Our work over the past several years has demonstrated that improper payments are a long-standing, widespread, and significant problem in the federal government. In December 2007, we reported on DOD’s fiscal year 2006 travel program improper payment estimates. We found that (1) the improper payment estimate was understated by at least $4 million, (2) several weaknesses in DOD’s sampling methodology did not result in statistically valid estimates of travel improper payments at the component level, and (3) limited guidance and oversight by the Office of the Comptroller contributed to the unreliable assessment of improper payments for the travel program. The DOD OIG also has issued reports for the past few years highlighting weaknesses in the department’s efforts to report on improper payment information. The DOD OIG reported that the department had not implemented guidance to address the use of valid statistical sampling in determining programs and activities susceptible to significant improper payments. In January 2008, it reported that DFAS had not conducted adequate research to determine if contractor refunds were improper and, in some cases, had not reported improper payments associated with these refunds. The DOD OIG continues to report that the department has not fully complied with the requirements of IPIA and OMB’s implementing guidance and does not have adequate controls to fully implement a recovery audit program. Guidance for reporting under IPIA and the Recovery Auditing Act is provided in Appendix C of OMB Circular No. A-123. IPIA requires agencies to perform four key steps in meeting the improper payment reporting requirements as shown in figure 1. OMB’s implementing guidance instructs agencies to carry out the four key steps under IPIA, with one exception. For the first step—perform a risk assessment—OMB guidance allows agency programs deemed not risk- susceptible to conduct a risk assessment generally every 3 years. Further, agencies need not conduct formal risk assessments for those programs in which improper payment baselines are already established, are in the process of being measured, or will be measured by an established date. However, OMB guidance does state that if a program experiences a significant change in legislation, a significant increase in funding level, or both, agencies are required to reassess the program’s risk susceptibility during the next annual cycle, even if it is less than 3 years from the last assessment. As we have previously testified before your Subcommittee this is inconsistent with the express terms of IPIA, which require that agencies annually review all of their programs and activities. OMB then requires that agencies estimate the gross total of both over- and underpayments for those programs and activities identified as susceptible. These estimates shall be based on a statistically random sample of sufficient size to yield an estimate with a 90 percent confidence interval of plus or minus 2.5 percentage points. If an agency cannot determine whether a payment was proper because of insufficient documentation, Appendix C to OMB Circular No. A-123 requires that the payment be considered improper. The guidance further requires that agencies develop corrective action plans that include a discussion of the causes of the improper payments identified, corrective actions taken for each different type or cause of error, and the results of actions taken to address those causes. In addition, OMB Circular No. A-136, Financial Reporting Requirements requires agencies to report, in table format, improper payment estimates and related outlay amounts for the prior year, current year, and the following 3 years. As part of this reporting, OMB encourages agencies to report underpayment and overpayment amounts, if available. The Recovery Auditing Act requires each executive branch agency that annually enters into contracts with a total value of $500 million or more to use recovery audits and recovery activities as part of a cost-effective recovery auditing program. The law authorizes federal agencies to retain recovered funds to cover actual administrative expenses as well as to pay other contractors, such as collection agencies. OMB guidance requires, among other things, that agencies include in their annual reporting a general description and evaluation of the steps taken to carry out a recovery auditing program, the total amount of contracts subject to review, the actual amount of contracts reviewed, the amounts identified for recovery, and the amounts actually recovered in a current year. Further, OMB Circular No. A-136 requires agencies to report cumulative amounts identified for recovery and amounts actually recovered as a part of their current year reporting. The responsibility for assessing and reporting DOD’s improper payments information rests with the Office of the Under Secretary of Defense (Comptroller) (Office of the Comptroller). The Accounting and Finance Policy Directorate within the Office of the Comptroller is responsible for carrying out the day-to-day activities involved in meeting IPIA requirements. To collect improper payment information including risk assessments, improper payment estimates, and corrective actions, the Accounting and Finance Policy Directorate sends out an improper payment survey (IPIA survey) to all DOD agencies and military services requesting improper payment information for the current fiscal year (see app. II for a list of the 33 agencies and military services). The agencies and services are required to submit improper payment estimates to the Accounting and Finance Policy Directorate for all DOD payment activities identified under IPIA. The Accounting and Finance Policy Directorate then aggregates and reports the improper payment information in DOD’s annual AFR. Since implementation of IPIA, DOD has reported improper payment estimates for the following payment activities for fiscal years 2004-2008 as shown in table 1 below. Similarly to improper payment reporting, the Office of the Comptroller is responsible for identifying and annually reporting recovery audit information in DOD’s AFR, while its Accounting and Finance Policy Directorate is responsible for carrying out the day-to-day activities. DOD’s recovery auditing process over contract and vendor payments (commercial payments) encompasses several organizations including DFAS offices and external contractors, which are discussed later in this report. These organizations are required to compile and submit the universe of commercial payments, commercial overpayments identified for recovery, and commercial payments actually recovered to the Accounting and Finance Policy Directorate. It in turn aggregates and reports the recovery audit information in DOD’s annual AFR. DOD’s reported recovery audit information for fiscal years 2004-2008 is shown in table 2 below. DOD’s processes to conduct risk assessments, estimate improper payments, and develop corrective actions to reduce improper payments for its fiscal year 2007 IPIA reporting had significant weaknesses. A lack of detailed guidance as well as inadequate monitoring and oversight of DOD’s improper payment activities also existed, raising doubts about the accuracy of the information reported. DOD’s risk assessment process was inadequate to ensure that appropriate consideration was given to the risks associated with its payment activities, thus not allowing management appropriate visibility of its vulnerabilities. DOD lacked detailed guidance on how to conduct a risk assessment, including identifying the universe of activities, determining if risks exist, identifying what those risks are, and evaluating the results, as required by our internal control standards. Recognizing that the internal guidance and documentation needed to be improved, in December 2008, DOD issued a new Financial Management Regulation (FMR) chapter—Volume 4, Chapter 14, Improper Payments—to expand existing guidance to address IPIA requirements, by clarifying the agencies’ and military services’ responsibilities for reporting improper payment information, broken down by payment activity. Although we did not determine the adequacy of these changes as the scope of our audit was fiscal year 2007, we noted that DOD did not require its agencies and military services to document their risk methodologies, including risk factors considered, the potential or actual impact on their program operations, and the rationale for assessing risk as either low, medium, or high. While nine DOD components conducted risk assessments for their six payment activities totaling about $493 billion in fiscal year 2007, we found an additional $322 billion in outlays reported in DOD’s Statement of Budgetary Resources (SBR) that had not been assessed although IPIA requires that agencies annually review all programs and activities (see fig. 2). According to Office of the Comptroller officials, the six payment activities it assessed covered all DOD outlays for fiscal year 2007 and the $322 billion difference in outlays represented IPIA reporting differences related to payroll payments for three of its six payment activities (net outlays reported for IPIA purposes versus gross outlays reported for SBR purposes), intragovernmental payments, and payments resulting from classified activities. While DOD officials stated that it reconciled the $322 billion difference to the SBR (with the exception of classified activities), these officials did not provide us with this reconciliation to enable us to independently substantiate this difference. Further, these officials could not reconcile the $493 billion in outlays for the six payment activities to an alternative source, such as the SBR. Based on this comparison, DOD had not reviewed all of its programs and activities. Office of the Comptroller officials told us that DOD agencies and the military services were required to reconcile their payment activities with their budget data for fiscal year 2008 to ensure that all payment activities had been accounted for at the component level. In addition, DOD did not have sufficient documentation to support the level of assessed risk for the six payment activities it did evaluate as required by OMB guidance and our internal control standards. For example, none of the nine components that conducted risk assessments described their methodology or rationale for the level of risk assigned to each applicable payment activity. For the six risk assessments conducted, DOD had determined the risk of having significant improper payments was low, based on OMB criteria. However, given the lack of supporting documentation and evidence for the risk assessments and DOD’s history of long-standing weaknesses, including GAO’s designation of eight individual DOD areas as high risk, the low risk levels are not based on sufficient analysis and are likely unrealistic and not reflective of the wide range of vulnerabilities that exist within DOD.