IPIA requires agencies to conduct a risk assessment for all programs and activities at least once every 3 years, and OMB guidance implementing IPIA also directs agencies to report on the assessment in either the agencies’ AFRs or PARs. Each agency must institute a systematic method of performing the improper payment risk assessment, which may take the form of either a quantitative analysis based on a statistical sample or qualitative evaluation (e.g., a risk assessment questionnaire). IPIA identifies seven risk factors and OMB guidance includes two additional risk factors that agencies are to consider when conducting improper payment risk assessments. According to OMB M-15-02, agencies’ risk assessments (either quantitative or qualitative) should consider all of the following nine risk factors that are likely to contribute to significant improper payments: 1. whether the program or activity reviewed is new to the agency; 2. the complexity of the program or activity reviewed, particularly with respect to determining correct payment amounts; 3. the volume of payments made annually; 4. whether payments or payment eligibility decisions are made outside of the agency, for example, by a state or local government or a regional federal office; 5. recent major changes in program funding, authorities, practices, or 6. the level, experience, and quality of training for personnel responsible for making program eligibility determinations or certifying that payments are accurate; 7. inherent risks of improper payments because of the nature of agency 8. significant deficiencies in the agency’s audit reports, including but not limited to the agency IG or GAO audit findings or other relevant management findings that might hinder accurate payment certification; and 9. results from prior improper payment work. OMB guidance describes these nine risk factors as the minimum factors that agencies should consider and notes that additional risk factors, such as those specific to the program or activity being assessed, should also be considered, as appropriate. If an agency’s improper payment risk assessment finds that a program is susceptible to significant improper payments, the agency is required by IPIA to estimate the annual amount of improper payments for the program, publish corrective action plans, set reduction targets, and annually report on the results of addressing these requirements for that program. IPIA states that each agency is required to publish the improper payment information in an annual report in the form and content required by OMB—typically an AFR or a PAR—for the most recent fiscal year, and post that report on the agency’s website. OMB Circular A-136 and OMB M-15-02 provide guidance for agencies on preparing their AFRs or PARs, including the reporting of improper payment information. Specifically, this OMB guidance directs agencies to disclose the following in their AFRs or PARs: (1) the basis for grouping programs and activities for improper payment risk assessments; (2) the risk factors considered during their risk assessment; and (3) a listing of all programs that were assessed for a given year, regardless of whether a program or activity was deemed susceptible to significant improper payments. Given that OMB guidance is updated periodically, some reporting directives may differ for each fiscal year. As shown in table 1, the directive to disclose the basis for grouping programs and activities was applicable for all 3 years included in the scope of our review (i.e., fiscal years 2014 through 2016). However, the directives to disclose all the risk factors considered and include a listing of all programs and activities assessed were only applicable for fiscal years 2015 and 2016. During fiscal years 2014 through 2016, the 24 CFO Act agencies, excluding the Department of Defense (DOD), reported in their AFRs or PARs that that they completed at least one risk assessment on at least one program or activity in one or more of those years. For the agencies that reported that they completed an improper payment risk assessment, we found that most generally adhered to the reporting directives that were applicable for fiscal years 2014 through 2016. For example, for fiscal year 2014, 21 of the 24 CFO Act agencies reported completing a risk assessment, and for those 21 agencies, we found that 19 agencies adhered to OMB guidance for reporting the basis of groupings of programs and activities and 2 did not. (See fig. 1.) For fiscal years 2015 and 2016, all 18 CFO Act agencies that reported completing a risk assessment adhered to OMB guidance for this directive. Appendix III provides additional details regarding the agencies’ reporting of completing an improper payment risk assessment each year and adherence to the OMB improper payment risk assessment reporting directives. Further details on each of these reporting directives are provided below. Reporting the basis for grouping programs and activities. During the 3-year period from fiscal years 2014 through 2016, we found two instances where the agencies—the Departments of Commerce (Commerce) and Energy (Energy)—did not adhere to the reporting directive for agencies to report the basis of grouping programs and activities. Although these two agencies did not adhere to this reporting directive in fiscal year 2014, Commerce adhered to this directive in fiscal year 2015 and fiscal year 2016. Energy adhered to this directive in fiscal year 2015, and this reporting directive was not applicable for fiscal year 2016 because Energy did not report completing any risk assessments that year. All other applicable agencies were in full adherence to this OMB directive in fiscal years 2015 and 2016. Reporting a listing of all programs and activities assessed during the agencies’ improper payment risk assessments. During fiscal years 2015 through 2016, the applicable CFO Act agencies, except for the U.S. Agency for International Development (USAID), adhered to the reporting directive for listing all programs and activities assessed during the agencies’ improper payment risk assessments. USAID did not adhere to this reporting directive in fiscal year 2015; however, in fiscal year 2016, USAID did list all programs and activities. USAID officials provided us an OMB e-mail indicating, among other things, that USAID could be on a 3- year cycle of performing risk assessments starting in fiscal year 2015. Notwithstanding that e-mail, USAID continued to perform improper payment risk assessments annually, according to USAID officials, to maintain audit readiness and expertise. These officials further stated that this OMB e-mail served as support for not adhering to the OMB directive for reporting risk assessments. However, we did not find upon our review that the e-mail explicitly provided such support. Reporting the risk factors considered during the agencies’ risk assessments. As directed by OMB guidance, agencies are to report the risk factors considered during improper payment risk assessments in their AFRs or PARs. Given that IPIA identifies seven risk factors that agencies are to consider and OMB guidance includes two additional risk factors, agencies are directed by OMB to consider a minimum of nine risk factors. Therefore, the AFRs and PARs adhering to OMB guidance are to include a discussion regarding the agencies’ consideration of these nine factors as well as any other factors considered. In our analysis, we found that six agencies failed to adhere to OMB reporting directives either in fiscal year 2015, fiscal year 2016, or both. Specifically, we found the following: The Office of Personnel Management (OPM) did not adhere to the improper payment risk assessment reporting directives in fiscal year 2015. However, OPM subsequently corrected the reporting issue in fiscal year 2016. Three agencies—USAID, the U.S. Department of Agriculture (USDA), and the Social Security Administration (SSA)—did not adhere to the improper payment risk assessment reporting directives in fiscal years 2015 and 2016. In their fiscal years 2015 and 2016 AFRs, USAID did not report its consideration of any of the nine risk factors, USDA reported that it considered four of the nine risk factors, and SSA reported that it considered six of the nine risk factors. Two agencies, the Department of Education (Education) and the Department of Labor (Labor), did not adhere to the improper payment risk assessment reporting directive in fiscal year 2016. In their fiscal year 2016 AFRs, neither Education nor Labor provided a detailed description of all the risk factors that were considered in their risk assessments. Education stated that its risk assessment analysis “included a quantitative review of questioned costs from Single Audit findings versus total program expenditures, as well as a qualitative review of other risk factors including changes in legislation or regulations and history of audit findings.” Labor did not list the risk factors considered in its improper payment risk assessments but instead provided a hyperlink to IPIA. As noted above, officials from USAID stated that an OMB e-mail served as support for not adhering to the OMB directive for reporting risk assessments, including the risk factors. However, we found upon our review that the e-mail did not explicitly provide such support. Officials from USDA, Labor, and SSA, three of the five agencies that did not adhere to the reporting directive in fiscal year 2016, informed us that they considered the nine risk factors but were not aware that they had to specifically list the nine risk factors in their AFRs or PARs. In addition, Labor officials stated that they included a link to IPIA instead of mentioning the nine risk factors to help simplify the reporting. However, OMB Circular A-136 specifically directs the agencies to include a description of the risk factors considered in their improper payment risk assessments in their AFRs or PARs. Although Labor officials stated that they considered all nine risk factors, Labor’s link to IPIA only includes seven required risk factors and not the two additional risk factors that are referenced in OMB guidance. After we brought these concerns to their attention, officials from these three agencies indicated that they plan to report the risk factors considered, as directed by OMB, which should include consideration of all nine risk factors. By adhering to the OMB directive for reporting risk factors, the agencies will improve the transparency of the risk assessments reported in their AFRs or PARs. An Education official stated that the department did not consider all nine risk factors for its non-Federal Student Aid programs during fiscal year 2016 because Education’s analysis was quantitative in nature. However, OMB guidance states that all nine risk factors must be considered in both qualitative and quantitative improper payment risk assessments. In May 2017, the Inspector General for Education recommended that Education ensure that improper payment risk assessments conform with IPIA and OMB guidance when determining whether programs may be susceptible to significant improper payments and identify all programs that may be susceptible to significant improper payments. In response to the recommendation in the Office of Inspector General (OIG) audit report, Education stated that it will align its improper payment risk assessments with the nine risk factors beginning in fiscal year 2017. A revised version of OMB Circular A-136 that was issued in August 2017 no longer directs agencies to report improper payment risk assessment information in the agencies’ fiscal year 2017 AFRs and PARs. Specifically, agencies will no longer have to report in their AFRs or PARs for a given year (1) the basis for grouping programs and activities for improper payment risk assessments, (2) a listing of all programs and activities assessed during their risk assessments, and (3) the risk factors considered during their risk assessments. OMB staff stated that their primary motivation for eliminating the risk assessment reporting directives from OMB guidance was to reduce the administrative burden on agencies. Although OMB guidance will not direct agencies to report the three items noted above, agencies are still required to complete the risk assessments, as required by IPIA and directed in OMB guidance. Further, OMB staff stated that they rely on each agency’s OIG to review the quality of each agency’s risk assessment, which should include assessing the three items noted above; therefore, these reporting directives are not necessary. While we recognize the importance of reducing administrative burden, we also have previously reported on the importance of risk assessments for managing improper payments. We believe that the requirement for agencies to publicly report the improper payment risk assessment information has helped hold agencies accountable and provided additional transparency to the agencies’ improper payment processes, as well as assisted Congress and others in their oversight of government- wide improper payments. However, if OMB is going to rely on each agency’s OIG to ensure quality risk assessments, it is important that these reviews are performed consistently throughout the federal government. In our May 2017 report, we found that OIGs inconsistently reported agencies’ compliance with the IPERA criterion for conducting program-specific risk assessments. For example, certain OIGs reported agencies as noncompliant when agencies did not consider all nine risk factors, as outlined in IPIA, OMB guidance, or both, during program- specific risk assessments, whereas other OIGs reported agencies as compliant with this IPERA criterion, despite also finding issues with the agencies’ consideration of the nine risk factors. To help ensure that government-wide compliance under IPERA is consistently determined and reported, we recommended in May 2017 that the Director of OMB coordinate with the Council of the Inspectors General on Integrity and Efficiency (CIGIE) to develop and issue guidance, either jointly or independently, to specify what procedures should be conducted as part of the OIGs’ IPERA compliance determinations. OMB did not provide any comments on our recommendation, and as of August 2017, OMB had not yet issued such guidance. CIGIE stated that it would coordinate with OMB as needed and provide feedback on any draft OMB guidance. Subsequent to the issuance in August 2017 of a revised version of OMB Circular A-136 and after we notified OMB of our views on the importance of certain data, OMB staff stated that they plan to direct agencies to report additional risk assessment data. Specifically, in September 2017, OMB staff told us that they plan to direct agencies to provide a listing of all programs and activities assessed during their risk assessments on www.paymentaccuracy.gov for fiscal year 2017 reporting, and that they plan to continue to direct agencies to report this listing for subsequent fiscal years. In addition, although the basis for grouping programs and activities for improper payment risk assessments and the risk factors considered during the risk assessments will not be required to be reported in fiscal year 2017 AFRs and PARs, OMB staff stated that they plan to revise the guidance for fiscal year 2018 so that agencies report such information in their AFRs and PARs. We found that three of the nine selected CFO Act agencies that we reviewed, Energy, the Department of Justice, and USAID, had documented procedures for performing the required improper payment risk assessments and these procedures included the design of control activities necessary to help ensure that all programs and activities were assessed at least once every 3 years. However, the remaining six agencies did not properly design control activities for this purpose. Specifically, three of these six selected agencies did not have documented procedures for performing the required improper payment risk assessments. The remaining three agencies improperly excluded specific programs and activities from the improper payment risk assessment process. Appendix IV provides more detail on our analysis of these selected agencies’ procedures for performing improper payment risk assessments. We did not evaluate whether all control activities related to conducting improper payment risk assessments were properly designed or evaluate other internal control components, such as the control environment. If we had done so, additional deficiencies may or may not have been identified that could impair the overall effectiveness of the control activities evaluated as part of this audit. Three of the nine selected CFO Act agencies—Commerce, the National Science Foundation (NSF), and the Nuclear Regulatory Commission (NRC)—did not have documented procedures for conducting improper payment risk assessments for fiscal years 2014 through 2016. Although two of these three agencies (Commerce and NSF) had developed processes to help ensure that all programs and activities were assessed for susceptibility to significant improper payments at least once every 3 years, these processes were not documented in written procedures. By the end of our review, the three agencies subsequently established documented procedures during fiscal year 2017. We reviewed the procedures for Commerce, NRC, and NSF and found that they included control activities designed to help ensure that all programs and activities are included in the agencies’ improper payment risk assessments at least once every 3 years, as required by IPIA. Although the Departments of the Interior and State and the National Aeronautics and Space Administration (NASA) had documented procedures for conducting improper payment risk assessments, we found that these agencies did not have properly designed control activities to help ensure that all programs and activities were assessed for susceptibility to improper payments. These three agencies specifically excluded certain programs and activities from the improper payment risk assessment process, as follows. Department of the Interior (Interior). In our review of Interior’s design of control activities, we found that Interior did not include payments made by the department for certain programs. When asked why the programs associated with these payments were not assessed, Interior officials told us that the list that the department used to ensure that all programs and activities for which the department made payments were properly assessed excluded those payments from Interior’s program population. Subsequent to our inquiry, Interior officials told us that Interior will update its procedures to ensure that they capture all programs in Interior’s assessments. In addition, Interior officials provided us a draft of Interior’s updated procedures, and we found that these draft procedures included control activities designed to help ensure that all programs and activities are included in the department’s improper payment risk assessments at least once every 3 years, as required by IPIA. Department of State (State). In our review of State’s design of control activities, we found that State excluded certain programs and activities from the improper payment risk assessment based on threshold limitations on outlay data. Specifically, State only included programs and activities in the improper payment risk assessments if the outlays were greater than (1) $100 million or (2) $85 million and a 50 percent increase from the prior year. Programs and activities that fell below these thresholds were not assessed for susceptibility to significant improper payments. State officials told us that they believed the $100 million threshold limitation was reasonable because State predicted that it was improbable one of its programs would have an improper payment estimate of at least 10 percent in order to meet the IPIA threshold of $10 million. According to State officials, State’s justification for its assessment threshold was based on many factors, including sampling of expenditures, past external audits, and internal OMB Circular A-123 reviews. However, IPIA requires that improper payment risk assessments be performed for each program and activity that the agency head administers. In commenting on our draft report, State officials informed us that State had updated its documented procedures to lower the assessment threshold to the $10 million threshold identified in IPIA. State officials provided us a copy of the updated procedures, and we found that the procedures included control activities designed to help ensure that all programs and activities are included in the department’s improper payment risk assessments at least once every 3 years, as required by IPIA. NASA. In our review of NASA’s design of control activities, we found that NASA has documented procedures for conducting improper payment risk assessments; however, the procedures used for improper payment risk assessments conducted for fiscal years 2014 through 2016 were outdated. Specifically, the documented procedures, dated 2012, did not account for changes to IPIA in 2013 or updates to OMB’s guidance issued in fiscal year 2014. In June 2017, NASA subsequently updated its procedures for improper payment risk assessments to properly address OMB’s current improper payments guidance. The updated procedures also included a description of key control activities designed to help ensure that all NASA programs and activities, other than OIG activities, have undergone an improper payment risk assessment. According to NASA officials, NASA’s improper payment risk assessment process specifically excluded OIG activities because its OIG receives its own appropriation, and therefore, OIG activities are not considered part of NASA’s programs or activities for improper payment risk assessments. In addition, NASA officials stated that NASA OIG activities are excluded from the improper payment risk assessments because of concerns regarding NASA OIG’s independence as NASA OIG conducts the agency’s annual IPERA compliance audit. NASA could not provide us with any guidance or documentation that specifically addresses the exclusion of OIG activities. The NASA OIG is part of NASA, and IPIA requires that improper payment risk assessments be performed for each program and activity that the agency head administers. To the extent that the potential threat to OIG independence prevents NASA from conducting a risk assessment of payments made by the OIG’s programs and activities, the NASA Administrator may transfer this responsibility to the OIG. By not making an assessment, NASA has not determined whether OIG programs and activities are susceptible to significant improper payments. Standards for Internal Control in the Federal Government states that management should develop control activities to achieve objectives and respond to risks and implement control activities through policies. When an agency does not have properly designed policies and procedures to help ensure that all programs and activities are assessed for susceptibility to significant improper payments at least once every 3 years, there is an increased risk that the agency may not always identify all risk-susceptible programs and activities, resulting in incomplete improper payment estimates. Performing improper payment risk assessments and reporting on such assessments are key to identifying programs and activities that may be susceptible to significant improper payments. Agencies’ nonadherence to the OMB guidance to report on the results of their risk assessments may result in Congress not having the information necessary to monitor and take prompt action to address problematic programs. Most of the nine selected agencies did not properly design control activities to include all programs and activities in their improper payment risk assessments at least once every 3 years during fiscal year 2014 through fiscal year 2016, the time period of our review. Subsequent to fiscal year 2016, with the exception of NASA, which did not include its OIG’s activities, the federal agencies that were identified as lacking properly designed control activities drafted or updated their procedures to help ensure that all programs and activities were assessed for susceptibility to significant improper payments. Without proper control activities, NASA may not be identifying all programs and activities that should be included in its improper payment risk assessments. If a program or activity is not assessed for risk, then an agency could be at risk of noncompliance with IPIA or nonadherence to OMB guidance as the risk assessment process is a crucial step in determining programs and activities that are susceptible to significant improper payments and thus subject to additional reporting and monitoring requirements. We are making the following recommendation to NASA: The Administrator of NASA should take steps to revise the agency’s procedures for conducting improper payment risk assessments to include the activities of its OIG in its risk assessment process to help ensure that all programs and activities are assessed for susceptibility to significant improper payments at least once every 3 years as required by IPIA. (Recommendation 1) We provided a draft of this report to the 24 CFO Act agencies and OMB for comment. We received written comments from 4 agencies—NASA, State, SSA, and USAID, which are reproduced in appendixes V through VIII. We also received technical comments from Energy, OMB, State, and USAID, which we incorporated in the report as appropriate. All of the other agencies notified us that they had no comments. The following discusses the written comments we received from the four agencies noted above. In its comments, NASA concurred with our recommendation and stated that the agency will revise its procedures for conducting improper payment risk assessments to include OIG programs and activities by September 2018. In the draft report provided to State for comment, we had recommended that State reevaluate the agency’s use of dollar thresholds for excluding programs and activities from its risk assessment process and revise its procedures for conducting improper payment risk assessments to help ensure that all programs and activities are assessed for susceptibility to significant improper payments at least once every 3 years as required by IPIA. In its comments, State questioned the practicality of our proposed recommendation; however, State stated that it updated its procedures to lower the assessment threshold to the minimum dollar threshold of $10 million. We noted that this threshold aligns with the IPIA threshold of $10 million. We reviewed State’s updated procedures and confirmed that State had revised its dollar threshold for conducting risk assessments, which effectively addressed our preliminary findings. Therefore, we have removed the recommendation from our report. In its comments, SSA stated that it believed that its risk assessment reporting fully complied with OMB guidance. SSA stated that it considered the nine required risk factors but only reported on the risk factors that were applicable to the agency. However, given that SSA reported that it considered six risk factors and did not indicate in its AFRs that the other factors were not applicable to SSA, we continue to believe that SSA did not report, as directed by OMB guidance, on all the risk factors considered in its improper payment risk assessments for fiscal years 2015 and 2016. In its comments, USAID stated that our draft report was inaccurate in stating that USAID did not adhere to OMB reporting directives. USAID stated that an e-mail from OMB provided USAID relief from improper payment reporting. However, OMB’s e-mail did not explicitly provide USAID a waiver from the OMB risk assessment reporting directives. Moreover, USAID reported in its AFRs for fiscal years 2014 through 2016 that it conducted annual risk assessments for the time period covered in this audit. As stated in appendix III, USAID did properly report the basis for grouping programs and activities for fiscal years 2014 through 2016, and the agency also properly reported a listing of all programs and activities that were assessed for fiscal year 2016. Accordingly, we believe that USAID also should have followed all OMB risk assessment reporting directives for the time period covered for our audit, and we believe that our report accurately characterizes this issue. We are sending copies of this report to the appropriate congressional committees, the heads of the 24 CFO Act agencies, the Director of the Office of Management and Budget, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-2623 or davisbh@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IX. This report examines the extent to which (1) the 24 agencies subject to the Chief Financial Officers Act of 1990 (CFO Act) followed Office of Management and Budget (OMB) guidance for reporting on improper payment risk assessments in their agency financial reports (AFR) or performance and accountability reports (PAR) for fiscal years 2014 through 2016 and (2) selected CFO Act agencies have designed control activities to include all of their programs and activities in an improper payment risk assessment at least once during a 3-year period, as required by the Improper Payments Information Act of 2002 (IPIA), as amended by the Improper Payments Elimination and Recovery Act of 2010 and the Improper Payments Elimination and Recovery Improvement Act of 2012. At the time of our review, the latest 3-year period was fiscal years 2014 through 2016. To address our first objective, we reviewed improper payment risk assessment requirements in IPIA, as amended, and the related guidance in OMB Circular A-136, Financial Reporting Requirements, including the OMB directives for agencies’ risk assessment reporting, and OMB Circular A-123, Appendix C, Requirements for Effective Estimation and Remediation of Improper Payments (OMB M-15-02). We analyzed these statutes and guidance to identify key criteria that agencies must meet for reporting on improper payment risk assessments. IPIA, as amended, identifies seven risk factors and OMB guidance includes two additional risk factors that agencies are to consider in their improper payment risk assessment to determine susceptibility to significant improper payments. Additionally, for fiscal years 2014 through 2016, OMB M-15-02 directed agencies that conducted improper payment risk assessments to disclose in their AFRs or PARs the basis for grouping programs and activities for improper payment risk assessments. For fiscal years 2015 and 2016, OMB Circular A-136 directed agencies to report (1) a listing of programs and activities that were assessed for susceptibility to significant improper payments in a given year, regardless of whether a program or activity was deemed risk-susceptible, and (2) the risk factors considered during their improper payment risk assessments. We analyzed the AFRs or PARs of the 24 CFO Act agencies for fiscal years 2014 through 2016 to determine whether each agency met the key OMB reporting criteria described above. For our review, we focused on whether the agencies reported the risk assessment information in their AFRs or PARs and did not evaluate the quality of improper payment risk assessments completed. For any agencies that did not meet the reporting directives outlined in OMB guidance for their improper payment risk assessments, we interviewed appropriate agency officials to determine why those agencies did not meet these key criteria. For fiscal year 2017, a revised version of OMB Circular A-136 that was issued in August 2017 no longer directs agencies to report improper payment risk assessment information in the agencies’ fiscal year 2017 AFRs and PARs. Subsequent to the issuance in August 2017 of a revised version of OMB Circular A-136 and after we notified OMB of our views on the importance of certain data, OMB staff stated that they plan to direct agencies to report additional risk assessment data. Specifically, in September 2017, OMB staff told us that they plan to direct agencies to provide a listing of all programs and activities assessed during their risk assessments on www.paymentaccuracy.gov for fiscal year 2017 reporting, and that they plan to continue to direct agencies to report this listing for subsequent fiscal years. In addition, although the basis for grouping programs and activities for improper payment risk assessments and the risk factors considered during the risk assessments will not be required to be reported in fiscal year 2017 AFRs and PARs, OMB staff stated that they plan to revise the guidance for fiscal year 2018 so that agencies report such information in their AFRs and PARs. To address our second objective, we reviewed IPIA, as amended; the related OMB guidance; and relevant internal control standards to determine the relevant control activities needed to help ensure that agencies conduct improper payment risk assessments for all programs and activities at least once every 3 years. For this objective, we selected nine CFO Act agencies that did not report improper payment estimates for any programs or activities in fiscal year 2015 or 2016 except those estimates that were required to be reported pursuant to the Disaster Relief Appropriations Act, 2013. These nine agencies were the Departments of Commerce, Energy, the Interior, Justice, and State; the National Aeronautics and Space Administration; the National Science Foundation; the Nuclear Regulatory Commission; and the U.S. Agency for International Development. We reviewed these agencies’ procedures for conducting improper payment risk assessments and interviewed agency officials to determine whether the agencies designed and documented control activities to include all programs and activities in an improper payment risk assessment at least once every 3 years. To verify each agency’s assertions that all programs and activities are reviewed at least once every 3 years, we compared the line item for gross outlays contained in each agency’s Statement of Budgetary Resources for the relevant period to outlay data provided by each agency for each program and activity covered by improper payment risk assessments for fiscal years 2014 through 2016. When we identified differences between the two data sources, we interviewed agency officials to understand the cause for the differences and obtained any supporting documentation to ensure that all significant programs and activities were properly assessed. While our second objective focused on certain significant control activities related to the selected agencies’ inclusion of programs and activities in their improper payment risk assessments at least once during fiscal years 2014 through 2016, we did not evaluate all control activities and other components of internal control. If we had done so, additional deficiencies may or may not have been identified that could impair the effectiveness of the control activities evaluated as part of this audit. We conducted this performance audit from June 2016 to November 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Standards for Internal Control in the Federal Government provides the overall framework for establishing and maintaining internal control. Internal control should be designed, implemented, and operating effectively to provide reasonable assurance that the operations, reporting, and compliance objectives of an entity will be achieved. The five components of internal control are as follows: Control environment - The foundation for an internal control system. It provides the discipline and structure to help an entity achieve its objectives. Risk assessment - Assesses the risks facing the entity as it seeks to achieve its objectives. This assessment provides the basis for developing appropriate risk responses. Control activities - The actions management establishes through policies and procedures to achieve objectives and respond to risks in the internal control system, which includes the entity’s information system. Information and communication - The quality information management and personnel communicate and use to support the internal control system. Monitoring - Activities management establishes and operates to assess the quality of performance over time and promptly resolve the findings of audits and other reviews. An effective internal control system has each of the five components of internal control effectively designed, implemented, and operating and the five components operating together in an integrated manner. In this audit, we focused on certain significant control activities related to the selected agencies’ inclusion of programs and activities in their improper payment risk assessments at least once during fiscal years 2014 through 2016. As noted in our report, the Improper Payments Information Act of 2002, as amended by the Improper Payments Elimination and Recovery Act of 2010 and the Improper Payments Elimination and Recovery Improvement Act of 2012, requires agencies to conduct improper payment risk assessments for all federal programs and activities in fiscal year 2011 and at least once every 3 years thereafter. During fiscal years 2014 through 2016, the 24 agencies subject to the Chief Financial Officers Act of 1990 (CFO Act), excluding the Department of Defense, reported in their agency financial reports (AFR) or performance and accountability reports (PAR) that they completed at least one risk assessment on at least one program or activity in one or more of those years. For each agency that reported completing an improper payment risk assessment in a given year, we evaluated whether the agency adhered to certain Office of Management and Budget (OMB) reporting directives. It is important to note that our audit scope did not include evaluating whether the agencies completed the required risk assessment for all programs and activities. We evaluated the 24 CFO Act agencies’ fiscal years 2014 through 2016 AFRs and PARs to determine if agencies adhered to OMB guidance for reporting on improper payment risk assessments. Table 2 summarizes agencies’ adherence to the OMB guidance to report a basis for grouping programs and activities in the AFRs or PARs for fiscal years 2014 through 2016. Table 3 summarizes agencies’ adherence to the OMB directive to list all of the programs and activities that were assessed for susceptibility to significant improper payments and describe the risk factors considered during their assessments for fiscal years 2015 and 2016. There was no directive to report this information for fiscal year 2014. Table 4 summarizes our analysis of the selected agencies’ procedures for performing improper payment risk assessments to help ensure that all programs and activities were properly reviewed once every 3 years. In addition to the contact named above, Matt Valenta (Assistant Director), Michelle Philpott (Assistant Director), Laura Bednar (Auditor-in-Charge), Stephanie Adams, Youssef Amrani, Francine DelVecchio, and Kailey Schoenholtz made key contributions to this report.

Summary: Reported improper payment estimates totaled over $1.2 trillion government-wide from fiscal years 2003 through 2016. Agencies are statutorily required to perform improper payment risk assessments to identify programs and activities that may be susceptible to significant improper payments and are required to report an improper payment estimate for ones that are susceptible to significant improper payments. GAO was asked to review federal agencies' improper payment risk assessments. This report examines the extent to which (1) the 24 CFO Act agencies followed OMB guidance for reporting on improper payment risk assessments and (2) selected CFO Act agencies properly designed control activities to include all of their programs and activities in an improper payment risk assessment at least once every 3 years, as statutorily required. GAO analyzed the 24 CFO Act agencies' AFRs and PARs and reviewed the procedures at 9 selected agencies. GAO selected 9 agencies that did not report improper payment estimates in fiscal year 2015, except for those estimates that were mandated to be reported pursuant to the Disaster Relief Appropriations Act, 2013. For this review, GAO did not evaluate the quality of improper payment risk assessments completed. GAO's review of the 24 Chief Financial Officers Act of 1990 (CFO Act) agencies' fiscal years 2014 through 2016 agency financial reports (AFR) and performance and accountability reports (PAR) found that these agencies generally adhered to the Office of Management and Budget's (OMB) improper payment risk assessment reporting directives. However, GAO found instances of nonadherence, including the following: There were two instances of nonadherence to OMB's directive for agencies to report the basis for how they grouped programs and activities, both of which occurred in fiscal year 2014. All agencies that completed risk assessments adhered to this directive for fiscal years 2015 and 2016. The Improper Payments Information Act of 2002, as amended, identifies seven risk factors and OMB guidance includes two additional risk factors that agencies are to consider when conducting risk assessments. For fiscal years 2015 and 2016 reporting, OMB directed agencies to report the risk factors considered in their risk assessments. However, GAO found six agencies that did not report one or more of the nine risk factors in their AFRs or PARs. OMB's revised guidance for fiscal year 2017 no longer directs agencies to report on their risk assessments. OMB staff stated that their primary motivation for removing such reporting was to reduce the administrative burden. After GAO notified OMB of the importance of certain data, OMB staff plan to direct agencies to provide additional data, including a listing of risk assessed programs and activities, on www.paymentaccuracy.gov for reporting beginning in fiscal year 2017. OMB staff also plan to revise the guidance for fiscal year 2018 for agencies to report the other risk assessment information in their AFRs or PARs. GAO also found that three of the nine selected agencies (the Departments of Energy and Justice and the U.S. Agency for International Development) that it reviewed had designed and documented control activities to help ensure that all programs and activities were assessed every 3 years. For the remaining six agencies, GAO found that the agencies did not properly design control activities for this purpose. Specifically, GAO found the following: Three agencies—the Department of Commerce, the National Science Foundation, and the Nuclear Regulatory Commission—did not have documented procedures for conducting risk assessments during fiscal years 2014 through 2016 but subsequently documented them. Three agencies—the Departments of the Interior (Interior) and State (State) and the National Aeronautics and Space Administration (NASA)—documented procedures for conducting risk assessments but did not include all programs and activities in their risk assessments. Interior later drafted revisions to its procedures and State updated its procedures to include them. Without properly designed and documented control activities, there is a risk that an agency may not identify all programs and activities that require a risk assessment, which could result in the agency failing to develop and report improper payment estimates for programs and activities that should have been identified as susceptible to significant improper payments. GAO recommends that NASA revise its procedures to help ensure that all programs and activities are assessed for susceptibility to significant improper payments at least once every 3 years. NASA concurred with the recommendation.