IPIA was passed in November 2002 with the major objective of enhancing the accuracy and integrity of federal payments. IPIA requires executive branch agency heads to review their programs and activities annually and identify those that may be susceptible to significant improper payments. For each program and activity agencies identify as susceptible, the act requires them to estimate the annual amount of improper payments and to report those estimates to the Congress. The act further requires that for programs for which estimated improper payments exceed $10 million, agencies are to report annually to the Congress on the actions they are taking to reduce those payments. The act also requires the Director of OMB to prescribe guidance for agencies to use in implementing IPIA. OMB’s implementing guidance requires the use of a systematic method for the annual review and identification of programs and activities that are susceptible to significant improper payments. However, this guidance also allows for annual reviews (also known as risk assessments) to be conducted less often than annually for programs where improper payment baselines are already established, are in the process of being measured, or are scheduled to be measured by an established date—which is inconsistent with the express requirement of IPIA. In addition, OMB’s guidance defines significant improper payments as those in any particular program that exceed both 2.5 percent of program payments and $10 million annually. It requires agencies to estimate improper payments annually using statistically valid techniques for each susceptible program or activity. The guidance also allows agencies to use alternative sampling methodologies and requires agencies to report on and provide a justification for using these methodologies in their PARs. For those agency programs determined to be susceptible to significant improper payments and with estimated annual improper payments greater than $10 million, IPIA and related OMB guidance require each agency to annually report the results of its efforts to reduce improper payments. In August 2004, OMB established Eliminating Improper Payments as a new program-specific initiative under the President’s Management Agenda (PMA). This separate PMA program initiative began in the first quarter of fiscal year 2005. Previously, agency efforts related to improper payments were tracked along with other financial management activities as part of the Improving Financial Performance initiative of the PMA. The objective of establishing a separate initiative for improper payments was to ensure that agency managers are held accountable for meeting the goals of IPIA and are therefore dedicating the necessary attention and resources to meeting IPIA requirements. With this initiative, 15 agencies are to measure their improper payments annually, develop improvement targets and corrective actions, and track the results annually to ensure the corrective actions are effective. This list does not include USAID or NASA, which are nevertheless covered under IPIA and thus are required to address improper payments for their programs and activities. However, both USAID and NASA stated that they consulted with OMB, although infrequently, about procedures planned or under way for the first 3 years of IPIA implementation. In addition, applicable agencies are required by OMB guidance to report their efforts to recoup contract-related improper payments under section 831 of the National Defense Authorization Act for Fiscal Year 2002, commonly referred to as the Recovery Auditing Act. This legislation provides an impetus for applicable agencies to systematically identify and recover contract overpayments for executive branch agencies entering into contracts with a cumulative total value exceeding $500 million in a fiscal year. Furthermore, the law authorizes federal agencies to retain recovered funds to cover in-house administrative costs as well as to pay other contractors, such as collection agencies. Recovery auditing is a method that agencies can use to recoup detected (as opposed to estimated) improper payments. As such, recovery auditing is a detective control to help determine whether contractor payments were proper. Specifically, it focuses on the identification of erroneous invoices, discounts offered but not received, improper late penalty payments, incorrect shipping costs, and multiple payments for single invoices. Recovery auditing can be conducted in-house or contracted out to recovery audit firms. The techniques used in recovery auditing offer the opportunity for identifying weaknesses in agency internal controls, which can be modified or upgraded to be more effective in preventing improper payments before they occur during subsequent contract outlays. Agencies that are required to undertake recovery audit programs were directed by OMB to provide annual reports on their recovery audit efforts, along with improper payment reporting detailed in an appendix to their PAR. Specifically, OMB’s implementing guidance requires that agencies include in the PAR: a general description and evaluation of the steps taken to carry out a recovery auditing program; the total cost of the agency’s recovery auditing program; the total amount of contracts subject to review, the actual amount of contracts reviewed, the amounts identified for recovery, and the amounts actually recovered in the current year; a corrective action plan to address the root causes of payment error; a general description and evaluation of any management improvement program carried out; and a description and justification of the classes of contracts excluded from recovery auditing review by the agency head. For the first 3 years of IPIA implementation—fiscal years 2004 through 2006—both agencies performed various procedures to conduct their risk assessments. Many of these procedures are positive steps to address the requirements of IPIA. At the same time, we identified numerous deficiencies in the procedures that warrant further improvement. Specifically, we found that both agencies lacked a systematic method to determine if risk of improper payments existed in their programs or activities, what those risks were, or the potential or actual impact of those risks on operations. For example, USAID and NASA had not developed a standardized process to evaluate the results of their reviews, such as weighting and scoring the results of risk conditions to determine susceptibility. As such, the various procedures performed did not provide meaningful results or may not have adequately depicted the agencies’ risk of improper payments. In addition, we noted USAID and NASA had not assessed the effectiveness of internal controls relied upon and weaknesses existed in payment reviews performed at the agency component level. Furthermore, risk assessment documentation maintained by USAID and NASA was lacking or insufficient to support their conclusions that no programs or activities were susceptible to significant improper payments. Fiscal year 2004 marked the first year in which all executive branch agencies were required to report improper payment information in their PARs under IPIA. Both USAID and NASA conducted a review of their payment streams as part of their risk assessment process to identify significant improper payments. OMB’s implementing guidance includes a broad definition of programs and activities subject to IPIA, which encompasses a review of payment activities. We found during our review of fiscal year 2006 PARs that agencies generally used one of two approaches to conduct their risk assessments—a review of program operations or a review of payment streams. Although agencies are allowed under OMB’s implementing guidance to determine their program and activity inventory for the purposes of performing a risk assessment, the two approaches can produce different results. In particular, a review of payment streams identifies the susceptibility of improper payments for specific payment types that could relate to multiple programs within an organization. On the other hand, a review of distinct programs would identify the susceptibility of improper payments for the different payment types included in a particular program. Depending on the volume and dollar amount of payments or size of a program, an agency could determine based on OMB’s current definition of significant improper payments—exceeding $10 million and 2.5 percent of program payments— that it had significant improper payments using one approach but not with the other, greatly impacting its risk assessment results. Implementing a payment stream approach, USAID and NASA did not identify any risk-susceptible programs or activities for fiscal year 2004. This continued into fiscal year 2005 for both agencies. For fiscal year 2006, USAID identified two high-risk payment streams as part of its risk assessment—cash transfers and contracts, grants, and cooperative agreements. However, the identification of these two payment streams did not result from a systematic process in place to identify high-risk programs, but rather was due to the high ratio of disbursements for these two payment streams to total agency outlays (about 77 percent for fiscal year 2006). On the other hand, NASA continued to assert for fiscal year 2006 that it had no programs susceptible to significant improper payments although it did not perform a risk assessment for that year. The following is a description of USAID’s and NASA’s risk assessment processes for fiscal years 2004 through 2006. Details of the weaknesses we identified in these processes are included later in this section. At USAID, the Cash Management and Payment (CMP) division within the Office of the Chief Financial Officer (OCFO) has the responsibility of executing and meeting the requirements of IPIA for the agency. For fiscal year 2004, CMP identified a universe of 11 payment streams totaling about $7.6 billion as part of its IPIA risk assessment. See appendix II for a description of each payment stream. For fiscal year 2004, these payment streams consisted of program, operating, and other fund disbursements made from headquarters and its 38 accounting stations that conduct cash management activities for approximately 70 mission offices located overseas. Two of the 11 payment streams—cash transfers and contracts, grants, and cooperative agreements—totaled $6.8 billion, or 90 percent of total outlays. USAID’s payment streams are shown in figure 1. USAID’s risk assessment for fiscal year 2004 consisted of a two-pronged review—payments made from headquarters and payments from the 38 mission accounting stations. According to USAID, approximately 75 percent of payments are made at headquarters and 25 percent from the mission offices. For the headquarters’ risk assessment, USAID stated it performed a review of all 11 payment streams; however, it did not perform any risk assessment procedures for two of the payment streams—training and transportation—because each of these payment streams’ total outlays did not exceed $10 million, and therefore, would not have met OMB’s dual criteria for estimating and reporting improper payments.