In November 2002, Congress passed and the President signed the Improper Payments Information Act of 2002 (IPIA), which was later amended by IPERA and the Improper Payments Elimination and Recovery Improvement Act of 2012 (IPERIA). The amended legislation requires executive branch agencies to (1) review all programs and activities and identify those that may be susceptible to significant improper payments (commonly referred to as a risk assessment), (2) publish improper payment estimates for those programs and activities that the agency identified as being susceptible to significant improper payments, (3) implement corrective actions to reduce improper payments and set reduction targets, and (4) report on the results of addressing the foregoing requirements. In addition to the agencies’ identifying programs and activities that are susceptible to significant improper payments, OMB designates as high priority the programs with the most egregious cases of improper payments. Specifically, under a provision added to IPIA by IPERIA, OMB is required to annually identify a list of high-priority federal programs in need of greater oversight and review. In general, for fiscal years 2014 through 2017, OMB implemented this requirement by designating high- priority programs based on a threshold of $750 million in estimated improper payments for a given fiscal year. OMB also plays a key role in implementing laws related to improper payment reporting. Specifically, OMB is directed by statute to provide guidance to federal agencies on estimating, reporting, reducing, and recovering improper payments. IPERA also requires executive agencies’ IGs to annually determine and report on whether their respective agencies complied with certain IPERA- related criteria. If an agency does not meet one or more of the six IPERA criteria for any of its programs or activities, the agency is considered noncompliant overall. The six criteria are as follows: 1. publish a report in the form and content required by OMB—typically an agency financial report (AFR) or a performance and accountability report (PAR)—for the most recent fiscal year, and post that report on the agency website; 2. conduct a program-specific risk assessment, if required, for each program or activity that conforms with IPIA as amended; 3. publish improper payment estimates for all programs and activities deemed susceptible to significant improper payments under the agency’s risk assessments; 4. publish corrective action plans for those programs and activities assessed to be at risk for significant improper payments; 5. publish and meet annual reduction targets for all programs and activities assessed to be at risk for significant improper payments; and 6. report a gross improper payment rate of less than 10 percent for each program and activity for which an improper payment estimate was published. Under IPERA, agencies reported by their IG as not in compliance with any of these criteria in a fiscal year are required to submit a plan to Congress describing the actions they will take to come into compliance, and such plans shall include measureable milestones, the designation of senior accountable officials, and the establishment of accountability mechanisms to achieve compliance. OMB guidance states that agencies are required to submit these plans to Congress and OMB in the first year of reported noncompliance. When agency programs are reported as noncompliant for consecutive years, IPERA and OMB guidance requires agencies and OMB to take additional actions. Specifically, an agency with a program reported as noncompliant for 3 or more consecutive years is required to submit to Congress within 30 days of the IG’s report either (1) a reauthorization proposal for the program or (2) the proposed statutory changes necessary to bring the program or activity into compliance. We previously recommended that when agencies determine that reauthorization or statutory changes are not necessary to bring the programs into compliance, the agencies should state so in their notifications to Congress. Effective starting with fiscal year 2018 reporting, OMB updated its guidance to instruct agencies with programs reported as noncompliant for 3 consecutive years to explain what the agency is doing to achieve compliance if a reauthorization proposal or proposed statutory change will not bring a program into compliance with IPERA. The updated guidance also instructs agencies with programs reported as noncompliant for 4 or more consecutive years to submit a report to Congress and OMB (within 30 days of the IG’s determination of noncompliance) detailing the activities taken and still being pursued to prevent and reduce improper payments. If agency programs are reported as noncompliant under IPERA for 2 consecutive years, and the Director of OMB determines that additional funding would help the agency come into compliance, the head of the agency must obligate additional funding in the amount determined by the Director to intensify compliance efforts. IPERA directs the agency to exercise any reprogramming or transfer authority that the agency may have to provide additional funding to meet the level determined by OMB and, if necessary, submit a request to Congress for additional reprogramming or transfer authority to meet the full level of funding determined by OMB. Table 1 summarizes agency and OMB requirements related to agency programs that are noncompliant under IPERA, as reported by their IGs. Seven years after the initial implementation of IPERA, over half of the 24 CFO Act agencies were reported as noncompliant by their IGs for fiscal years 2016 and 2017. Specifically, 13 agencies were reported as noncompliant with one or more IPERA criteria for fiscal year 2016, and 14 agencies were reported as noncompliant for fiscal year 2017 (see fig. 1). Nine of these agencies have been reported as noncompliant in one or more programs every year since IPERA was implemented in 2011 (see app. II for additional details on CFO Act agencies’ compliance under IPERA for fiscal years 2011 through 2017, as reported by their IGs). Although the number of agencies reported as noncompliant under IPERA has varied slightly since fiscal year 2011, the total instances of noncompliance for all six criteria substantially improved after fiscal year 2011, when IPERA was first implemented. As shown in figure 2, the total instances decreased from 38 instances (for 14 noncompliant agencies) for fiscal year 2011 to 26 instances (for 14 noncompliant agencies) for fiscal year 2017. Also, for fiscal year 2017, 7 of 14 agencies were reported as noncompliant for only one criterion per noncompliant program. Of these, 6 agencies—the Departments of Homeland Security (DHS), Education (Education), Commerce, and Transportation; the General Services Administration; and the Social Security Administration (SSA)—were only reported as noncompliant with the IPERA criterion that requires agencies to publish and meet reduction targets. In addition, the Department of the Treasury (Treasury) was only reported as noncompliant with the IPERA criterion that requires agencies to report improper payment rates below 10 percent. Furthermore, the programs reported as noncompliant for fiscal year 2017 accounted for a significantly smaller portion of the total reported estimated improper payments as compared to the noncompliant programs for fiscal year 2015. Specifically, we previously reported that 52 noncompliant programs accounted for $132 billion (or about 96 percent) of the $137 billion total reported estimated improper payments for fiscal year 2015, whereas 58 noncompliant programs accounted for $80 billion (or about 57 percent) of the $141 billion total reported estimated improper payments for fiscal year 2017. Although improper payment estimates associated with noncompliant programs vary from year to year, this decrease (approximately $52 billion) was primarily due to two programs. Specifically, the Department of Health and Human Services’ (HHS) Medicare Fee-for-Service (Parts A and B) and Medicare Part C programs were reported as noncompliant and accounted for approximately $43 billion and $14 billion, respectively, of estimated improper payments for fiscal year 2015. These programs were reported as compliant for fiscal year 2017 and accounted for approximately $36 billion and $14 billion, respectively, or about 36 percent of the $141 billion total reported improper payments for fiscal year 2017. Almost a third (18 programs) of the 58 programs that contributed to 14 CFO Act agencies’ noncompliance under IPERA, as of fiscal year 2017, were reported as noncompliant for 3 or more consecutive years. The number of programs noncompliant for 3 or more consecutive years has continually increased since fiscal year 2015, as shown in figure 3. Specifically, 12 programs (associated with 7 agencies) were reported as noncompliant for 3 or more consecutive years, as of fiscal year 2015, and the number increased to 14 programs (associated with 8 agencies) and 18 programs (associated with 9 agencies), as of fiscal years 2016 and 2017, respectively. These programs accounted for a substantial portion of the $141 billion total estimated improper payments for fiscal year 2017. As shown in table 2, 14 of the 18 programs that were reported as noncompliant for 3 or more consecutive years reported improper payment estimates that accounted for an estimated $74.4 billion (about 53 percent) of the $141 billion, while the other 4 programs did not report improper payment estimates for fiscal year 2017 and were reported by their respective IGs as noncompliant with the IPERA criterion to publish improper payment estimates. The $74.4 billion is primarily composed of estimates reported for 2 noncompliant programs—HHS’s Medicaid program ($36.7 billion) and Treasury’s Earned Income Tax Credit program ($16.2 billion)— totaling $52.9 billion (or approximately 71 percent of the $74.4 billion). Improper payments associated with these two noncompliant programs are also a central part of two areas included in our 2017 High-Risk List, which includes federal programs and operations that are especially vulnerable to waste, fraud, abuse, and mismanagement, or that need transformative change. Eight of the 18 noncompliant programs have been reported as noncompliant since the implementation of IPERA in fiscal year 2011, for a total of 7 consecutive years, as shown in table 2. Reported compliance for Treasury’s Earned Income Tax Credit improved from being reported as noncompliant with multiple IPERA criteria in fiscal year 2013 to noncompliance with only one criterion for the last 4 years (fiscal years 2014 through 2017). Eight CFO Act agencies’ programs were reported as noncompliant under IPERA for 3 or more consecutive years, as of fiscal year 2016. Three of these agencies did not notify Congress of their program’s continued noncompliance as required. In addition to submitting the required notifications for their noncompliant programs, the other five agencies also included additional information in their notifications—such as measurable milestones, designation of senior officials, and accountability mechanisms—useful for assessing their efforts to achieve compliance. In June 2018, OMB updated its guidance to clarify agency reporting requirements for each consecutive year a program is reported as noncompliant. However, OMB’s updated guidance did not direct agencies to include other types of quality information in their notifications for programs reported as noncompliant for 3 or more consecutive years that could help Congress to more effectively assess their efforts to address long-standing challenges and other issues affecting these programs and to achieve compliance. Of the eight agencies with programs reported as noncompliant under IPERA for 3 or more consecutive years as of fiscal year 2016, we found that five agencies notified Congress of their noncompliance as required. Specifically, the Department of Defense (DOD), Education, HHS, DHS, and SSA notified Congress of their programs’ reported noncompliance for 3 or more consecutive years as of fiscal year 2016 as required by IPERA and OMB guidance. The remaining three agencies—the U.S. Department of Agriculture (USDA), the Department of Labor (DOL), and Treasury— did not notify Congress as required. Additional information regarding the three agencies that did not submit their required notifications to Congress is summarized below: USDA: In May 2017, the USDA IG reported that four USDA Food and Nutrition Service programs—Child and Adult Care Food Program; National School Lunch Program; School Breakfast Program; and Special Supplemental Nutrition Program for Women, Infants, and Children—had been noncompliant for 6 consecutive years, as of fiscal year 2016. However, USDA has not notified Congress of these programs’ continued noncompliance with IPERA as of fiscal year 2016, despite prior recommendations that we, and the USDA IG, made to USDA to do so. USDA staff stated in May 2018 that USDA drafted, but had not submitted, a letter to Congress regarding these programs’ noncompliance. DOL: In June 2017, the DOL IG reported that the Unemployment Insurance Benefit program had been noncompliant for 6 consecutive years, as of fiscal year 2016. In October 2016, DOL included proposed legislation in its last notification to Congress regarding this program, approximately 8 months prior to the DOL IG’s IPERA compliance report. However, because the requirement for agencies to notify Congress is triggered by IG reporting of programs that are noncompliant for 3 or more consecutive years, DOL should have also notified Congress regarding the program’s continued noncompliance in fiscal year 2016 after the IG’s report was issued in June 2017. DOL staff stated in August 2018 that the proposed legislation included in its October 2016 notification had not been enacted and that DOL is currently working to develop a new report to Congress and OMB detailing corrective actions taken to bring the program into compliance. Treasury: In May 2017, the Treasury IG reported that the Earned Income Tax Credit (EITC) program had been noncompliant for 6 consecutive years, as of fiscal year 2016. We previously reported that Treasury submitted proposed statutory changes to Congress for this program in August 2014 and in June 2015. As stated in the Treasury IG’s fiscal year 2016 IPERA compliance report, the proposed statutory changes would help prevent the improper issuance of billions of dollars in refunds as it would provide the Internal Revenue Service (IRS) with expanded authority to systematically correct erroneous claims that are identified when tax returns are processed and allow IRS to deny erroneous EITC refund claims before they are paid. Further, Treasury stated that IRS has repeatedly requested authority to correct such errors in subsequent fiscal year budgets, including its fiscal year 2019 budget submission. In June 2018, Treasury staff stated that the Consolidated Appropriations Act, 2016 provided IRS with additional tools for reducing EITC improper payments; however, the act did not expand IRS’s authority to systematically correct the erroneous claims that are identified when tax returns are processed. Treasury staff also stated that the department has continued to coordinate with OMB on required reporting for the EITC program because of the program’s complexity, and that OMB has not requested additional actions or documentation regarding the program’s noncompliance. Although continued coordination with OMB is important, Treasury did not notify Congress regarding the EITC program’s continued noncompliance as required. In summary, despite reporting requirements in IPERA and OMB guidance, one agency (USDA) has not notified Congress about four programs being reported as noncompliant for 6 consecutive years, as of fiscal year 2016. The remaining two agencies (DOL and Treasury) that did not notify Congress of their programs’ consecutive noncompliance, as of fiscal year 2016, submitted notifications to Congress prior to their respective IGs’ fiscal year 2016 compliance results. However, IPERA requires agencies to notify Congress when programs are reported as noncompliant for more than 3 consecutive years and thus DOL and Treasury should have also notified Congress about their programs’ being reported as noncompliant for 6 consecutive years, as of fiscal year 2016. It is important that agencies continue to notify Congress of their programs’ consecutive noncompliance each year after the third consecutive year as the information related to their proposals or regarding their IPERA compliance efforts included in prior years’ notifications to Congress may significantly change over time. Unless agencies continue to notify Congress in subsequent years, Congress may lack the current and relevant information needed to effectively assess agencies’ proposals or monitor their efforts to address problematic programs in a timely manner. OMB updated its guidance in June 2018 to provide more clarity regarding the notification requirements for each consecutive year a program is reported as noncompliant. Effective implementation of this guidance may help ensure that agencies consistently provide required information to Congress on these programs in future years. We found that the five agencies—DOD, DHS, Education, HHS, and SSA—that notified Congress regarding their programs’ reported noncompliance for 3 or more consecutive years, as of fiscal year 2016, also included additional information about their efforts to achieve IPERA compliance. Although IPERA does not specifically require that agency proposals for reauthorization or other statutory change provide such information, including it could help Congress to better assess the agencies’ proposals included in these notifications and to oversee agency efforts to address long-standing challenges and compliance issues associated with these programs. In many instances, the types of additional information provided by these agencies are similar to information that agencies are required to provide to Congress or OMB in other required notifications or other reports, such as annual AFRs or PARs. For example, all improper payment estimates reported under IPIA, as amended, must be accompanied by information on what the agency is doing to reduce improper payments, including a description of root causes and the steps the agency has taken to ensure accountability. Further, IPERA and OMB guidance require agencies to provide corrective action plans to Congress for programs reported as noncompliant for 1 year. Such plans should include actions planned or taken to address the program’s noncompliance, measurable milestones, a senior official designated to oversee progress, and the accountability mechanisms in place to hold the senior official accountable. In addition, GAO’s Standards for Internal Control in the Federal Government emphasizes the importance of communicating quality information, such as significant matters related to risks, changes, or issues affecting agencies’ efforts to achieve compliance objectives, to external parties—such as legislators, oversight bodies, and the general public. Furthermore, in our fiscal year 2017 High-Risk Update, we also highlight the importance of these types of information when assessing agency efforts to address issues associated with programs included on our High-Risk List. Examples of such information include (1) action plans that are accessible and transparent with clear milestones and metrics, including established goals and performance measures to address identified root causes; (2) leadership commitment of top (or senior) officials to establish long-term priorities and goals and continued oversight and accountability; (3) monitoring progress against goals, assessing program performance, or reporting potential risks; and (4) demonstrated progress, through recommendations implemented, actions taken for improvement, and effectively addressing identified root causes and managing high-risk issues. Table 3 summarizes the types of additional information described above that the five agencies provided in their fiscal year 2016 notifications to Congress to address programs with 3 or more consecutive years of noncompliance. All five agencies informed Congress of (1) root causes that directly lead to improper payments or hindered the program’s ability to achieve compliance; (2) certain risks, significant changes, or issues affecting their efforts; and (3) their corrective actions or strategies to achieve compliance. Three of the five agencies—DOD, Education, and DHS—also included the other types of additional information described above in their notifications, including measurable milestones, designated senior officials to oversee progress, and accountability mechanisms established to help achieve compliance. For example, all three agencies designated their chief financial officers (CFO) to oversee progress toward achieving measurable milestones and expanded their official roles and responsibilities to hold them accountable. Education and DHS stated that these responsibilities were added to their respective CFOs’ individual performance plans. Although OMB updated its guidance in June 2018 to clarify agency reporting requirements related to programs reported as noncompliant for 3 or more consecutive years, the updated guidance did not direct agencies to include other types of quality information in their notifications, such as those described above. In addition, information related to measurable milestones, corrective actions, risks, issues, or other items affecting agencies’ efforts may change significantly over time. With this additional information, Congress could have more complete information to effectively oversee agency efforts to address long-standing challenges and other issues that have contributed to programs being reported as noncompliant for 3 or more consecutive years. Fifteen programs in seven agencies and 12 programs in six agencies were reported as noncompliant for 2 consecutive years as of fiscal years 2016 and 2017, respectively. For agencies reported as noncompliant under IPERA for 2 consecutive years for the same program, IPERA gives the Director of OMB the authority to determine whether additional funding would help the agencies come into compliance. If the OMB Director determines that such funding would help, the agency is required to use any available reprogramming or transfer authority to meet the funding level that the OMB Director specified and, if such authorities are not sufficient, submit a request to Congress for additional reprogramming or transfer authority. According to OMB staff, OMB determined that no additional funding was needed for programs reported as noncompliant for 2 consecutive years as of fiscal year 2016. As of September 2018, OMB was in the process of making funding determinations for 12 programs that were reported as noncompliant as of fiscal year 2017 and stated that any determinations made would be developed in the President’s Budget for fiscal year 2020. The 12 programs reported as noncompliant for 2 consecutive years, as of fiscal year 2017, accounted for approximately $3 billion (2 percent) of the $141 billion total improper payment estimate for that year. Of these 12 programs, more than half (or 7 of the 12) were attributable to DOD; however, Education’s Pell Grant program accounted for $2.2 billion (or 74 percent) of the $3 billion in improper payment estimates for programs reported as noncompliant programs for 2 consecutive years, for fiscal year 2017. In addition, as shown in table 4, the 12 programs reported as noncompliant for 2 consecutive years, as of fiscal year 2017, were primarily noncompliant with the IPERA criteria that required agencies to publish information in their PAR or AFR or publish and meet reduction targets. As noted previously, IPERA gives OMB authority to determine whether additional funding for intensified compliance efforts would help the agency come into compliance under IPERA. Therefore, an established process for making timely, well-informed funding determinations is an essential part of ensuring that agencies have sufficient resources and take steps to intensify their compliance efforts in a timely manner. In April 2018, OMB staff stated that when making funding determinations, they primarily rely on the IGs’ recommendations in their annual IPERA compliance reports. OMB staff also stated that for its fiscal year 2016 determinations, OMB determined that additional funding was not needed because the IGs’ recommendations did not specify that additional funding was needed to help resolve the programs’ noncompliance. The IGs’ annual reports provide information on agencies’ IPERA compliance and may be useful to OMB as a tool to help them make determinations for additional funding. However, IPERA does not require IGs to address funding levels in their annual compliance reports, and OMB’s guidance does not inform the IGs that their work might be relied upon in this manner. We reviewed the IGs’ fiscal years 2016 and 2017 IPERA compliance reports for the agencies with programs reported as noncompliant for 2 consecutive years and found that the IGs did not make any recommendations regarding additional funding needed to bring these programs into compliance. In addition, as specifically stated by the IGs for Education and USDA in their IPERA reports, OMB has the statutory responsibility to make these funding determinations. Education IG’s fiscal year 2017 IPERA compliance report stated that “If OMB recommends that the Department needs additional funding or should take any other actions to become compliant with IPERA, we recommend that the Department implement OMB’s recommendations.” Also, the USDA IG’s fiscal year 2016 IPERA compliance report stated, “For agencies that are not compliant for 2 consecutive years for the same program, the Director of OMB will determine if additional funding would help these programs come into compliance.” As a result, OMB’s reliance on IG recommendations as the source of information to support additional funding determinations may not provide sufficient information to effectively assess agencies’ funding needs to address noncompliance. OMB staff subsequently stated that they no longer need to conduct a detailed review of the IGs’ IPERA compliance reports to identify recommendations related to additional funding needs. Instead, OMB Memorandum M-18-20, issued in June 2018, updated OMB Circular No. A-123, Appendix C, and clarified that the funding determination process will unfold as part of the annual development of the President’s Budget, as described in OMB Circular No. A-11. This updated guidance also directs agencies to submit proposals to OMB regarding additional funding needs that may help them address IPERA noncompliance. To illustrate, under this new guidance, the IGs’ fiscal year 2018 IPERA compliance reports will be due in May 2019, and any funding needs to address noncompliance would be incorporated in the next annual budget preparation process, the results of which are due to be submitted to Congress in February 2020 for the President’s Budget for fiscal year 2021. Once OMB’s determinations have been made and communicated to agencies, agencies would respond by performing the required reprogramming and making transfers under existing authority, where available. Any requests for additional transfer authority may be incorporated into subsequent appropriations legislation. Estimated improper payments reported government-wide total almost $1.4 trillion from fiscal year 2003 through fiscal year 2017. The number of programs reported as noncompliant under IPERA for 3 or more consecutive years has continued to increase, from 12 programs (associated with 7 agencies) to 18 programs (associated with 9 agencies) as of fiscal years 2015 and 2017, respectively. Including additional useful, up-to-date information—such as measurable milestones, risks, or other issues affecting agency efforts to achieve compliance—in notifications to Congress, which are required when programs are reported as noncompliant for 3 or more consecutive years, could help Congress better assess agency efforts to address long-standing challenges and other issues associated with them. Although certain agencies included certain types of additional information in their notifications as of fiscal year 2016, OMB guidance does not require agencies to include such information in their notifications. As a result, Congress may lack sufficient information to effectively oversee agency efforts and take prompt action to help address long-standing challenges or other issues associated with these programs. The Director of OMB should take steps to update OMB guidance to specify other types of quality information that agencies with programs noncompliant for 3 or more consecutive years should include in their notifications to Congress, such as significant matters related to risks, issues, root causes, measurable milestones, designated senior officials, accountability mechanisms, and corrective actions or strategies planned or taken by agencies to achieve compliance. (Recommendation 1) We provided a draft of this report to OMB and requested comments, and OMB said that it had no comments. We also provided a draft of this report to the 24 CFO Act agencies and their IGs and requested comments. We received letters from the DHS Office of Inspector General (OIG), SSA, and the United States Agency for International Development. These letters are reproduced in appendixes V through VII. We also received technical comments from DOL, the Department of Veterans Affairs, the General Services Administration, HHS, the Department of Housing and Urban Development, and the Treasury OIG, which we incorporated in the report as appropriate. The remaining agencies and OIGs either did not provide comments or notified us via email that they had no comments. In its comments, SSA stated that it provided information to Congress on measurable milestones, designated senior officials, and accountability mechanisms in its AFR. In the report, we acknowledge that these types of additional information are similar to information that agencies are required to provide to Congress or OMB in other reports, such as annual AFRs. However, our analysis was based on SSA’s fiscal year 2016 notifications to Congress for programs reported as noncompliant under IPERA, in which this specific information was not reported. As such, we continue to believe that OMB should take steps to update OMB guidance to help ensure that agencies report such significant information and include it in their notifications to Congress. We are sending copies of this report to the appropriate congressional committees, the Director of the Office of Management and Budget, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions on matters discussed in this report, please contact me at (202) 512-2623 or davisbh@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix VIII. Our objectives were to determine the following: 1. The extent to which the 24 agencies listed in the Chief Financial Officers Act of 1990, as amended (CFO Act), complied with the six criteria listed in the Improper Payments Elimination and Recovery Act of 2010 (IPERA), for fiscal years 2016 and 2017, and the trends evident since 2011, as reported by their inspectors general (IG). 2. The extent to which CFO Act agencies addressed requirements for programs and activities reported as noncompliant with IPERA criteria for 3 or more consecutive years, as of fiscal year 2016, and communicated their strategies to Congress for reducing improper payments and achieving compliance. 3. The extent to which the Office of Management and Budget (OMB) made determinations regarding whether additional funding would help CFO Act programs and activities reported as noncompliant with IPERA criteria for 2 consecutive years, as of fiscal years 2016 and 2017, come into compliance. Although the responsibility for complying with provisions of improper payment-related statutes rests with the head of each executive agency, we focused on the 24 agencies listed in the CFO Act because estimates of their improper payments represent over 99 percent of the total reported estimated improper payments for fiscal years 2016 and 2017. Our work did not include validating or retesting the data or methodologies that the IGs used to determine and report compliance. We corroborated all of our findings with OMB and all 24 CFO Act agencies and IGs. To address our first objective, we identified the requirements that agencies must meet by reviewing the Improper Payments Information Act of 2002 (IPIA), IPERA, and OMB guidance. We reviewed the CFO Act agency IGs’ IPERA compliance reports for fiscal years 2016 and 2017, which were the most current reports available at the time of our review. We summarized the overall agency and program-specific compliance determinations with the six IPERA criteria, as reported by the IGs. For fiscal years 2011 through 2015, we relied on and reviewed prior year supporting documentation and analyses of CFO Act agencies’ IPERA compliance, as reported in our prior reports, in order to identify compliance trends since 2011, as reported by the IGs. Based on these reports, we summarized the programs and the number of consecutive years that they were reported as noncompliant. For each IG report that did not specifically state that the agency had programs noncompliant for consecutive years, we compared the list of programs reported as noncompliant for fiscal years 2016 and 2017 to the list of programs reported as noncompliant for fiscal years 2014 and 2015 in our prior reports. Lastly, we corroborated our findings with OMB and all 24 CFO Act agencies and IGs. To address our second objective, we determined if the agencies responsible for programs and activities reported as noncompliant for 3 or more consecutive years as of fiscal year 2016 had submitted the required proposals (reauthorizations or statutory changes) to Congress by requesting and reviewing documentation of the required submissions and relevant notifications to Congress obtained from each applicable agency. Further, we reviewed the content of each agency notification to evaluate agencies’ efforts to communicate quality information to Congress concerning their strategies for achieving compliance consistent with Standards for Internal Control in the Federal Government. Principle 15 of these standards emphasizes the need for an entity’s management to communicate necessary quality information, such as significant matters related to risks, changes, or issues affecting agencies’ efforts, to achieve compliance objectives, to external parties—such as legislators, oversight bodies, and the general public. To identify other types of information useful for this purpose, we reviewed IPIA, as amended; IPERA; and OMB guidance for information agencies are required to provide to Congress or OMB in other notifications and reports, such as their corrective action plans or strategies, measurable milestones, designated senior officials, and accountability mechanisms for achieving compliance. We also reviewed information used to assess agency efforts to address issues associated with programs on our High-Risk List. To determine the extent to which agencies’ notifications to Congress included these additional types of useful information for their applicable program(s), we used a data collection instrument to document our determinations regarding the additional types of quality information included in each notification. In addition, two GAO analysts independently reviewed each agency’s notification and documented their determinations regarding the types of information included in the notifications. Differences between the analysts’ determinations were identified and resolved to ensure that the types of additional information were consistently identified and categorized. We did not evaluate the sufficiency and completeness of the agency-provided information. Lastly, we corroborated our findings with the respective agencies and IGs. To address our third objective, we identified provisions in IPIA, IPERA, and OMB guidance that are applicable to OMB for programs reported as noncompliant for 2 consecutive years. To determine if OMB made additional funding determinations for agency programs and activities reported as noncompliant for 2 consecutive years as of fiscal years 2016 and 2017, we requested relevant information and communications from OMB and the applicable agencies and IGs. We also interviewed key OMB staff on their process for determining additional funding needs for noncompliant programs and activities as of fiscal years 2016 and 2017 and related results. In addition, we reviewed the applicable fiscal years 2016 and 2017 CFO Act agency IG IPERA compliance reports, which OMB staff stated they relied on for determining whether noncompliant programs and activities required additional funding. We also asked the agencies whether they coordinated with OMB regarding their need for additional funding for programs and activities reported as noncompliant for 2 consecutive years as of fiscal years 2016 and 2017. Lastly, we corroborated our findings with OMB and the respective agencies and IGs. We conducted this performance audit from November 2017 to December 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Figure 4 details the 24 Chief Financial Officers Act of 1990 (CFO Act) agencies’ overall compliance under the Improper Payments Elimination and Recovery Act of 2010 (IPERA), as reported by their inspectors general, for fiscal years 2011 through 2017. We previously reported on CFO Act agencies’ overall reported compliance for fiscal years 2011 through 2015. Tables 5 and 6 detail the Chief Financial Officers Act of 1990 (CFO Act) agencies and programs reported by their inspectors general as noncompliant with the six criteria specified by the Improper Payments Elimination and Recovery Act of 2010 (IPERA), for fiscal years 2016 and 2017. We previously reported on CFO Act agencies’ reported compliance with the six IPERA criteria for fiscal year 2015. Table 7 details the Chief Financial Officers Act of 1990 (CFO Act) agencies and programs reported by their inspectors general as noncompliant under the Improper Payments Elimination and Recovery Act of 2010 (IPERA) for 2 or more consecutive years, as of fiscal years 2016 and 2017. We previously reported on CFO Act agencies’ reported compliance for fiscal year 2015. In addition to the contact named above, Michelle Philpott (Assistant Director), Matthew Valenta (Assistant Director), Vivian Ly (Auditor in Charge), Juvy Chaney, John Craig, Caitlin Cusati, Francine DelVecchio, Patrick Frey, Maria Hasan, Maxine Hattery, Jason Kelly, Jim Kernen, Jason Kirwan, Sharon Kittrell, Lisa Motley, Heena Patel, Anne Rhodes- Kline, and Kailey Schoenholtz made key contributions to this report.

Summary: Government-wide estimated improper payments totaled almost $1.4 trillion from fiscal year 2003 through fiscal year 2017. IPERA requires IGs to annually assess and report on whether executive branch agencies complied with the six criteria to (1) publish an agency financial report or performance accountability report, (2) conduct program-specific improper payment risk assessments, (3) publish improper payment estimates, (4) publish corrective action plans, (5) publish and meet annual improper payment reduction targets, and (6) report a gross improper payment rate of less than 10 percent. This report examines the extent to which 1. CFO Act agencies complied with IPERA criteria for fiscal years 2016 and 2017, and the trends evident since 2011, as reported by their IGs; 2. CFO Act agencies addressed requirements for programs reported as noncompliant with IPERA criteria for 3 or more consecutive years, as of fiscal year 2016, and communicated their strategies to Congress for reducing improper payments and achieving compliance; and 3. OMB made determinations regarding whether additional funding would help CFO Act agency programs reported as noncompliant with IPERA criteria for 2 consecutive years, as of fiscal years 2016 and 2017, come into compliance. GAO analyzed the IGs' fiscal years 2016 and 2017 IPERA compliance reports; reviewed prior GAO reports on agencies' IPERA compliance; reviewed agency information submitted to Congress; and made inquiries to OMB, applicable agencies, and IGs; and assessed such information based on relevant IPERA provisions and OMB and other guidance. Over half of the 24 Chief Financial Officers Act of 1990 (CFO Act) agencies were reported by their inspectors general (IG) as noncompliant with one or more criteria under the Improper Payments Elimination and Recovery Act of 2010 (IPERA) for fiscal years 2016 and 2017. Nine CFO Act agencies have been reported as noncompliant in one or more programs every year since the implementation of IPERA in fiscal year 2011, totaling 7 consecutive years of noncompliance. The IGs of the 14 noncompliant agencies reported that a total of 58 programs were responsible for the identified instances of noncompliance in fiscal year 2017. Further, 18 of the 58 programs at 9 agencies were reported as noncompliant for 3 or more consecutive years. Fourteen of these 18 programs accounted for an estimated $74.4 billion of the $141 billion total estimated improper payments for fiscal year 2017; the other 4 programs did not report improper payment estimates. This sum may include estimates that are of unknown reliability. The $74.4 billion is primarily composed of estimates reported for two noncompliant programs, the Department of Health and Human Services' Medicaid program and the Department of the Treasury's (Treasury) Earned Income Tax Credit program; estimated improper payments for these two programs are also a central part of certain high-risk areas in GAO's 2017 High-Risk List. Agencies with any program reported as noncompliant for 3 or more consecutive years are required to notify Congress of their program's consecutive noncompliance and submit a proposal for reauthorization or statutory change to bring that program into compliance. GAO found that three agencies with one or more programs reported as noncompliant for 3 or more consecutive years, as of fiscal year 2016, did not notify Congress or submit the required proposals. The Departments of Labor and the Treasury submitted proposed legislative changes in response to their programs being previously reported as noncompliant, but did not notify Congress of the programs' continued noncompliance as of fiscal year 2016. The U.S. Department of Agriculture (USDA) has not notified Congress despite prior GAO and USDA IG recommendations to do so. To address these issues, in June 2018 the Office of Management and Budget (OMB) updated its guidance to clarify the notification requirements for each consecutive year a program is reported as noncompliant. GAO found that five agencies did notify Congress as required, and included additional quality information that is not specifically required, but could be useful in updating Congress on their compliance efforts. For example, all five agencies provided information on the root causes, risks, changes, or issues affecting their efforts and corrective actions or strategies to address them; three agencies provided other quality information on accountability mechanisms, designated senior officials, and measurable milestones. In June 2018, OMB updated its guidance to clarify agency reporting requirements for programs reported as noncompliant for 3 or more consecutive years. However, the updated guidance does not direct agencies to include the types of quality information included in these five agencies' notifications for fiscal year 2016. GAO's Standards for Internal Control in the Federal Government emphasizes the importance of communicating quality information, such as significant matters affecting agencies' efforts to achieve compliance objectives. Such information could be useful in understanding the current challenges of these programs and is essential for assessing agency efforts to address high-risk and other issues. As a result, Congress could have more complete information to effectively oversee agency efforts to address program noncompliance for 3 or more consecutive years. When programs are reported as noncompliant for 2 consecutive years, IPERA gives OMB authority to determine whether additional funding is needed to help resolve the noncompliance. In April 2018, OMB staff stated that they determined that no additional funding was needed for the 15 programs that were reported as noncompliant for 2 consecutive years, as of fiscal year 2016, and that they primarily rely on the IGs' recommendations in their annual IPERA compliance reports when making funding determinations. OMB staff subsequently stated that they no longer need to conduct a detailed review of the IGs' IPERA compliance reports to identify recommendations related to additional funding needs. Instead, OMB updated its guidance in June 2018 to direct agencies to submit proposals to OMB regarding additional funding needs to help address IPERA noncompliance and clarified that the funding determination process will unfold as part of the annual development of the President's Budget. As of September 2018, OMB was in the process of making funding determinations for 12 programs that were reported as noncompliant as of fiscal year 2017 and stated that any determinations made would be developed in the President's Budget for fiscal year 2020. GAO recommends that OMB update its guidance to specify other types of quality information that agencies with programs noncompliant for 3 or more consecutive years should include in their notifications to Congress, such as significant matters related to risks, issues, root causes, measurable milestones, designated senior officials, accountability mechanisms, and corrective actions or strategies planned or taken by agencies to achieve compliance. GAO provided a draft of this report to OMB and requested comments, and OMB said that it had no comments. GAO also provided a draft of this report to the 24 CFO Act agencies and their IGs and requested comments. In its written comments, the Social Security Administration (SSA) stated that it provided information on measurable milestones, designated senior officials, and accountability mechanisms in its agency financial report. However, SSA did not provide this information in its notifications to Congress for programs reported as noncompliant under IPERA as of fiscal year 2016. GAO believes that OMB should take steps to update OMB's guidance to help ensure that agencies report such significant information and include it in their notifications to Congress. In addition, several agencies and IGs provided technical comments, which were incorporated in the report as appropriate.