. Agency OIGs reported management challenges in the annual PARs related to agencies’ internal control weaknesses that continue to plague programs susceptible to significant improper payments. In accordance with OMB Circular No. A-136, OIGs are required to highlight issues that the OIGs consider to be the most serious management and performance challenges facing agencies. Management challenges involving internal control have a direct effect on program integrity and improper payment issues, and thus a review of the OIGs’ statements on management challenges can be instructive in this regard. Generally, improper payments result from a lack of or an inadequate system of internal control, but some result from program design issues. Internal control is a major part of managing an organization. It comprises the plans, methods, and procedures used to meet missions, goals, and objectives and supports performance-based management. Internal control also serves as the first line of defense in safeguarding assets and preventing and detecting errors and fraud. Our Standards for Internal Control in the Federal Government provide a road map for entities to establish control for all aspects of their operations and a basis against which entities’ control structures can be evaluated. Also, our executive guide on strategies to manage improper payments focuses on internal control standards as they relate to reducing improper payments. We found that over half of the programs reporting improper payment estimates also had reported management challenges that could increase the risk of improper payments, including challenges related to internal controls. For example, in the Department of Education’s (Education) fiscal year 2006 PAR, the Education OIG reported that recent audits, inspections, and investigations continue to uncover problems with program control and oversight of program participants, placing billions of taxpayer dollars at risk of waste, fraud, abuse, and noncompliance. The OIG concluded that only by improving effective oversight of its operations and demanding accountability by its managers, staff, contractors, and grantees can the agency be an effective steward of the billions of taxpayer dollars supporting its programs and operations. Education’s OIG also reported that identifying and correcting improper payments remains a challenge for the agency due to ineffective oversight and monitoring of its policies, programs, and participants. Another example involved an agency’s systems used to detect fraudulent activity. Specifically, Treasury’s OIG reported that some tax credits, such as the Earned Income Tax Credit, provide opportunities for abuse in income tax claims. In past years, the Internal Revenue Service (IRS) used its Web-based Electronic Fraud Detection System (EFDS) to search for signs of fraud at the time that tax returns are filed to help eliminate the issuing of questionable refunds. For its 2005 processing year, IRS stopped over $412 million in improper payments. However, IRS was unable to utilize EFDS for the 2006 processing year because the contractor it had hired to update the fraud detection program could not produce a working program within the established timeframe. Because IRS believed that the contractor would deliver the updated program, it had not developed a contingency plan nor taken any action to return to the old system. As a result, the Treasury OIG reported that more than $300 million in fraudulent refunds may have been issued in 2006. We identified this issue as a material weakness during our audit of IRS’s fiscal years 2005 and 2006 financial statements. Section 831 of the National Defense Authorization Act for Fiscal Year 2002 provides an impetus for applicable agencies to systematically identify and recover contract overpayments. The act requires that agencies that enter into contracts with a total value in excess of $500 million in a fiscal year carry out a cost-effective program for identifying and recovering amounts erroneously paid to contractors. The law authorizes federal agencies to retain recovered funds to cover in-house administrative costs as well as to pay contractors, such as collection agencies. Any residual recoveries, net of these program costs, shall be credited back to the original appropriation from which the improper payment was made, subject to restrictions as described in the legislation. Recovery auditing is a method that agencies can use to recoup detected improper payments. Recovery auditing is a detective control to help determine whether contractor costs were proper. Specifically, it focuses on the identification of erroneous invoices, discounts offered but not received, improper late penalty payments, incorrect shipping costs, and multiple payments for single invoices. Recovery auditing can be conducted in-house or contracted out to recovery audit firms. The techniques used in recovery auditing offer the opportunity for identifying weaknesses in agency internal controls, which can be modified or upgraded to be more effective in preventing improper payments before they occur for subsequent contract outlays. I would like to emphasize that effective internal control calls for a sound, ongoing invoice review and approval process as the first line of defense in preventing unallowable contract costs. Given the large volume and complexity of federal payments and historically low recovery rates for certain programs, it is much more efficient and effective to pay bills and provide benefits properly in the first place. Prevention is always preferred to detection and collection. Aside from minimizing overpayments, preventing improper payments increases public confidence in the administration of benefit programs and avoids the difficulties associated with the “pay and chase” aspects of recovering improper payments. Without strong preventive controls, agencies’ internal control activities over payments to contractors will not be effective in reducing the risk of improper payments. Beginning with fiscal year 2004, OMB required that applicable agencies publicly report on their recovery auditing efforts as part of their PAR reporting of improper payment information. Agencies are required to discuss any contract types excluded from review and justification for doing so. Agencies are also required to report, in table format, various amounts related to contracts subject to review and actually reviewed, contract amounts identified for recovery and actually recovered, and prior year amounts. From fiscal year 2004 to 2006, we noted that the number of agencies reporting recovery auditing information and the dollar amounts identified for recovery and actually recovered had increased, as shown in table 4. We are pleased that progress has been made over the past 3 fiscal years to identify amounts for recovery and those amounts actually recovered. We also noted that the rate of recovery of contract overpayments for fiscal year 2006, about 30 percent, had substantially decreased from the prior year reported recovery rate of 84 percent. In our November 2006 report, we raised questions regarding the overall high recovery rate of 84 percent and found discrepancies, such as the contract costs identified for recovery were considerably lower than the corresponding OIG amount identified from that year’s audit reviews. We determined that the discrepancies significantly decreased the overall recovery rate from 84 percent to 22 percent. Although we have not performed a detailed review of the agencies’ recovery rates for fiscal year 2006, the reported overall recovery rate of 30 percent may provide a more realistic view of agencies’ recovery audit efforts. From our review, we noted that 12 agencies reported recovering about $53 million for fiscal year 2004 compared to 18 agencies that reported recovering about $256 million for fiscal year 2006. In addition to the 18 agencies, we found that 3 agencies—Education, the Department of Housing and Urban Development (HUD), and Labor—did not report recovery auditing information for fiscal year 2006. Education reported that it reviewed all of its vendor payments from fiscal years 1998 to 2005 and found that potential recoveries were minimal. During fiscal year 2007, Education plans to review fiscal year 2006 contract payments. Education also noted that its purchase card and travel card programs are subject to monthly reviews and reconciliations to identify potential misuse or abuse. HUD and Labor reported that based on their recovery audit results, a recovery auditing program was not cost-beneficial or necessary, similar to what they reported for fiscal year 2005. Specifically, in fiscal year 2006, HUD reported that its recovery audit contractor had determined that procedures and systems in place provide strong controls for processing contract payments. Labor reported that from its statistical sample of 50 transactions, no improper payments were found, and therefore recovery audit efforts were not necessary. In addition, we noted that of the 18 agencies reporting for fiscal year 2006, 3 agencies had conducted in-house recovery audits, 8 agencies reported they contracted out their recovery audit services, another 6 agencies reported using both in-house and recovery audit contractors to perform recovery auditing, and the remaining 1 agency was silent. In closing, we recognize that measuring improper payments and designing and implementing actions to reduce them are not simple tasks and will not be easily accomplished. Further, while internal control should be maintained as the front-line defense against improper payments, recovery auditing holds promise as a cost-effective means of identifying contractor overpayments. Given today’s budgetary pressures and the American public’s increasing demands for accountability over taxpayer funds, oversight hearings such as this one today and the continuing leadership of OMB under the PMA, help keep agencies focused on the goals of IPIA and being accountable for results. Preventing, identifying, and recovering improper payments in that order are what is needed across government. Fulfilling the requirements of IPIA will require sustained attention to implementation and oversight to monitor whether desired results are being achieved. Mr. Chairman, this concludes my statement. I would be pleased to respond to any questions that you or other members of the subcommittee may have. For more information regarding this testimony, please contact McCoy Williams, Director, Financial Management and Assurance, at (202) 512-9095 or by e-mail at williamsm1@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony. Individuals making key contributions to this testimony included Carla Lewis, Assistant Director; Francine DelVecchio; Christina Quattrociocchi; Heather Rasmussen; Donell Ries; and Viny Talwar. millions) (percent) millions) (percent) Cooperative Agreements, Grants, and Contracts Child and Adult Care Food Program Farm Security and Rural Investment Program (previously Commodity Loan Programs) 12 Milk Income Loss Contract 13 National School Lunch and School Breakfast Programs (previously School Programs)17 Women, Infants, and Children 18 All programs and activities4 Department of Defense 19 Civilian Pay 0.1 millions) (percent) millions) (percent) 5 Department of Education 25 Student Financial Assistance— 29 Clean Water State Revolving 30 Drinking Water State Revolving 31 All programs and activities 32 All programs and activities 33 High Cost Support Program34 Universal Service Fund’s 35 All programs and activities 36 All programs and activities 37 All programs and activities38 Child Care and Development 45 State Children’s Insurance Programmillions) (percent) millions) (percent) Block Grant (Entitlement Grants, States/Small Cities) Administration’s Single Family Acquired Asset Management System 51 Low Income Public Housing 52 Public Housing Capital Fund 55 All programs and activities56 All programs and activities60 All programs and activities61 All programs and activities 62 All programs and activities 64 All programs and activities 65 All programs and activities0.0 millions) (percent) millions) (percent) 66 Federal Employees Group Life 68 Retirement Program (Civil Service Retirement System and Federal Employees Retirement System) 69 All programs and activities 70 All programs and activities 73 All programs and activities75 7(a) Business Loan Program 78 All programs and activities 79 Old Age and Survivors’ International Information Program—U.S. Speaker and Specialist Program International Narcotic and Law Enforcement Affairs— Narcotics Program 0.1 millions) (percent) millions) (percent) 91 Earned Income Tax Credit $41,643.3 This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The federal government is accountable for how its agencies and grantees spend hundreds of billions of taxpayer dollars and is responsible for safeguarding those funds against improper payments as well as for recouping those funds when improper payments occur. The Congress enacted the Improper Payments Information Act of 2002 (IPIA) and the Recovery Auditing Act to address these issues. Fiscal year 2006 marked the 3rd year that agencies were required to report improper payment and recovery audit information in their Performance and Accountability Reports. GAO was asked to testify on the progress agencies have made in these areas. Specifically, GAO focused on (1) trends in agencies' reporting under IPIA from fiscal years 2004 through 2006, (2) challenges in reporting improper payment information and improving internal control, and (3) agencies' reporting of recovery auditing efforts. This testimony is based on GAO's previous reports on agencies' efforts to implement IPIA requirements for fiscal years 2005 and 2004 and current review of available fiscal year 2006 improper payment and recovery auditing information. The Office of Management and Budget (OMB) provided technical comments that were incorporated as appropriate. GAO identified several key trends related to IPIA reporting requirements. (1) Risk assessments: For fiscal years 2004 through 2006, some agencies still had not instituted systematic methods of reviewing all programs and activities or had not identified all programs susceptible to significant improper payments. Further, certain agencies' risk assessments appeared questionable. GAO also noted that OMB's recently revised IPIA implementing guidance, which allows certain agencies to perform risk assessments every 3 years instead of annually, may result in fewer agencies conducting risk assessments in the future. (2) Improper payment estimates: Since fiscal year 2004, agencies have made some progress in reporting improper payment information. The number of programs reporting improper payment estimates for fiscal year 2004 totaled 41, compared to 60 programs for fiscal year 2006. The total improper payments dollar estimate was $45 billion in fiscal year 2004, $38 billion in fiscal year 2005, and about $42 billion in fiscal year 2006. (3) Noncompliance issues: Although not currently required by IPIA to do so, some agency auditors continued to report problems related to agencies' risk assessments, definition of programs for IPIA purposes, sampling methodologies, lack of reporting for all risk-susceptible programs, and supporting documentation. Although showing progress under OMB's continuing leadership, agencies' fiscal year 2006 reporting under IPIA does not yet reflect the full scope of improper payments. Major challenges remain in meeting the goals of the act and ultimately improving the integrity of payments. First, some agencies have not yet reported for all risk-susceptible programs. For example, the fiscal year 2006 total improper payment estimate of about $42 billion did not include any amounts for 13 risk-susceptible programs that had fiscal year 2006 outlays totaling about $329 billion. Second, certain methodologies used to estimate improper payments did not result in accurate estimates. Finally, GAO noted that internal control weaknesses continued to plague programs susceptible to significant improper payments. From fiscal years 2004 through 2006, the number of agencies reporting recovery auditing information for contract overpayments and the dollar amounts identified for recovery and actually recovered increased. For fiscal year 2004, 12 agencies reported recovering about $53 million, compared to 18 agencies that reported recovering about $256 million for fiscal year 2006. Given the large volume and complexity of federal contract payments and historically low recovery rates for certain programs, GAO emphasized that it is much more efficient to pay bills properly in the first place. Effective internal control calls for a sound, ongoing invoice review and approval process as the first line of defense in preventing erroneous payments.