Background In November 2002, Congress passed and the President signed the  Improper Payments Information Act of 2002 (IPIA), which was later  amended by IPERA and the Improper Payments Elimination and  Recovery Improvement Act of 2012 (IPERIA). The amended legislation  requires executive branch agencies to (1) review all programs and  activities and identify those that may be susceptible to significant  improper payments (commonly referred to as a risk assessment),   (2) publish improper payment estimates for those programs and activities  that the agency identified as being susceptible to significant improper  payments, (3) implement corrective actions to reduce improper payments  and set reduction targets, and (4) report on the results of addressing the  foregoing requirements. In addition to the agencies’ identifying programs and activities that are  susceptible to significant improper payments, OMB designates as high  priority the programs with the most egregious cases of improper  payments. Specifically, under a provision added to IPIA by IPERIA, OMB  is required to annually identify a list of high-priority federal programs in  need of greater oversight and review. In general, for fiscal years 2014  through 2017, OMB implemented this requirement by designating high- priority programs based on a threshold of $750 million in estimated  improper payments for a given fiscal year. OMB also plays a key role in  implementing laws related to improper payment reporting. Specifically,  OMB is directed by statute to provide guidance to federal agencies on  estimating, reporting, reducing, and recovering improper payments. IPERA also requires executive agencies’ IGs to annually determine and  report on whether their respective agencies complied with certain IPERA- related criteria. If an agency does not meet one or more of the six IPERA  criteria for any of its programs or activities, the agency is considered  noncompliant overall. The six criteria are as follows:  1.  publish a report in the form and content required by OMB—typically  an agency financial report (AFR) or a performance and accountability  report (PAR)—for the most recent fiscal year, and post that report on  the agency website;  2.  conduct a program-specific risk assessment, if required, for each  program or activity that conforms with IPIA as amended;  3.  publish improper payment estimates for all programs and activities  deemed susceptible to significant improper payments under the  agency’s risk assessments;  4.  publish corrective action plans for those programs and activities  assessed to be at risk for significant improper payments;  5.  publish and meet annual reduction targets for all programs and  activities assessed to be at risk for significant improper payments; and  6.  report a gross improper payment rate of less than 10 percent for  each program and activity for which an improper payment estimate  was published. Under IPERA, agencies reported by their IG as not in compliance with  any of these criteria in a fiscal year are required to submit a plan to  Congress describing the actions they will take to come into compliance,  and such plans shall include measureable milestones, the designation of  senior accountable officials, and the establishment of accountability  mechanisms to achieve compliance. OMB guidance states that agencies  are required to submit these plans to Congress and OMB in the first year  of reported noncompliance. When agency programs are reported as noncompliant for consecutive  years, IPERA and OMB guidance requires agencies and OMB to take  additional actions. Specifically, an agency with a program reported as  noncompliant for 3 or more consecutive years is required to submit to  Congress within 30 days of the IG’s report either (1) a reauthorization  proposal for the program or (2) the proposed statutory changes  necessary to bring the program or activity into compliance. We  previously recommended that when agencies determine that  reauthorization or statutory changes are not necessary to bring the  programs into compliance, the agencies should state so in their  notifications to Congress. Effective starting with fiscal year 2018  reporting, OMB updated its guidance to instruct agencies with programs  reported as noncompliant for 3 consecutive years to explain what the  agency is doing to achieve compliance if a reauthorization proposal or  proposed statutory change will not bring a program into compliance with  IPERA. The updated guidance also instructs agencies with programs  reported as noncompliant for 4 or more consecutive years to submit a  report to Congress and OMB (within 30 days of the IG’s determination of  noncompliance) detailing the activities taken and still being pursued to  prevent and reduce improper payments. If agency programs are reported as noncompliant under IPERA for 2  consecutive years, and the Director of OMB determines that additional  funding would help the agency come into compliance, the head of the  agency must obligate additional funding in the amount determined by the  Director to intensify compliance efforts. IPERA directs the agency to  exercise any reprogramming or transfer authority that the agency may  have to provide additional funding to meet the level determined by OMB  and, if necessary, submit a request to Congress for additional  reprogramming or transfer authority to meet the full level of funding  determined by OMB. Table 1 summarizes agency and OMB requirements  related to agency programs that are noncompliant under IPERA, as  reported by their IGs. Over Half of the CFO  Act Agencies Were  Reported as  Noncompliant under  IPERA for Fiscal  Years 2016 and 2017,  and Consecutive  Years of  Noncompliance  Continue for Certain  Programs Over Half of the Agencies  Were Reported as  Noncompliant for Fiscal  Years 2016 and 2017 Seven years after the initial implementation of IPERA, over half of the 24  CFO Act agencies were reported as noncompliant by their IGs for fiscal  years 2016 and 2017. Specifically, 13 agencies were reported as  noncompliant with one or more IPERA criteria for fiscal year 2016, and 14  agencies were reported as noncompliant for fiscal year 2017 (see fig. 1).  Nine of these agencies have been reported as noncompliant in one or  more programs every year since IPERA was implemented in 2011 (see  app. II for additional details on CFO Act agencies’ compliance under  IPERA for fiscal years 2011 through 2017, as reported by their IGs). Although the number of agencies reported as noncompliant under IPERA  has varied slightly since fiscal year 2011, the total instances of  noncompliance for all six criteria substantially improved after fiscal year  2011, when IPERA was first implemented. As shown in figure 2, the total  instances decreased from 38 instances (for 14 noncompliant agencies)  for fiscal year 2011 to 26 instances (for 14 noncompliant agencies) for  fiscal year 2017. Also, for fiscal year 2017, 7 of 14 agencies were reported as  noncompliant for only one criterion per noncompliant program. Of these, 6  agencies—the Departments of Homeland Security (DHS), Education  (Education), Commerce, and Transportation; the General Services  Administration; and the Social Security Administration (SSA)—were only  reported as noncompliant with the IPERA criterion that requires agencies  to publish and meet reduction targets. In addition, the Department of the  Treasury (Treasury) was only reported as noncompliant with the IPERA  criterion that requires agencies to report improper payment rates below  10 percent. Furthermore, the programs reported as noncompliant for fiscal year 2017  accounted for a significantly smaller portion of the total reported  estimated improper payments as compared to the noncompliant  programs for fiscal year 2015. Specifically, we previously reported that 52  noncompliant programs accounted for $132 billion (or about 96 percent)  of the $137 billion total reported estimated improper payments for fiscal  year 2015, whereas 58 noncompliant programs accounted for $80 billion  (or about 57 percent) of the $141 billion total reported estimated improper  payments for fiscal year 2017. Although improper payment estimates  associated with noncompliant programs vary from year to year, this  decrease (approximately $52 billion) was primarily due to two programs.  Specifically, the Department of Health and Human Services’ (HHS)  Medicare Fee-for-Service (Parts A and B) and Medicare Part C programs  were reported as noncompliant and accounted for approximately   $43 billion and $14 billion, respectively, of estimated improper payments  for fiscal year 2015. These programs were reported as compliant for fiscal  year 2017 and accounted for approximately $36 billion and $14 billion,  respectively, or about 36 percent of the $141 billion total reported  improper payments for fiscal year 2017. Certain Programs  Continue to Be Reported  as Noncompliant for  Consecutive Years Almost a third (18 programs) of the 58 programs that contributed to 14  CFO Act agencies’ noncompliance under IPERA, as of fiscal year 2017,  were reported as noncompliant for 3 or more consecutive years. The  number of programs noncompliant for 3 or more consecutive years has  continually increased since fiscal year 2015, as shown in figure 3.  Specifically, 12 programs (associated with 7 agencies) were reported as  noncompliant for 3 or more consecutive years, as of fiscal year 2015, and  the number increased to 14 programs (associated with 8 agencies) and  18 programs (associated with 9 agencies), as of fiscal years 2016 and  2017, respectively. These programs accounted for a substantial portion of the $141 billion  total estimated improper payments for fiscal year 2017. As shown in table  2, 14 of the 18 programs that were reported as noncompliant for 3 or  more consecutive years reported improper payment estimates that  accounted for an estimated $74.4 billion (about 53 percent) of the   $141 billion, while the other 4 programs did not report improper payment  estimates for fiscal year 2017 and were reported by their respective IGs  as noncompliant with the IPERA criterion to publish improper payment  estimates. The $74.4 billion is primarily composed of estimates reported  for 2 noncompliant programs—HHS’s Medicaid program ($36.7 billion)  and Treasury’s Earned Income Tax Credit program ($16.2 billion)— totaling $52.9 billion (or approximately 71 percent of the $74.4 billion).  Improper payments associated with these two noncompliant programs  are also a central part of two areas included in our 2017 High-Risk List,  which includes federal programs and operations that are especially  vulnerable to waste, fraud, abuse, and mismanagement, or that need  transformative change. Eight of the 18 noncompliant programs have been reported as  noncompliant since the implementation of IPERA in fiscal year 2011, for a  total of 7 consecutive years, as shown in table 2. Reported compliance for  Treasury’s Earned Income Tax Credit improved from being reported as  noncompliant with multiple IPERA criteria in fiscal year 2013 to  noncompliance with only one criterion for the last 4 years (fiscal years  2014 through 2017). CFO Act Agencies  Did Not Always Notify  Congress, and They  Provided Varying  Information on  Programs Reported  as Noncompliant for 3  or More Consecutive  Years Eight CFO Act agencies’ programs were reported as noncompliant under  IPERA for 3 or more consecutive years, as of fiscal year 2016. Three of  these agencies did not notify Congress of their program’s continued  noncompliance as required. In addition to submitting the required  notifications for their noncompliant programs, the other five agencies also  included additional information in their notifications—such as measurable  milestones, designation of senior officials, and accountability  mechanisms—useful for assessing their efforts to achieve compliance. In  June 2018, OMB updated its guidance to clarify agency reporting  requirements for each consecutive year a program is reported as  noncompliant. However, OMB’s updated guidance did not direct agencies  to include other types of quality information in their notifications for  programs reported as noncompliant for 3 or more consecutive years that  could help Congress to more effectively assess their efforts to address  long-standing challenges and other issues affecting these programs and  to achieve compliance. CFO Act Agencies with  Programs Reported as  Noncompliant for 3 or  More Consecutive Years  Did Not Always Notify  Congress Of the eight agencies with programs reported as noncompliant under  IPERA for 3 or more consecutive years as of fiscal year 2016, we found  that five agencies notified Congress of their noncompliance as required.  Specifically, the Department of Defense (DOD), Education, HHS, DHS,  and SSA notified Congress of their programs’ reported noncompliance for  3 or more consecutive years as of fiscal year 2016 as required by IPERA  and OMB guidance. The remaining three agencies—the U.S. Department  of Agriculture (USDA), the Department of Labor (DOL), and Treasury— did not notify Congress as required. Additional information regarding the three agencies that did not submit  their required notifications to Congress is summarized below: USDA: In May 2017, the USDA IG reported that four USDA Food and  Nutrition Service programs—Child and Adult Care Food Program;  National School Lunch Program; School Breakfast Program; and  Special Supplemental Nutrition Program for Women, Infants, and  Children—had been noncompliant for 6 consecutive years, as of fiscal  year 2016. However, USDA has not notified Congress of these  programs’ continued noncompliance with IPERA as of fiscal year  2016, despite prior recommendations that we, and the USDA IG,  made to USDA to do so. USDA staff stated in May 2018 that USDA  drafted, but had not submitted, a letter to Congress regarding these  programs’ noncompliance. DOL: In June 2017, the DOL IG reported that the Unemployment  Insurance Benefit program had been noncompliant for 6 consecutive  years, as of fiscal year 2016. In October 2016, DOL included  proposed legislation in its last notification to Congress regarding this  program, approximately 8 months prior to the DOL IG’s IPERA  compliance report. However, because the requirement for agencies to  notify Congress is triggered by IG reporting of programs that are  noncompliant for 3 or more consecutive years, DOL should have also  notified Congress regarding the program’s continued noncompliance  in fiscal year 2016 after the IG’s report was issued in June 2017. DOL  staff stated in August 2018 that the proposed legislation included in its  October 2016 notification had not been enacted and that DOL is  currently working to develop a new report to Congress and OMB  detailing corrective actions taken to bring the program into  compliance. Treasury: In May 2017, the Treasury IG reported that the Earned  Income Tax Credit (EITC) program had been noncompliant for 6  consecutive years, as of fiscal year 2016. We previously reported that  Treasury submitted proposed statutory changes to Congress for this  program in August 2014 and in June 2015. As stated in the Treasury  IG’s fiscal year 2016 IPERA compliance report, the proposed statutory  changes would help prevent the improper issuance of billions of  dollars in refunds as it would provide the Internal Revenue Service  (IRS) with expanded authority to systematically correct erroneous  claims that are identified when tax returns are processed and allow  IRS to deny erroneous EITC refund claims before they are paid.  Further, Treasury stated that IRS has repeatedly requested authority  to correct such errors in subsequent fiscal year budgets, including its  fiscal year 2019 budget submission. In June 2018, Treasury staff  stated that the Consolidated Appropriations Act, 2016 provided IRS  with additional tools for reducing EITC improper payments; however,  the act did not expand IRS’s authority to systematically correct the  erroneous claims that are identified when tax returns are processed. Treasury staff also stated that the department has continued to  coordinate with OMB on required reporting for the EITC program  because of the program’s complexity, and that OMB has not  requested additional actions or documentation regarding the  program’s noncompliance. Although continued coordination with OMB  is important, Treasury did not notify Congress regarding the EITC  program’s continued noncompliance as required. In summary, despite reporting requirements in IPERA and OMB  guidance, one agency (USDA) has not notified Congress about four  programs being reported as noncompliant for 6 consecutive years, as of  fiscal year 2016. The remaining two agencies (DOL and Treasury) that  did not notify Congress of their programs’ consecutive noncompliance, as  of fiscal year 2016, submitted notifications to Congress prior to their  respective IGs’ fiscal year 2016 compliance results. However, IPERA  requires agencies to notify Congress when programs are reported as  noncompliant for more than 3 consecutive years and thus DOL and  Treasury should have also notified Congress about their programs’ being  reported as noncompliant for 6 consecutive years, as of fiscal year 2016. It is important that agencies continue to notify Congress of their programs’  consecutive noncompliance each year after the third consecutive year as  the information related to their proposals or regarding their IPERA  compliance efforts included in prior years’ notifications to Congress may  significantly change over time. Unless agencies continue to notify  Congress in subsequent years, Congress may lack the current and  relevant information needed to effectively assess agencies’ proposals or  monitor their efforts to address problematic programs in a timely manner.  OMB updated its guidance in June 2018 to provide more clarity regarding  the notification requirements for each consecutive year a program is  reported as noncompliant. Effective implementation of this guidance may  help ensure that agencies consistently provide required information to  Congress on these programs in future years. Certain Agencies Provided  Additional Quality  Information on IPERA  Compliance Efforts in  Their Notifications to  Congress We found that the five agencies—DOD, DHS, Education, HHS, and  SSA—that notified Congress regarding their programs’ reported  noncompliance for 3 or more consecutive years, as of fiscal year 2016,  also included additional information about their efforts to achieve IPERA  compliance. Although IPERA does not specifically require that agency  proposals for reauthorization or other statutory change provide such  information, including it could help Congress to better assess the  agencies’ proposals included in these notifications and to oversee agency  efforts to address long-standing challenges and compliance issues  associated with these programs. In many instances, the types of additional information provided by these  agencies are similar to information that agencies are required to provide  to Congress or OMB in other required notifications or other reports, such  as annual AFRs or PARs. For example, all improper payment estimates  reported under IPIA, as amended, must be accompanied by information  on what the agency is doing to reduce improper payments, including a  description of root causes and the steps the agency has taken to ensure  accountability. Further, IPERA and OMB guidance require agencies to  provide corrective action plans to Congress for programs reported as  noncompliant for 1 year. Such plans should include actions planned or  taken to address the program’s noncompliance, measurable milestones,  a senior official designated to oversee progress, and the accountability  mechanisms in place to hold the senior official accountable. In addition, GAO’s Standards for Internal Control in the Federal  Government emphasizes the importance of communicating quality  information, such as significant matters related to risks, changes, or  issues affecting agencies’ efforts to achieve compliance objectives, to  external parties—such as legislators, oversight bodies, and the general  public. Furthermore, in our fiscal year 2017 High-Risk Update, we also  highlight the importance of these types of information when assessing  agency efforts to address issues associated with programs included on  our High-Risk List. Examples of such information include (1) action  plans that are accessible and transparent with clear milestones and  metrics, including established goals and performance measures to  address identified root causes; (2) leadership commitment of top (or  senior) officials to establish long-term priorities and goals and continued  oversight and accountability; (3) monitoring progress against goals,  assessing program performance, or reporting potential risks; and   (4) demonstrated progress, through recommendations implemented,  actions taken for improvement, and effectively addressing identified root  causes and managing high-risk issues. Table 3 summarizes the types of additional information described above  that the five agencies provided in their fiscal year 2016 notifications to  Congress to address programs with 3 or more consecutive years of  noncompliance. All five agencies informed Congress of (1) root causes  that directly lead to improper payments or hindered the program’s ability  to achieve compliance; (2) certain risks, significant changes, or issues  affecting their efforts; and (3) their corrective actions or strategies to  achieve compliance. Three of the five agencies—DOD, Education, and  DHS—also included the other types of additional information described  above in their notifications, including measurable milestones, designated  senior officials to oversee progress, and accountability mechanisms  established to help achieve compliance. For example, all three agencies  designated their chief financial officers (CFO) to oversee progress toward  achieving measurable milestones and expanded their official roles and  responsibilities to hold them accountable. Education and DHS stated that  these responsibilities were added to their respective CFOs’ individual  performance plans. Although OMB updated its guidance in June 2018 to clarify agency  reporting requirements related to programs reported as noncompliant for  3 or more consecutive years, the updated guidance did not direct  agencies to include other types of quality information in their notifications,  such as those described above. In addition, information related to  measurable milestones, corrective actions, risks, issues, or other items  affecting agencies’ efforts may change significantly over time. With this  additional information, Congress could have more complete information to  effectively oversee agency efforts to address long-standing challenges  and other issues that have contributed to programs being reported as  noncompliant for 3 or more consecutive years. OMB Updated  Guidance for  Determining  Additional Funding  Needs for Programs  Reported as  Noncompliant for 2  Consecutive Years Fifteen programs in seven agencies and 12 programs in six agencies  were reported as noncompliant for 2 consecutive years as of fiscal years  2016 and 2017, respectively. For agencies reported as noncompliant  under IPERA for 2 consecutive years for the same program, IPERA gives  the Director of OMB the authority to determine whether additional funding  would help the agencies come into compliance. If the OMB Director  determines that such funding would help, the agency is required to use  any available reprogramming or transfer authority to meet the funding  level that the OMB Director specified and, if such authorities are not  sufficient, submit a request to Congress for additional reprogramming or  transfer authority. According to OMB staff, OMB determined that no  additional funding was needed for programs reported as noncompliant for  2 consecutive years as of fiscal year 2016. As of September 2018, OMB  was in the process of making funding determinations for 12 programs that  were reported as noncompliant as of fiscal year 2017 and stated that any  determinations made would be developed in the President’s Budget for  fiscal year 2020. The 12 programs reported as noncompliant for 2 consecutive years, as of  fiscal year 2017, accounted for approximately $3 billion (2 percent) of the  $141 billion total improper payment estimate for that year. Of these 12  programs, more than half (or 7 of the 12) were attributable to DOD;  however, Education’s Pell Grant program accounted for $2.2 billion (or 74  percent) of the $3 billion in improper payment estimates for programs  reported as noncompliant programs for 2 consecutive years, for fiscal  year 2017. In addition, as shown in table 4, the 12 programs reported as  noncompliant for 2 consecutive years, as of fiscal year 2017, were  primarily noncompliant with the IPERA criteria that required agencies to  publish information in their PAR or AFR or publish and meet reduction  targets. As noted previously, IPERA gives OMB authority to determine whether  additional funding for intensified compliance efforts would help the agency  come into compliance under IPERA. Therefore, an established process  for making timely, well-informed funding determinations is an essential  part of ensuring that agencies have sufficient resources and take steps to  intensify their compliance efforts in a timely manner. In April 2018, OMB  staff stated that when making funding determinations, they primarily rely  on the IGs’ recommendations in their annual IPERA compliance reports.  OMB staff also stated that for its fiscal year 2016 determinations, OMB  determined that additional funding was not needed because the IGs’  recommendations did not specify that additional funding was needed to  help resolve the programs’ noncompliance. The IGs’ annual reports provide information on agencies’ IPERA  compliance and may be useful to OMB as a tool to help them make  determinations for additional funding. However, IPERA does not require  IGs to address funding levels in their annual compliance reports, and  OMB’s guidance does not inform the IGs that their work might be relied  upon in this manner. We reviewed the IGs’ fiscal years 2016 and 2017  IPERA compliance reports for the agencies with programs reported as  noncompliant for 2 consecutive years and found that the IGs did not make  any recommendations regarding additional funding needed to bring these  programs into compliance. In addition, as specifically stated by the IGs for  Education and USDA in their IPERA reports, OMB has the statutory  responsibility to make these funding determinations. Education IG’s fiscal  year 2017 IPERA compliance report stated that “If OMB recommends that  the Department needs additional funding or should take any other actions  to become compliant with IPERA, we recommend that the Department  implement OMB’s recommendations.” Also, the USDA IG’s fiscal year  2016 IPERA compliance report stated, “For agencies that are not  compliant for 2 consecutive years for the same program, the Director of  OMB will determine if additional funding would help these programs come  into compliance.” As a result, OMB’s reliance on IG recommendations as  the source of information to support additional funding determinations  may not provide sufficient information to effectively assess agencies’  funding needs to address noncompliance. OMB staff subsequently stated that they no longer need to conduct a  detailed review of the IGs’ IPERA compliance reports to identify  recommendations related to additional funding needs. Instead, OMB  Memorandum M-18-20, issued in June 2018, updated OMB Circular No.  A-123, Appendix C, and clarified that the funding determination process  will unfold as part of the annual development of the President’s Budget,  as described in OMB Circular No. A-11. This updated guidance also  directs agencies to submit proposals to OMB regarding additional funding  needs that may help them address IPERA noncompliance. To illustrate, under this new guidance, the IGs’ fiscal year 2018 IPERA  compliance reports will be due in May 2019, and any funding needs to  address noncompliance would be incorporated in the next annual budget  preparation process, the results of which are due to be submitted to  Congress in February 2020 for the President’s Budget for fiscal year  2021. Once OMB’s determinations have been made and communicated  to agencies, agencies would respond by performing the required  reprogramming and making transfers under existing authority, where  available. Any requests for additional transfer authority may be  incorporated into subsequent appropriations legislation. Conclusions Estimated improper payments reported government-wide total almost  $1.4 trillion from fiscal year 2003 through fiscal year 2017. The number of  programs reported as noncompliant under IPERA for 3 or more  consecutive years has continued to increase, from 12 programs  (associated with 7 agencies) to 18 programs (associated with 9 agencies)  as of fiscal years 2015 and 2017, respectively. Including additional useful,  up-to-date information—such as measurable milestones, risks, or other  issues affecting agency efforts to achieve compliance—in notifications to  Congress, which are required when programs are reported as  noncompliant for 3 or more consecutive years, could help Congress  better assess agency efforts to address long-standing challenges and  other issues associated with them. Although certain agencies included  certain types of additional information in their notifications as of fiscal year  2016, OMB guidance does not require agencies to include such  information in their notifications. As a result, Congress may lack sufficient  information to effectively oversee agency efforts and take prompt action  to help address long-standing challenges or other issues associated with  these programs. Recommendation for  Executive Action The Director of OMB should take steps to update OMB guidance to  specify other types of quality information that agencies with programs  noncompliant for 3 or more consecutive years should include in their  notifications to Congress, such as significant matters related to risks,  issues, root causes, measurable milestones, designated senior officials,  accountability mechanisms, and corrective actions or strategies planned  or taken by agencies to achieve compliance. (Recommendation 1) Agency Comments  and Our Evaluation We provided a draft of this report to OMB and requested comments, and  OMB said that it had no comments. We also provided a draft of this report  to the 24 CFO Act agencies and their IGs and requested comments. We  received letters from the DHS Office of Inspector General (OIG), SSA,  and the United States Agency for International Development. These  letters are reproduced in appendixes V through VII. We also received  technical comments from DOL, the Department of Veterans Affairs, the  General Services Administration, HHS, the Department of Housing and  Urban Development, and the Treasury OIG, which we incorporated in the  report as appropriate. The remaining agencies and OIGs either did not  provide comments or notified us via email that they had no comments. In its comments, SSA stated that it provided information to Congress on  measurable milestones, designated senior officials, and accountability  mechanisms in its AFR. In the report, we acknowledge that these types of  additional information are similar to information that agencies are required  to provide to Congress or OMB in other reports, such as annual AFRs.  However, our analysis was based on SSA’s fiscal year 2016 notifications  to Congress for programs reported as noncompliant under IPERA, in  which this specific information was not reported. As such, we continue to  believe that OMB should take steps to update OMB guidance to help  ensure that agencies report such significant information and include it in  their notifications to Congress. We are sending copies of this report to the appropriate congressional  committees, the Director of the Office of Management and Budget, and  other interested parties. In addition, the report is available at no charge on  the GAO website at http://www.gao.gov. If you or your staff have any questions on matters discussed in this report,  please contact me at (202) 512-2623 or davisbh@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this report. GAO staff who made key  contributions to this report are listed in appendix VIII. Appendix I: Objectives, Scope, and  Methodology Our objectives were to determine the following:  1.  The extent to which the 24 agencies listed in the Chief Financial  Officers Act of 1990, as amended (CFO Act), complied with the six  criteria listed in the Improper Payments Elimination and Recovery Act  of 2010 (IPERA), for fiscal years 2016 and 2017, and the trends  evident since 2011, as reported by their inspectors general (IG).  2.  The extent to which CFO Act agencies addressed requirements for  programs and activities reported as noncompliant with IPERA criteria  for 3 or more consecutive years, as of fiscal year 2016, and  communicated their strategies to Congress for reducing improper  payments and achieving compliance.  3.  The extent to which the Office of Management and Budget (OMB)  made determinations regarding whether additional funding would help  CFO Act programs and activities reported as noncompliant with  IPERA criteria for 2 consecutive years, as of fiscal years 2016 and  2017, come into compliance. Although the responsibility for complying with provisions of improper  payment-related statutes rests with the head of each executive agency,  we focused on the 24 agencies listed in the CFO Act because estimates  of their improper payments represent over 99 percent of the total reported  estimated improper payments for fiscal years 2016 and 2017. Our work  did not include validating or retesting the data or methodologies that the  IGs used to determine and report compliance. We corroborated all of our  findings with OMB and all 24 CFO Act agencies and IGs. To address our first objective, we identified the requirements that  agencies must meet by reviewing the Improper Payments Information Act  of 2002 (IPIA), IPERA, and OMB guidance. We reviewed the CFO Act  agency IGs’ IPERA compliance reports for fiscal years 2016 and 2017,  which were the most current reports available at the time of our review. We summarized the overall agency and program-specific compliance  determinations with the six IPERA criteria, as reported by the IGs. For  fiscal years 2011 through 2015, we relied on and reviewed prior year  supporting documentation and analyses of CFO Act agencies’ IPERA  compliance, as reported in our prior reports, in order to identify  compliance trends since 2011, as reported by the IGs. Based on these  reports, we summarized the programs and the number of consecutive  years that they were reported as noncompliant. For each IG report that  did not specifically state that the agency had programs noncompliant for  consecutive years, we compared the list of programs reported as  noncompliant for fiscal years 2016 and 2017 to the list of programs  reported as noncompliant for fiscal years 2014 and 2015 in our prior  reports. Lastly, we corroborated our findings with OMB and all 24 CFO  Act agencies and IGs. To address our second objective, we determined if the agencies  responsible for programs and activities reported as noncompliant for 3 or  more consecutive years as of fiscal year 2016 had submitted the required  proposals (reauthorizations or statutory changes) to Congress by  requesting and reviewing documentation of the required submissions and  relevant notifications to Congress obtained from each applicable agency.  Further, we reviewed the content of each agency notification to evaluate  agencies’ efforts to communicate quality information to Congress  concerning their strategies for achieving compliance consistent with  Standards for Internal Control in the Federal Government. Principle 15 of  these standards emphasizes the need for an entity’s management to  communicate necessary quality information, such as significant matters  related to risks, changes, or issues affecting agencies’ efforts, to achieve  compliance objectives, to external parties—such as legislators, oversight  bodies, and the general public. To identify other types of information  useful for this purpose, we reviewed IPIA, as amended; IPERA; and OMB  guidance for information agencies are required to provide to Congress or  OMB in other notifications and reports, such as their corrective action  plans or strategies, measurable milestones, designated senior officials,  and accountability mechanisms for achieving compliance. We also  reviewed information used to assess agency efforts to address issues  associated with programs on our High-Risk List. To determine the extent to which agencies’ notifications to Congress  included these additional types of useful information for their applicable  program(s), we used a data collection instrument to document our  determinations regarding the additional types of quality information  included in each notification. In addition, two GAO analysts independently  reviewed each agency’s notification and documented their determinations  regarding the types of information included in the notifications.  Differences between the analysts’ determinations were identified and  resolved to ensure that the types of additional information were  consistently identified and categorized. We did not evaluate the  sufficiency and completeness of the agency-provided information. Lastly,  we corroborated our findings with the respective agencies and IGs. To address our third objective, we identified provisions in IPIA, IPERA,  and OMB guidance that are applicable to OMB for programs reported as  noncompliant for 2 consecutive years. To determine if OMB made  additional funding determinations for agency programs and activities  reported as noncompliant for 2 consecutive years as of fiscal years 2016  and 2017, we requested relevant information and communications from  OMB and the applicable agencies and IGs. We also interviewed key OMB  staff on their process for determining additional funding needs for  noncompliant programs and activities as of fiscal years 2016 and 2017  and related results. In addition, we reviewed the applicable fiscal years  2016 and 2017 CFO Act agency IG IPERA compliance reports, which  OMB staff stated they relied on for determining whether noncompliant  programs and activities required additional funding. We also asked the  agencies whether they coordinated with OMB regarding their need for  additional funding for programs and activities reported as noncompliant  for 2 consecutive years as of fiscal years 2016 and 2017. Lastly, we  corroborated our findings with OMB and the respective agencies and IGs. We conducted this performance audit from November 2017 to December  2018 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. Appendix II: CFO Act Agencies’ Overall  IPERA Compliance for Fiscal Years 2011  through 2017, as Reported or Acknowledged  by Their IGs Figure 4 details the 24 Chief Financial Officers Act of 1990 (CFO Act)  agencies’ overall compliance under the Improper Payments Elimination  and Recovery Act of 2010 (IPERA), as reported by their inspectors  general, for fiscal years 2011 through 2017. We previously reported on  CFO Act agencies’ overall reported compliance for fiscal years 2011  through 2015. Appendix III: CFO Act Agencies and  Programs Reported as Noncompliant with  IPERA for Fiscal Years 2016 and 2017 Tables 5 and 6 detail the Chief Financial Officers Act of 1990 (CFO Act)  agencies and programs reported by their inspectors general as  noncompliant with the six criteria specified by the Improper Payments  Elimination and Recovery Act of 2010 (IPERA), for fiscal years 2016 and  2017. We previously reported on CFO Act agencies’ reported compliance  with the six IPERA criteria for fiscal year 2015. Appendix IV: CFO Act Agencies with  Programs Reported by Their IGs as  Noncompliant for 2 or More Consecutive  Years, as of Fiscal Years 2016 and 2017 Table 7 details the Chief Financial Officers Act of 1990 (CFO Act)  agencies and programs reported by their inspectors general as  noncompliant under the Improper Payments Elimination and Recovery  Act of 2010 (IPERA) for 2 or more consecutive years, as of fiscal years  2016 and 2017. We previously reported on CFO Act agencies’ reported  compliance for fiscal year 2015. Appendix V: Comments from the Department  of Homeland Security Office of Inspector  General Appendix VI: Comments from the Social  Security Administration Appendix VII: Comments from the United  States Agency for International Development Appendix VIII: GAO Contact and Staff  Acknowledgments GAO Contact Staff  Acknowledgments In addition to the contact named above, Michelle Philpott (Assistant  Director), Matthew Valenta (Assistant Director), Vivian Ly (Auditor in  Charge), Juvy Chaney, John Craig, Caitlin Cusati, Francine DelVecchio,  Patrick Frey, Maria Hasan, Maxine Hattery, Jason Kelly, Jim Kernen,  Jason Kirwan, Sharon Kittrell, Lisa Motley, Heena Patel, Anne Rhodes- Kline, and Kailey Schoenholtz made key contributions to this report.
Government-wide estimated improper payments totaled almost $1.4 trillion from fiscal year 2003 through fiscal year 2017. IPERA requires IGs to annually assess and report on whether executive branch agencies complied with the six criteria to (1) publish an agency financial report or performance accountability report, (2) conduct program-specific improper payment risk assessments, (3) publish improper payment estimates, (4) publish corrective action plans, (5) publish and meet annual improper payment reduction targets, and (6) report a gross improper payment rate of less than 10 percent. This report examines the extent to which 1. CFO Act agencies complied with IPERA criteria for fiscal years 2016 and 2017, and the trends evident since 2011, as reported by their IGs; 2. CFO Act agencies addressed requirements for programs reported as noncompliant with IPERA criteria for 3 or more consecutive years, as of fiscal year 2016, and communicated their strategies to Congress for reducing improper payments and achieving compliance; and 3. OMB made determinations regarding whether additional funding would help CFO Act agency programs reported as noncompliant with IPERA criteria for 2 consecutive years, as of fiscal years 2016 and 2017, come into compliance. GAO analyzed the IGs' fiscal years 2016 and 2017 IPERA compliance reports; reviewed prior GAO reports on agencies' IPERA compliance; reviewed agency information submitted to Congress; and made inquiries to OMB, applicable agencies, and IGs; and assessed such information based on relevant IPERA provisions and OMB and other guidance. Over half of the 24 Chief Financial Officers Act of 1990 (CFO Act) agencies were reported by their inspectors general (IG) as noncompliant with one or more criteria under the Improper Payments Elimination and Recovery Act of 2010 (IPERA) for fiscal years 2016 and 2017. Nine CFO Act agencies have been reported as noncompliant in one or more programs every year since the implementation of IPERA in fiscal year 2011, totaling 7 consecutive years of noncompliance. The IGs of the 14 noncompliant agencies reported that a total of 58 programs were responsible for the identified instances of noncompliance in fiscal year 2017. Further, 18 of the 58 programs at 9 agencies were reported as noncompliant for 3 or more consecutive years. Fourteen of these 18 programs accounted for an estimated $74.4 billion of the $141 billion total estimated improper payments for fiscal year 2017; the other 4 programs did not report improper payment estimates. This sum may include estimates that are of unknown reliability. The $74.4 billion is primarily composed of estimates reported for two noncompliant programs, the Department of Health and Human Services' Medicaid program and the Department of the Treasury's (Treasury) Earned Income Tax Credit program; estimated improper payments for these two programs are also a central part of certain high-risk areas in GAO's 2017 High-Risk List. Agencies with any program reported as noncompliant for 3 or more consecutive years are required to notify Congress of their program's consecutive noncompliance and submit a proposal for reauthorization or statutory change to bring that program into compliance. GAO found that three agencies with one or more programs reported as noncompliant for 3 or more consecutive years, as of fiscal year 2016, did not notify Congress or submit the required proposals. The Departments of Labor and the Treasury submitted proposed legislative changes in response to their programs being previously reported as noncompliant, but did not notify Congress of the programs' continued noncompliance as of fiscal year 2016. The U.S. Department of Agriculture (USDA) has not notified Congress despite prior GAO and USDA IG recommendations to do so. To address these issues, in June 2018 the Office of Management and Budget (OMB) updated its guidance to clarify the notification requirements for each consecutive year a program is reported as noncompliant. GAO found that five agencies did notify Congress as required, and included additional quality information that is not specifically required, but could be useful in updating Congress on their compliance efforts. For example, all five agencies provided information on the root causes, risks, changes, or issues affecting their efforts and corrective actions or strategies to address them; three agencies provided other quality information on accountability mechanisms, designated senior officials, and measurable milestones. In June 2018, OMB updated its guidance to clarify agency reporting requirements for programs reported as noncompliant for 3 or more consecutive years. However, the updated guidance does not direct agencies to include the types of quality information included in these five agencies' notifications for fiscal year 2016. GAO's Standards for Internal Control in the Federal Government emphasizes the importance of communicating quality information, such as significant matters affecting agencies' efforts to achieve compliance objectives. Such information could be useful in understanding the current challenges of these programs and is essential for assessing agency efforts to address high-risk and other issues. As a result, Congress could have more complete information to effectively oversee agency efforts to address program noncompliance for 3 or more consecutive years. When programs are reported as noncompliant for 2 consecutive years, IPERA gives OMB authority to determine whether additional funding is needed to help resolve the noncompliance. In April 2018, OMB staff stated that they determined that no additional funding was needed for the 15 programs that were reported as noncompliant for 2 consecutive years, as of fiscal year 2016, and that they primarily rely on the IGs' recommendations in their annual IPERA compliance reports when making funding determinations. OMB staff subsequently stated that they no longer need to conduct a detailed review of the IGs' IPERA compliance reports to identify recommendations related to additional funding needs. Instead, OMB updated its guidance in June 2018 to direct agencies to submit proposals to OMB regarding additional funding needs to help address IPERA noncompliance and clarified that the funding determination process will unfold as part of the annual development of the President's Budget. As of September 2018, OMB was in the process of making funding determinations for 12 programs that were reported as noncompliant as of fiscal year 2017 and stated that any determinations made would be developed in the President's Budget for fiscal year 2020.