Background IPIA requires agencies to conduct a risk assessment for all programs and  activities at least once every 3 years, and OMB guidance implementing  IPIA also directs agencies to report on the assessment in either the  agencies’ AFRs or PARs. Each agency must institute a systematic  method of performing the improper payment risk assessment, which may  take the form of either a quantitative analysis based on a statistical  sample or qualitative evaluation (e.g., a risk assessment questionnaire). IPIA identifies seven risk factors and OMB guidance includes two  additional risk factors that agencies are to consider when conducting  improper payment risk assessments. According to OMB M-15-02,  agencies’ risk assessments (either quantitative or qualitative) should  consider all of the following nine risk factors that are likely to contribute to  significant improper payments:  1.  whether the program or activity reviewed is new to the agency;  2.  the complexity of the program or activity reviewed, particularly with  respect to determining correct payment amounts;  3.  the volume of payments made annually;  4.  whether payments or payment eligibility decisions are made outside of  the agency, for example, by a state or local government or a regional  federal office;  5.  recent major changes in program funding, authorities, practices, or  6.  the level, experience, and quality of training for personnel responsible  for making program eligibility determinations or certifying that  payments are accurate;  7.  inherent risks of improper payments because of the nature of agency  8.  significant deficiencies in the agency’s audit reports, including but not  limited to the agency IG or GAO audit findings or other relevant  management findings that might hinder accurate payment  certification; and  9.  results from prior improper payment work. OMB guidance describes these nine risk factors as the minimum factors  that agencies should consider and notes that additional risk factors, such  as those specific to the program or activity being assessed, should also  be considered, as appropriate. If an agency’s improper payment risk assessment finds that a program is  susceptible to significant improper payments, the agency is required by  IPIA to estimate the annual amount of improper payments for the  program, publish corrective action plans, set reduction targets, and  annually report on the results of addressing these requirements for that  program. IPIA states that each agency is required to publish the improper  payment information in an annual report in the form and content required  by OMB—typically an AFR or a PAR—for the most recent fiscal year, and  post that report on the agency’s website. OMB Circular A-136 and OMB M-15-02 provide guidance for agencies on  preparing their AFRs or PARs, including the reporting of improper  payment information. Specifically, this OMB guidance directs agencies to  disclose the following in their AFRs or PARs: (1) the basis for grouping  programs and activities for improper payment risk assessments; (2) the  risk factors considered during their risk assessment; and (3) a listing of all  programs that were assessed for a given year, regardless of whether a  program or activity was deemed susceptible to significant improper  payments. Given that OMB guidance is updated periodically, some  reporting directives may differ for each fiscal year. As shown in table 1,  the directive to disclose the basis for grouping programs and activities  was applicable for all 3 years included in the scope of our review (i.e.,  fiscal years 2014 through 2016). However, the directives to disclose all  the risk factors considered and include a listing of all programs and  activities assessed were only applicable for fiscal years 2015 and 2016. CFO Act Agencies  Generally Adhered to  Improper Payment  Reporting Directives  for Risk Assessments During fiscal years 2014 through 2016, the 24 CFO Act agencies,  excluding the Department of Defense (DOD), reported in their AFRs or  PARs that that they completed at least one risk assessment on at least  one program or activity in one or more of those years. For the agencies  that reported that they completed an improper payment risk assessment,  we found that most generally adhered to the reporting directives that were  applicable for fiscal years 2014 through 2016. For example, for fiscal year  2014, 21 of the 24 CFO Act agencies reported completing a risk  assessment, and for those 21 agencies, we found that 19 agencies  adhered to OMB guidance for reporting the basis of groupings of  programs and activities and 2 did not. (See fig. 1.) For fiscal years 2015  and 2016, all 18 CFO Act agencies that reported completing a risk  assessment adhered to OMB guidance for this directive. Appendix III  provides additional details regarding the agencies’ reporting of completing  an improper payment risk assessment each year and adherence to the  OMB improper payment risk assessment reporting directives. Further  details on each of these reporting directives are provided below. Reporting the basis for grouping programs and activities. During the  3-year period from fiscal years 2014 through 2016, we found two  instances where the agencies—the Departments of Commerce  (Commerce) and Energy (Energy)—did not adhere to the reporting  directive for agencies to report the basis of grouping programs and  activities. Although these two agencies did not adhere to this reporting  directive in fiscal year 2014, Commerce adhered to this directive in fiscal  year 2015 and fiscal year 2016. Energy adhered to this directive in fiscal  year 2015, and this reporting directive was not applicable for fiscal year  2016 because Energy did not report completing any risk assessments  that year. All other applicable agencies were in full adherence to this  OMB directive in fiscal years 2015 and 2016. Reporting a listing of all programs and activities assessed during  the agencies’ improper payment risk assessments. During fiscal  years 2015 through 2016, the applicable CFO Act agencies, except for  the U.S. Agency for International Development (USAID), adhered to the  reporting directive for listing all programs and activities assessed during  the agencies’ improper payment risk assessments. USAID did not adhere  to this reporting directive in fiscal year 2015; however, in fiscal year 2016,  USAID did list all programs and activities. USAID officials provided us an  OMB e-mail indicating, among other things, that USAID could be on a 3- year cycle of performing risk assessments starting in fiscal year 2015.  Notwithstanding that e-mail, USAID continued to perform improper  payment risk assessments annually, according to USAID officials, to  maintain audit readiness and expertise. These officials further stated that  this OMB e-mail served as support for not adhering to the OMB directive  for reporting risk assessments. However, we did not find upon our review  that the e-mail explicitly provided such support. Reporting the risk factors considered during the agencies’ risk  assessments. As directed by OMB guidance, agencies are to report the  risk factors considered during improper payment risk assessments in their  AFRs or PARs. Given that IPIA identifies seven risk factors that agencies  are to consider and OMB guidance includes two additional risk factors,  agencies are directed by OMB to consider a minimum of nine risk factors.  Therefore, the AFRs and PARs adhering to OMB guidance are to include  a discussion regarding the agencies’ consideration of these nine factors  as well as any other factors considered. In our analysis, we found that six  agencies failed to adhere to OMB reporting directives either in fiscal year  2015, fiscal year 2016, or both. Specifically, we found the following: The Office of Personnel Management (OPM) did not adhere to the  improper payment risk assessment reporting directives in fiscal year  2015. However, OPM subsequently corrected the reporting issue in  fiscal year 2016. Three agencies—USAID, the U.S. Department of Agriculture (USDA),  and the Social Security Administration (SSA)—did not adhere to the  improper payment risk assessment reporting directives in fiscal years  2015 and 2016. In their fiscal years 2015 and 2016 AFRs, USAID did  not report its consideration of any of the nine risk factors, USDA  reported that it considered four of the nine risk factors, and SSA  reported that it considered six of the nine risk factors. Two agencies, the Department of Education (Education) and the  Department of Labor (Labor), did not adhere to the improper payment  risk assessment reporting directive in fiscal year 2016. In their fiscal  year 2016 AFRs, neither Education nor Labor provided a detailed  description of all the risk factors that were considered in their risk  assessments. Education stated that its risk assessment analysis  “included a quantitative review of questioned costs from Single Audit  findings versus total program expenditures, as well as a qualitative  review of other risk factors including changes in legislation or  regulations and history of audit findings.” Labor did not list the risk  factors considered in its improper payment risk assessments but  instead provided a hyperlink to IPIA. As noted above, officials from USAID stated that an OMB e-mail served  as support for not adhering to the OMB directive for reporting risk  assessments, including the risk factors. However, we found upon our  review that the e-mail did not explicitly provide such support. Officials from USDA, Labor, and SSA, three of the five agencies that did  not adhere to the reporting directive in fiscal year 2016, informed us that  they considered the nine risk factors but were not aware that they had to  specifically list the nine risk factors in their AFRs or PARs. In addition,  Labor officials stated that they included a link to IPIA instead of  mentioning the nine risk factors to help simplify the reporting. However,  OMB Circular A-136 specifically directs the agencies to include a  description of the risk factors considered in their improper payment risk  assessments in their AFRs or PARs. Although Labor officials stated that  they considered all nine risk factors, Labor’s link to IPIA only includes  seven required risk factors and not the two additional risk factors that are  referenced in OMB guidance. After we brought these concerns to their  attention, officials from these three agencies indicated that they plan to  report the risk factors considered, as directed by OMB, which should  include consideration of all nine risk factors. By adhering to the OMB  directive for reporting risk factors, the agencies will improve the  transparency of the risk assessments reported in their AFRs or PARs. An Education official stated that the department did not consider all nine  risk factors for its non-Federal Student Aid programs during fiscal year  2016 because Education’s analysis was quantitative in nature.  However, OMB guidance states that all nine risk factors must be  considered in both qualitative and quantitative improper payment risk  assessments. In May 2017, the Inspector General for Education  recommended that Education ensure that improper payment risk  assessments conform with IPIA and OMB guidance when determining  whether programs may be susceptible to significant improper payments and identify all programs that may be susceptible to significant improper  payments. In response to the recommendation in the Office of Inspector  General (OIG) audit report, Education stated that it will align its improper  payment risk assessments with the nine risk factors beginning in fiscal  year 2017. A revised version of OMB Circular A-136 that was issued in August 2017  no longer directs agencies to report improper payment risk assessment  information in the agencies’ fiscal year 2017 AFRs and PARs.  Specifically, agencies will no longer have to report in their AFRs or PARs  for a given year (1) the basis for grouping programs and activities for  improper payment risk assessments, (2) a listing of all programs and  activities assessed during their risk assessments, and (3) the risk factors  considered during their risk assessments. OMB staff stated that their  primary motivation for eliminating the risk assessment reporting directives  from OMB guidance was to reduce the administrative burden on  agencies. Although OMB guidance will not direct agencies to report the  three items noted above, agencies are still required to complete the risk  assessments, as required by IPIA and directed in OMB guidance. Further,  OMB staff stated that they rely on each agency’s OIG to review the  quality of each agency’s risk assessment, which should include assessing  the three items noted above; therefore, these reporting directives are not  necessary. While we recognize the importance of reducing administrative burden, we  also have previously reported on the importance of risk assessments for  managing improper payments. We believe that the requirement for  agencies to publicly report the improper payment risk assessment  information has helped hold agencies accountable and provided  additional transparency to the agencies’ improper payment processes, as  well as assisted Congress and others in their oversight of government- wide improper payments. However, if OMB is going to rely on each  agency’s OIG to ensure quality risk assessments, it is important that these reviews are performed consistently throughout the federal  government. In our May 2017 report, we found that OIGs inconsistently  reported agencies’ compliance with the IPERA criterion for conducting  program-specific risk assessments. For example, certain OIGs reported  agencies as noncompliant when agencies did not consider all nine risk  factors, as outlined in IPIA, OMB guidance, or both, during program- specific risk assessments, whereas other OIGs reported agencies as  compliant with this IPERA criterion, despite also finding issues with the  agencies’ consideration of the nine risk factors. To help ensure that  government-wide compliance under IPERA is consistently determined  and reported, we recommended in May 2017 that the Director of OMB  coordinate with the Council of the Inspectors General on Integrity and  Efficiency (CIGIE) to develop and issue guidance, either jointly or  independently, to specify what procedures should be conducted as part of  the OIGs’ IPERA compliance determinations. OMB did not provide any  comments on our recommendation, and as of August 2017, OMB had not  yet issued such guidance. CIGIE stated that it would coordinate with OMB  as needed and provide feedback on any draft OMB guidance. Subsequent to the issuance in August 2017 of a revised version of OMB  Circular A-136 and after we notified OMB of our views on the importance  of certain data, OMB staff stated that they plan to direct agencies to  report additional risk assessment data. Specifically, in September 2017,  OMB staff told us that they plan to direct agencies to provide a listing of  all programs and activities assessed during their risk assessments on  www.paymentaccuracy.gov for fiscal year 2017 reporting, and that they  plan to continue to direct agencies to report this listing for subsequent  fiscal years. In addition, although the basis for grouping programs and  activities for improper payment risk assessments and the risk factors  considered during the risk assessments will not be required to be  reported in fiscal year 2017 AFRs and PARs, OMB staff stated that they  plan to revise the guidance for fiscal year 2018 so that agencies report  such information in their AFRs and PARs. Six Selected CFO Act  Agencies Did Not  Have Properly  Designed Control  Activities That  Included All Programs  and Activities in Their  Improper Payment  Risk Assessments We found that three of the nine selected CFO Act agencies that we  reviewed, Energy, the Department of Justice, and USAID, had  documented procedures for performing the required improper payment  risk assessments and these procedures included the design of control  activities necessary to help ensure that all programs and activities were  assessed at least once every 3 years. However, the remaining six  agencies did not properly design control activities for this purpose.  Specifically, three of these six selected agencies did not have  documented procedures for performing the required improper payment  risk assessments. The remaining three agencies improperly excluded  specific programs and activities from the improper payment risk  assessment process. Appendix IV provides more detail on our analysis of  these selected agencies’ procedures for performing improper payment  risk assessments. We did not evaluate whether all control activities related to conducting  improper payment risk assessments were properly designed or evaluate  other internal control components, such as the control environment. If we  had done so, additional deficiencies may or may not have been identified  that could impair the overall effectiveness of the control activities  evaluated as part of this audit. Three Selected CFO Act  Agencies Did Not Have  Documented Procedures  for Conducting Their  Improper Payment Risk  Assessments but Have  Now Documented Them Three of the nine selected CFO Act agencies—Commerce, the National  Science Foundation (NSF), and the Nuclear Regulatory Commission  (NRC)—did not have documented procedures for conducting improper  payment risk assessments for fiscal years 2014 through 2016. Although  two of these three agencies (Commerce and NSF) had developed  processes to help ensure that all programs and activities were assessed  for susceptibility to significant improper payments at least once every 3  years, these processes were not documented in written procedures. By  the end of our review, the three agencies subsequently established  documented procedures during fiscal year 2017. We reviewed the  procedures for Commerce, NRC, and NSF and found that they included  control activities designed to help ensure that all programs and activities  are included in the agencies’ improper payment risk assessments at least  once every 3 years, as required by IPIA. Three Selected CFO Act  Agencies Did Not Properly  Design Control Activities to  Help Ensure That All  Programs and Activities  Were Assessed Although the Departments of the Interior and State and the National  Aeronautics and Space Administration (NASA) had documented  procedures for conducting improper payment risk assessments, we  found that these agencies did not have properly designed control  activities to help ensure that all programs and activities were assessed for  susceptibility to improper payments. These three agencies specifically  excluded certain programs and activities from the improper payment risk  assessment process, as follows. Department of the Interior (Interior). In our review of Interior’s  design of control activities, we found that Interior did not include  payments made by the department for certain programs. When asked  why the programs associated with these payments were not  assessed, Interior officials told us that the list that the department  used to ensure that all programs and activities for which the  department made payments were properly assessed excluded those  payments from Interior’s program population. Subsequent to our  inquiry, Interior officials told us that Interior will update its procedures  to ensure that they capture all programs in Interior’s assessments. In  addition, Interior officials provided us a draft of Interior’s updated  procedures, and we found that these draft procedures included control  activities designed to help ensure that all programs and activities are  included in the department’s improper payment risk assessments at  least once every 3 years, as required by IPIA. Department of State (State). In our review of State’s design of  control activities, we found that State excluded certain programs and  activities from the improper payment risk assessment based on  threshold limitations on outlay data. Specifically, State only included  programs and activities in the improper payment risk assessments if  the outlays were greater than (1) $100 million or (2) $85 million and a  50 percent increase from the prior year. Programs and activities that  fell below these thresholds were not assessed for susceptibility to  significant improper payments. State officials told us that they  believed the $100 million threshold limitation was reasonable because  State predicted that it was improbable one of its programs would have  an improper payment estimate of at least 10 percent in order to meet  the IPIA threshold of $10 million. According to State officials, State’s  justification for its assessment threshold was based on many factors,  including sampling of expenditures, past external audits, and internal  OMB Circular A-123 reviews. However, IPIA requires that improper  payment risk assessments be performed for each program and  activity that the agency head administers. In commenting on our draft  report, State officials informed us that State had updated its  documented procedures to lower the assessment threshold to the   $10 million threshold identified in IPIA. State officials provided us a  copy of the updated procedures, and we found that the procedures  included control activities designed to help ensure that all programs  and activities are included in the department’s improper payment risk  assessments at least once every 3 years, as required by IPIA. NASA. In our review of NASA’s design of control activities, we found  that NASA has documented procedures for conducting improper  payment risk assessments; however, the procedures used for  improper payment risk assessments conducted for fiscal years 2014  through 2016 were outdated. Specifically, the documented  procedures, dated 2012, did not account for changes to IPIA in 2013  or updates to OMB’s guidance issued in fiscal year 2014. In June  2017, NASA subsequently updated its procedures for improper  payment risk assessments to properly address OMB’s current  improper payments guidance. The updated procedures also included  a description of key control activities designed to help ensure that all  NASA programs and activities, other than OIG activities, have  undergone an improper payment risk assessment. According to NASA officials, NASA’s improper payment risk assessment  process specifically excluded OIG activities because its OIG receives its  own appropriation, and therefore, OIG activities are not considered part of  NASA’s programs or activities for improper payment risk assessments. In  addition, NASA officials stated that NASA OIG activities are excluded  from the improper payment risk assessments because of concerns  regarding NASA OIG’s independence as NASA OIG conducts the  agency’s annual IPERA compliance audit. NASA could not provide us  with any guidance or documentation that specifically addresses the  exclusion of OIG activities. The NASA OIG is part of NASA, and IPIA requires that improper payment  risk assessments be performed for each program and activity that the  agency head administers. To the extent that the potential threat to OIG  independence prevents NASA from conducting a risk assessment of  payments made by the OIG’s programs and activities, the NASA  Administrator may transfer this responsibility to the OIG. By not making  an assessment, NASA has not determined whether OIG programs and  activities are susceptible to significant improper payments. Standards for Internal Control in the Federal Government states that  management should develop control activities to achieve objectives and  respond to risks and implement control activities through policies. When  an agency does not have properly designed policies and procedures to  help ensure that all programs and activities are assessed for susceptibility  to significant improper payments at least once every 3 years, there is an  increased risk that the agency may not always identify all risk-susceptible  programs and activities, resulting in incomplete improper payment  estimates. Conclusions Performing improper payment risk assessments and reporting on such  assessments are key to identifying programs and activities that may be  susceptible to significant improper payments. Agencies’ nonadherence to  the OMB guidance to report on the results of their risk assessments may  result in Congress not having the information necessary to monitor and  take prompt action to address problematic programs. Most of the nine  selected agencies did not properly design control activities to include all  programs and activities in their improper payment risk assessments at  least once every 3 years during fiscal year 2014 through fiscal year 2016,  the time period of our review. Subsequent to fiscal year 2016, with the  exception of NASA, which did not include its OIG’s activities, the federal  agencies that were identified as lacking properly designed control  activities drafted or updated their procedures to help ensure that all  programs and activities were assessed for susceptibility to significant  improper payments. Without proper control activities, NASA may not be  identifying all programs and activities that should be included in its  improper payment risk assessments. If a program or activity is not  assessed for risk, then an agency could be at risk of noncompliance with  IPIA or nonadherence to OMB guidance as the risk assessment process  is a crucial step in determining programs and activities that are  susceptible to significant improper payments and thus subject to  additional reporting and monitoring requirements. Recommendation for  Executive Action We are making the following recommendation to NASA:  The Administrator of NASA should take steps to revise the agency’s  procedures for conducting improper payment risk assessments to include  the activities of its OIG in its risk assessment process to help ensure that  all programs and activities are assessed for susceptibility to significant  improper payments at least once every 3 years as required by IPIA.  (Recommendation 1) Agency Comments  and Our Evaluation We provided a draft of this report to the 24 CFO Act agencies and OMB  for comment. We received written comments from 4 agencies—NASA,  State, SSA, and USAID, which are reproduced in appendixes V through  VIII. We also received technical comments from Energy, OMB, State, and  USAID, which we incorporated in the report as appropriate. All of the  other agencies notified us that they had no comments. The following discusses the written comments we received from the four  agencies noted above. In its comments, NASA concurred with our recommendation and  stated that the agency will revise its procedures for conducting  improper payment risk assessments to include OIG programs and  activities by September 2018. In the draft report provided to State for comment, we had  recommended that State reevaluate the agency’s use of dollar  thresholds for excluding programs and activities from its risk  assessment process and revise its procedures for conducting  improper payment risk assessments to help ensure that all programs  and activities are assessed for susceptibility to significant improper  payments at least once every 3 years as required by IPIA. In its  comments, State questioned the practicality of our proposed  recommendation; however, State stated that it updated its procedures  to lower the assessment threshold to the minimum dollar threshold of  $10 million. We noted that this threshold aligns with the IPIA threshold  of $10 million. We reviewed State’s updated procedures and  confirmed that State had revised its dollar threshold for conducting  risk assessments, which effectively addressed our preliminary  findings. Therefore, we have removed the recommendation from our  report. In its comments, SSA stated that it believed that its risk assessment  reporting fully complied with OMB guidance. SSA stated that it  considered the nine required risk factors but only reported on the risk  factors that were applicable to the agency. However, given that SSA  reported that it considered six risk factors and did not indicate in its  AFRs that the other factors were not applicable to SSA, we continue  to believe that SSA did not report, as directed by OMB guidance, on  all the risk factors considered in its improper payment risk  assessments for fiscal years 2015 and 2016. In its comments, USAID stated that our draft report was inaccurate in  stating that USAID did not adhere to OMB reporting directives. USAID  stated that an e-mail from OMB provided USAID relief from improper  payment reporting. However, OMB’s e-mail did not explicitly provide  USAID a waiver from the OMB risk assessment reporting directives.   Moreover, USAID reported in its AFRs for fiscal years 2014 through  2016 that it conducted annual risk assessments for the time period  covered in this audit. As stated in appendix III, USAID did properly  report the basis for grouping programs and activities for fiscal years  2014 through 2016, and the agency also properly reported a listing of  all programs and activities that were assessed for fiscal year 2016.  Accordingly, we believe that USAID also should have followed all  OMB risk assessment reporting directives for the time period covered  for our audit, and we believe that our report accurately characterizes  this issue. We are sending copies of this report to the appropriate congressional  committees, the heads of the 24 CFO Act agencies, the Director of the  Office of Management and Budget, and other interested parties. In  addition, the report is available at no charge on the GAO website at  http://www.gao.gov. If you or your staff have any questions about this report, please contact  me at (202) 512-2623 or davisbh@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix IX. Appendix I: Objectives, Scope, and  Methodology This report examines the extent to which (1) the 24 agencies subject to  the Chief Financial Officers Act of 1990 (CFO Act) followed Office of  Management and Budget (OMB) guidance for reporting on improper  payment risk assessments in their agency financial reports (AFR) or  performance and accountability reports (PAR) for fiscal years 2014  through 2016 and (2) selected CFO Act agencies have designed control  activities to include all of their programs and activities in an improper  payment risk assessment at least once during a 3-year period, as  required by the Improper Payments Information Act of 2002 (IPIA), as  amended by the Improper Payments Elimination and Recovery Act of  2010 and the Improper Payments Elimination and Recovery Improvement  Act of 2012. At the time of our review, the latest 3-year period was fiscal  years 2014 through 2016. To address our first objective, we reviewed improper payment risk  assessment requirements in IPIA, as amended, and the related guidance  in OMB Circular A-136, Financial Reporting Requirements, including the  OMB directives for agencies’ risk assessment reporting, and OMB  Circular A-123, Appendix C, Requirements for Effective Estimation and  Remediation of Improper Payments (OMB M-15-02). We analyzed these  statutes and guidance to identify key criteria that agencies must meet for  reporting on improper payment risk assessments. IPIA, as amended,  identifies seven risk factors and OMB guidance includes two additional  risk factors that agencies are to consider in their improper payment risk  assessment to determine susceptibility to significant improper payments.  Additionally, for fiscal years 2014 through 2016, OMB M-15-02 directed  agencies that conducted improper payment risk assessments to disclose  in their AFRs or PARs the basis for grouping programs and activities for  improper payment risk assessments. For fiscal years 2015 and 2016,  OMB Circular A-136 directed agencies to report (1) a listing of programs  and activities that were assessed for susceptibility to significant improper  payments in a given year, regardless of whether a program or activity was  deemed risk-susceptible, and (2) the risk factors considered during their  improper payment risk assessments. We analyzed the AFRs or PARs of  the 24 CFO Act agencies for fiscal years 2014 through 2016 to determine  whether each agency met the key OMB reporting criteria described  above. For our review, we focused on whether the agencies reported the  risk assessment information in their AFRs or PARs and did not evaluate  the quality of improper payment risk assessments completed. For any agencies that did not meet the reporting directives outlined in  OMB guidance for their improper payment risk assessments, we  interviewed appropriate agency officials to determine why those agencies  did not meet these key criteria. For fiscal year 2017, a revised version of  OMB Circular A-136 that was issued in August 2017 no longer directs  agencies to report improper payment risk assessment information in the  agencies’ fiscal year 2017 AFRs and PARs. Subsequent to the issuance  in August 2017 of a revised version of OMB Circular A-136 and after we  notified OMB of our views on the importance of certain data, OMB staff  stated that they plan to direct agencies to report additional risk  assessment data. Specifically, in September 2017, OMB staff told us that  they plan to direct agencies to provide a listing of all programs and  activities assessed during their risk assessments on  www.paymentaccuracy.gov for fiscal year 2017 reporting, and that they  plan to continue to direct agencies to report this listing for subsequent  fiscal years. In addition, although the basis for grouping programs and  activities for improper payment risk assessments and the risk factors  considered during the risk assessments will not be required to be  reported in fiscal year 2017 AFRs and PARs, OMB staff stated that they  plan to revise the guidance for fiscal year 2018 so that agencies report  such information in their AFRs and PARs. To address our second objective, we reviewed IPIA, as amended; the  related OMB guidance; and relevant internal control standards to  determine the relevant control activities needed to help ensure that  agencies conduct improper payment risk assessments for all programs  and activities at least once every 3 years. For this objective, we selected  nine CFO Act agencies that did not report improper payment estimates  for any programs or activities in fiscal year 2015 or 2016 except those  estimates that were required to be reported pursuant to the Disaster  Relief Appropriations Act, 2013. These nine agencies were the  Departments of Commerce, Energy, the Interior, Justice, and State; the  National Aeronautics and Space Administration; the National Science  Foundation; the Nuclear Regulatory Commission; and the U.S. Agency  for International Development. We reviewed these agencies’ procedures  for conducting improper payment risk assessments and interviewed  agency officials to determine whether the agencies designed and  documented control activities to include all programs and activities in an  improper payment risk assessment at least once every 3 years. To verify  each agency’s assertions that all programs and activities are reviewed at  least once every 3 years, we compared the line item for gross outlays  contained in each agency’s Statement of Budgetary Resources for the  relevant period to outlay data provided by each agency for each program  and activity covered by improper payment risk assessments for fiscal  years 2014 through 2016. When we identified differences between the  two data sources, we interviewed agency officials to understand the  cause for the differences and obtained any supporting documentation to  ensure that all significant programs and activities were properly assessed. While our second objective focused on certain significant control activities  related to the selected agencies’ inclusion of programs and activities in  their improper payment risk assessments at least once during fiscal years  2014 through 2016, we did not evaluate all control activities and other  components of internal control. If we had done so, additional deficiencies  may or may not have been identified that could impair the effectiveness of  the control activities evaluated as part of this audit. We conducted this performance audit from June 2016 to November 2017  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. Appendix II: Standards for Internal Control in  the Federal Government Standards for Internal Control in the Federal Government provides the  overall framework for establishing and maintaining internal control.  Internal control should be designed, implemented, and operating  effectively to provide reasonable assurance that the operations, reporting,  and compliance objectives of an entity will be achieved. The five  components of internal control are as follows: Control environment - The foundation for an internal control system. It  provides the discipline and structure to help an entity achieve its  objectives. Risk assessment - Assesses the risks facing the entity as it seeks to  achieve its objectives. This assessment provides the basis for  developing appropriate risk responses. Control activities - The actions management establishes through  policies and procedures to achieve objectives and respond to risks in  the internal control system, which includes the entity’s information  system. Information and communication - The quality information management  and personnel communicate and use to support the internal control  system. Monitoring - Activities management establishes and operates to  assess the quality of performance over time and promptly resolve the  findings of audits and other reviews. An effective internal control system has each of the five components of  internal control effectively designed, implemented, and operating and the  five components operating together in an integrated manner. In this audit,  we focused on certain significant control activities related to the selected  agencies’ inclusion of programs and activities in their improper payment  risk assessments at least once during fiscal years 2014 through 2016. Appendix III: Agency Adherence to Office of  Management and Budget Reporting  Directives for Risk Assessments As noted in our report, the Improper Payments Information Act of 2002,  as amended by the Improper Payments Elimination and Recovery Act of  2010 and the Improper Payments Elimination and Recovery Improvement  Act of 2012, requires agencies to conduct improper payment risk  assessments for all federal programs and activities in fiscal year 2011  and at least once every 3 years thereafter. During fiscal years 2014  through 2016, the 24 agencies subject to the Chief Financial Officers Act  of 1990 (CFO Act), excluding the Department of Defense, reported in  their agency financial reports (AFR) or performance and accountability  reports (PAR) that they completed at least one risk assessment on at  least one program or activity in one or more of those years. For each  agency that reported completing an improper payment risk assessment in  a given year, we evaluated whether the agency adhered to certain Office  of Management and Budget (OMB) reporting directives. It is important to  note that our audit scope did not include evaluating whether the agencies  completed the required risk assessment for all programs and activities. We evaluated the 24 CFO Act agencies’ fiscal years 2014 through 2016  AFRs and PARs to determine if agencies adhered to OMB guidance for  reporting on improper payment risk assessments. Table 2 summarizes  agencies’ adherence to the OMB guidance to report a basis for grouping  programs and activities in the AFRs or PARs for fiscal years 2014 through  2016. Table 3 summarizes agencies’ adherence to the OMB directive to list all  of the programs and activities that were assessed for susceptibility to  significant improper payments and describe the risk factors considered  during their assessments for fiscal years 2015 and 2016. There was no  directive to report this information for fiscal year 2014. Appendix IV: Summary of Agencies’  Procedures for Performing Improper  Payment Risk Assessments Table 4 summarizes our analysis of the selected agencies’ procedures for  performing improper payment risk assessments to help ensure that all  programs and activities were properly reviewed once every 3 years. Appendix V: Comments from the National  Aeronautics and Space Administration Appendix VI: Comments from the Social  Security Administration Appendix VII: Comments from the  Department of State Appendix VIII: Comments from the U.S.  Agency for International Development Appendix IX: GAO Contact and Staff  Acknowledgments GAO Contact Staff  Acknowledgments In addition to the contact named above, Matt Valenta (Assistant Director),  Michelle Philpott (Assistant Director), Laura Bednar (Auditor-in-Charge),  Stephanie Adams, Youssef Amrani, Francine DelVecchio, and Kailey  Schoenholtz made key contributions to this report.
Reported improper payment estimates totaled over $1.2 trillion government-wide from fiscal years 2003 through 2016. Agencies are statutorily required to perform improper payment risk assessments to identify programs and activities that may be susceptible to significant improper payments and are required to report an improper payment estimate for ones that are susceptible to significant improper payments. GAO was asked to review federal agencies' improper payment risk assessments. This report examines the extent to which (1) the 24 CFO Act agencies followed OMB guidance for reporting on improper payment risk assessments and (2) selected CFO Act agencies properly designed control activities to include all of their programs and activities in an improper payment risk assessment at least once every 3 years, as statutorily required. GAO analyzed the 24 CFO Act agencies' AFRs and PARs and reviewed the procedures at 9 selected agencies. GAO selected 9 agencies that did not report improper payment estimates in fiscal year 2015, except for those estimates that were mandated to be reported pursuant to the Disaster Relief Appropriations Act, 2013. For this review, GAO did not evaluate the quality of improper payment risk assessments completed. GAO's review of the 24 Chief Financial Officers Act of 1990 (CFO Act) agencies' fiscal years 2014 through 2016 agency financial reports (AFR) and performance and accountability reports (PAR) found that these agencies generally adhered to the Office of Management and Budget's (OMB) improper payment risk assessment reporting directives. However, GAO found instances of nonadherence, including the following: There were two instances of nonadherence to OMB's directive for agencies to report the basis for how they grouped programs and activities, both of which occurred in fiscal year 2014. All agencies that completed risk assessments adhered to this directive for fiscal years 2015 and 2016. The Improper Payments Information Act of 2002, as amended, identifies seven risk factors and OMB guidance includes two additional risk factors that agencies are to consider when conducting risk assessments. For fiscal years 2015 and 2016 reporting, OMB directed agencies to report the risk factors considered in their risk assessments. However, GAO found six agencies that did not report one or more of the nine risk factors in their AFRs or PARs. OMB's revised guidance for fiscal year 2017 no longer directs agencies to report on their risk assessments. OMB staff stated that their primary motivation for removing such reporting was to reduce the administrative burden. After GAO notified OMB of the importance of certain data, OMB staff plan to direct agencies to provide additional data, including a listing of risk assessed programs and activities, on www.paymentaccuracy.gov for reporting beginning in fiscal year 2017. OMB staff also plan to revise the guidance for fiscal year 2018 for agencies to report the other risk assessment information in their AFRs or PARs. GAO also found that three of the nine selected agencies (the Departments of Energy and Justice and the U.S. Agency for International Development) that it reviewed had designed and documented control activities to help ensure that all programs and activities were assessed every 3 years. For the remaining six agencies, GAO found that the agencies did not properly design control activities for this purpose. Specifically, GAO found the following: Three agencies—the Department of Commerce, the National Science Foundation, and the Nuclear Regulatory Commission—did not have documented procedures for conducting risk assessments during fiscal years 2014 through 2016 but subsequently documented them. Three agencies—the Departments of the Interior (Interior) and State (State) and the National Aeronautics and Space Administration (NASA)—documented procedures for conducting risk assessments but did not include all programs and activities in their risk assessments. Interior later drafted revisions to its procedures and State updated its procedures to include them. Without properly designed and documented control activities, there is a risk that an agency may not identify all programs and activities that require a risk assessment, which could result in the agency failing to develop and report improper payment estimates for programs and activities that should have been identified as susceptible to significant improper payments.