Background Fraud Risk Management Fraud and “fraud risk” are distinct concepts. Fraud—obtaining something  of value through willful misrepresentation—is a determination to be made  through the judicial or other adjudicative system, and that determination is  beyond management’s professional responsibility. Fraud risk exists when  individuals have an opportunity to engage in fraudulent activity, have an  incentive or are under pressure to commit fraud, or are able to rationalize  committing fraud. Although the occurrence of fraud indicates there is a fraud risk, a fraud risk can exist even if actual fraud has not yet been  identified or occurred. When fraud risks can be identified and mitigated,  agencies may be able to improve fraud prevention, detection, and  response. Managers of federal programs maintain the primary  responsibility for enhancing program integrity and managing fraud risks.  Those who are effective at managing their fraud risks collect and analyze  data and identify fraud trends and use data and trends to improve fraud  risk management activities. Implementing effective fraud risk  management processes is important to help ensure that federal programs  fulfill their intended purpose, funds are spent effectively, and assets are  safeguarded. The Fraud Risk Framework provides a comprehensive set of leading  practices that serve as a guide for agency managers developing or  enhancing efforts to combat fraud in a strategic, risk-based manner. The  Fraud Risk Framework is also aligned with Principle 8 (“Assess Fraud  Risk”) of the Standards for Internal Control. It is designed to focus on  preventive activities, which generally offer the most cost-efficient use of  resources since they enable managers to avoid a costly and inefficient  “pay-and-chase” model of recovering funds from fraudulent transactions  after payments have been made. The leading practices in the Fraud Risk  Framework are organized into four components—commit, assess, design  and implement, and evaluate and adapt—as depicted in figure 1. FRDAA Requirements Legislation and guidance has increasingly focused on the need for  program managers to take a strategic approach to managing risks,  including fraud. FRDAA was enacted to improve federal agency controls  and procedures to assess and mitigate fraud risks, and to improve  agencies’ development and use of data analytics for the purpose of  identifying, preventing, and responding to fraud. FRDAA requires  agencies to establish financial and administrative controls that incorporate  the Fraud Risk Framework’s leading practices, including  1.  conducting an evaluation of fraud risks and using a risk-based  approach to design and implement financial and administrative control  activities to mitigate identified fraud risks;  2.  collecting and analyzing data from reporting mechanisms on detected  fraud to monitor fraud trends, and using that data and information to  continuously improve fraud-prevention controls; and  3.  using the results of monitoring, evaluation, audits, and investigations  to improve fraud prevention, detection, and response. Further, agencies are required to annually report to Congress on their  progress in implementing the act for each of the first 3 fiscal years after its  enactment. FRDAA required OMB, in consultation with the Comptroller General, to  establish guidelines for agencies that incorporate leading practices from  the Fraud Risk Framework as well as to establish a working group that  shares best practices in fraud risk management. In addition, the working  group is required to submit a plan to develop a federal interagency data  analytics library for fraud risk management. This working group was also  required to consult with the Offices of Inspector General and federal and  nonfederal experts on fraud risk assessments, financial controls, and  other relevant matters as well as to meet not fewer than four times per  year. See figure 2 for additional details on FRDAA’s requirements and  implementation timeline. Agencies Have Taken  Steps to Manage and  Report on Fraud  Risks as FRDAA  Requires, but Have  Identified Challenges Agencies Indicated They  Are Planning or  Implementing Activities to  Manage Fraud Risks Agencies’ steps to manage fraud risks at the agency-wide level—and in  response to FRDAA—are at varying stages of planning and  implementation, according to our survey of agencies subject to the act. In  our survey, we asked the 72 agencies subject to FRDAA to characterize  (1) the overall status of their efforts to plan for and implement the act as  “not started,” “started but not mature,” or “mature” and (2) whether they  regularly undertook specific fraud risk management activities prior to and  after FRDAA’s enactment. With respect to overall status, most surveyed  agencies (85 percent) indicated that they have at least started planning  how they will meet FRDAA requirements (started or mature), and about  78 percent indicated that they have also started or are mature in their  efforts to implement the requirements. Fewer agencies, however,  characterized either their planning or implementation efforts as “not  started” (about 15 and 22 percent, respectively). See figure 3 for agency  responses on their FRDAA planning and implementing efforts. While most agencies indicated they have taken planning and  implementation steps, agencies varied in the extent to which they  indicated undertaking specific fraud risk management activities required  by FRDAA at the agency-wide level, according to our survey results. We  asked agencies whether they were currently performing key fraud risk  management activities at the agency-wide level. The fraud risk  management activities identified in the survey were an abbreviated  version of the FRDAA requirements for agencies to establish financial  and administrative controls, which included (1) conducting an evaluation  of fraud risks and using a risk-based approach to design and implement  financial and administrative control activities to mitigate identified fraud  risks; (2) collecting and analyzing data from reporting mechanisms on  detected fraud to monitor fraud trends and using that data and information  to continuously improve fraud-prevention controls; and (3) using the  results of monitoring, evaluation, audits, and investigations to improve  fraud prevention, detection, and response. Most agencies (about 86  percent) indicated they use the results of monitoring, evaluation, audits,  and investigations to manage fraud risk. Fewer agencies (about 63  percent) indicated they collect fraud-related data for prevention. Agencies  also varied in the frequency with which they perform certain activities. For  example, of the agencies that indicated that they collect fraud-related  data for prevention, 44 percent indicated they do so regularly, while 18  percent indicated that they do so but not on a regular basis. See figure 4  for additional information on the frequency with which agencies indicated  they perform fraud risk management activities related to FRDAA  requirements for financial and administrative controls. The majority of agencies we surveyed indicated that they were engaged  in a variety of fraud risk management activities before FRDAA’s  enactment, but a larger number indicated action in each of these activities  since the law was enacted. For example, 86 percent of agencies  indicated they used findings from monitoring, auditing, or evaluation of  fraud risk activities after the enactment of FRDAA, compared with 79  percent of agencies that indicated they used such findings before  FRDAA. See figure 5 for a comparison of the number of agencies  reporting that they undertook fraud risk management activities before and  after the enactment of FRDAA. To identify relationships among survey responses associated with  progress implementing elements of FRDAA and fraud risk management  practices, we considered direction and strength of correlations between  those questions. Agencies that indicated that they have started  implementing FRDAA (85 percent) also reported higher use of some key  fraud risk management activities, according to our analysis of the survey  data. For example, agencies that indicated their implementation efforts  were “mature” or “started but not mature” indicated at higher rates that  they conduct risk-based evaluations of fraud risks and collect fraud- related data for prevention since the enactment of FRDAA. As mentioned,  these activities are FRDAA requirements and are leading practices in the  Fraud Risk Framework. These agencies also indicated at higher rates  that they incorporated fraud risk activities into broader ERM, as directed  by OMB Circular A-123. Further, while most (89 percent) agencies  indicated having a designated entity for managing fraud risk, consistent  with one leading practice identified in the Fraud Risk Framework, fewer  (74 percent) have designated an entity specifically for FRDAA  implementation. Agencies that indicated they had a designated entity for  implementing FRDAA indicated that they were at a mature stage of  FRDAA implementation more often than agencies without such an entity. All CFO Act Agencies  Reported on Their  Progress Implementing  FRDAA, but Reporting  Varied in Completeness  and Detail Each of the 24 CFO Act agencies reported on their progress  implementing FRDAA in their fiscal year 2017 annual financial reports to  Congress, as FRDAA requires, but the reporting varied in completeness  and detail. FRDAA specifies that, beginning in fiscal year 2017 and for the  following 2 fiscal years, agencies must include the following 11 elements  in their reports: Agencies must report their progress implementing the financial and  administrative controls required to be established by the agency,  which include (1) conducting an evaluation of fraud risks and using a  risk-based approach to design and implement financial and  administrative control activities to mitigate identified fraud risks; (2)  collecting and analyzing data from reporting mechanisms on detected  fraud to monitor fraud trends and using that data and information to  continuously improve fraud-prevention controls; (3) using the results  of monitoring, evaluation, audits, and investigations to improve fraud  prevention, detection, and response; (4) implementing the fraud risk  principle as described in the Standards for Internal Control; and (5)  implementing the OMB Circular A-123 section related to leading  practices for managing fraud risk. Agencies must report their progress identifying risks and  vulnerabilities to fraud. These include (6) payroll, (7) beneficiary  payments, (8) grants, (9) large contracts, and (10) purchase and  travel cards. Agencies must report their progress (11) establishing strategies,  procedures, and other steps to curb fraud. In August 2017, OMB updated its financial-reporting guidance in Circular  A-136, Financial Reporting Requirements, with a section on FRDAA  reporting requirements, including the reporting elements specified in the  act. While the reporting requirements in FRDAA and OMB’s guidance  list three categories of information, as noted above, we broke out the  unique requirements in each category for our assessment. As a result,  our analysis of the completeness of agencies’ annual financial reports is  based on whether they contain each of 11 specific reporting elements.  See appendix I (table 2) for additional information about these reporting  elements. The 24 CFO Act agencies each included fraud-reduction sections in their  annual financial reports as FRDAA requires but, at times, the  completeness and detail of reporting was limited because some reports  did not completely address all of the elements specified in the act. Four  agencies reported on all of the specified elements, 19 agencies reported  on more than half of the specified elements, and 1 agency reported on  fewer than half of the specified elements, according to our analysis. For  example, each of the 24 CFO Act agencies reported on their progress in  establishing financial and administrative fraud controls required by  FRDAA and OMB Circular A-123, but 7 agencies did not report on  progress in implementing the fraud risk principle in the Standards for  Internal Control. In addition, some agencies did not report on their  progress in identifying risks and vulnerabilities with respect to payroll,  beneficiary payments, and other elements specified in the act.  Specifically, 12 of the CFO Act agencies did not report on payroll, 11 did  not report on beneficiary payments, 5 did not report on grants, 9 did not  report on large contracts, and 7 did not report on purchase and travel  cards. See figure 6 for an analysis of the inclusion of required FRDAA  reporting elements in agency reports. Variation in reporting on progress in identifying specific risks and  vulnerabilities could result from some agencies’ determinations about  their applicability to the agency. For example, some agencies that  participated in our roundtable discussion noted that grant risks are not  applicable to their agency because they do not have grant programs.  However, this would not explain some areas of risk that are applicable to  all agencies, but were not reported, such as payroll. As discussed later in  this report, variation in reporting on progress in identifying specific risks  and vulnerabilities may also be partly due to some agencies’ uncertainty  about what information must be reported. The reports also varied in terms of detail provided about agencies’ efforts,  including specific actions taken to implement elements of FRDAA. For  example, one agency reported that its efforts to comply with the fraud risk  principle in the Standards for Internal Control included implementing  enterprise risk management (ERM) and establishing a policy for having a  common risk assessment tool to ensure consistency across the agency  and to determine appropriate mitigation strategies for risks identified in all  programs. Conversely, another agency reported that it updated an annual  entity-level control assessment to comply with this principle, but the  agency did not describe how this update achieved compliance. Without  this detail in the report, it is not possible to determine the extent of the  agency’s implementation progress, as we describe later in the report. Further, most (16 of the 24 CFO Act agencies) included details about  financial fraud risks but did not address nonfinancial fraud risks. For  example, one agency reported it had low fraud risk and, as such, did not  implement any new controls in response to FRDAA. As support, the  agency provided examples of identifying no or limited financial fraud risks,  and concluded that it did not have fraud risks to address. The agency did  not discuss nonfinancial fraud. However, a 2016 GAO report identified  this agency as having vulnerabilities to nonfinancial fraud that present  national security risks. In addition, a 2017 report recommended that two  agencies responsible for a program with national security–related  responsibilities conduct joint fraud risk assessments to obtain  comprehensive information on inherent fraud risks that may affect  program integrity; provide reasonable assurance that their controls  mitigate those risks; and ensure that fraud-prevention efforts target the  areas of highest risk. However, one of these agencies did not mention  nonfinancial fraud in its report. Further, neither agency identified this  program in their report. As mentioned in the Fraud Risk Framework,  nonfinancial fraud, such as fraudulently obtained credentials, can  potentially facilitate other crimes related to national security such as  international terrorism and drug trafficking. In addition, a leading practice  of the Fraud Risk Framework is that managers consider nonfinancial  effects of fraud, such as those related to the program’s reputation and  compliance with laws, regulations, or standards. As discussed later in this  report, these limitations in agency reporting may be partly due to limited  guidance provided by OMB to agencies regarding the level of detail and  type of information that should be included in the reports. Agencies Identified  Challenges Undertaking  Fraud Risk Management  Activities Agencies identified challenges undertaking some fraud risk management  activities required by FRDAA, according to our analysis of survey and  roundtable responses. Top identified challenges were generally related to  staffing and resources, among other things. These challenges may affect  agencies’ ability to implement leading practices from the Fraud Risk  Framework. Some roundtable participants also noted strategies for  mitigating some of these challenges. The factors agencies most  frequently indicated as great or moderate challenges in undertaking fraud  risk management activities include the following: Availability of resources. Agencies most frequently noted the  availability of resources, such as staffing and funding to conduct fraud  risk management activities, as a challenge to managing fraud risk.  About 75 percent of agencies indicated in their surveys that this was a  great or moderate challenge. Agencies that participated in our  roundtable discussion identified similar “bandwidth” concerns related  to staffing. For example, one agency noted the ability of staff to  manage multiple responsibilities—such as conducting fraud risk  management activities in addition to daily program-related activities— as a top challenge, especially within smaller units of the agency.  Some agencies at the roundtable discussion told us that having the  authority to use program-integrity funding for fraud risk management  would help provide necessary resources to undertake fraud risk  management activities required by FRDAA. However, one agency  noted that this may not be a viable solution for all agencies, since not  all agencies may receive additional program-integrity funding to  conduct fraud risk management activities. Limited tools and techniques for data analytics. Most agencies  (about 68 percent) indicated that limitations in having and using tools  and techniques for data analytics were a great or moderate challenge,  according to our survey. Using data analytics to manage fraud risk is  a leading practice in the Fraud Risk Framework. While one agency at  our roundtable discussion told us that the agency does not have  software to assist staff in performing data analytics, other agencies  suggested leveraging free or existing resources to gain access to and  use data tools. For example, one agency representative described the  usefulness of the Department of the Treasury’s Do Not Pay Business  Center. This agency representative noted that the Department of the  Treasury can proactively analyze agency data it has received and  share it with agencies. Another agency suggested that agencies ask  their shared service providers to provide data analytics, provide  insight, and benchmark against other agencies. Lack of available expertise. The availability of staff with expertise to  conduct fraud risk management activities also presents challenges for  agencies. Leading practices in the Fraud Risk Framework include  designating an antifraud entity that serves as the repository of  knowledge on fraud risks and controls and increasing managers’ and  employees’ awareness of potential fraud schemes through training  and education. About 56 percent of agencies we surveyed, however,  identified availability of staff expertise as a great or moderate  challenge. Agencies that identified this as a challenge also more  frequently indicated that they experience some other challenges  associated with FRDAA implementation, such as understanding  FRDAA requirements and implementation time frames; reporting on  implementation progress in the annual financial reports; and  sufficiency of other information or tools to aid in implementation.  During the roundtable discussion, some agencies also described  having a staffing gap where data-analytic skills were concerned. In  response to this challenge, one agency moved its centralized  antifraud unit to a newly created, more-experienced unit within the  agency to increase the antifraud unit’s capacity to conduct data- analytics reviews. Access to data and information. A majority of agencies also  identified having access to data to look for fraud or fraud indicators as  a challenge. About 55 percent of agencies indicated that access to  data is a great or moderate challenge to their ability to implement  fraud risk activities. Agencies that participated in our roundtable  discussion also told us that access to data is a key challenge  associated with implementing FRDAA requirements. For example,  one agency stated that the Privacy Act presents a challenge to data  matching that may limit agencies’ ability to share data with one  another, such as Social Security numbers involved in potentially  fraudulent activity that could cut across multiple agencies. This  challenge is not new. In our July 2013 report on using data analytics  for oversight and law enforcement and in our March 2017 report on  using data analytics to address fraud and improper payments, we  reported on similar perceived challenges from other agencies and  organizations regarding data sharing among agencies. Some agencies at the roundtable discussion also stated that they did  not receive information from their respective Office of Inspector  General that would help them manage fraud risks and implement  FRDAA. The Fraud Risk Framework highlights the role of the Office of  Inspector General in agencies’ fraud risk management activities.  According to the framework, the Office of Inspector General itself  should not lead or facilitate fraud risk assessments, in order to  preserve its independence when reviewing the program’s activities.  However, the framework notes that program managers and their  Office of Inspector General should collaborate and communicate to  help improve understanding of fraud risks and identify emerging fraud  risks, in order to proactively enhance fraud-prevention activities. While  one agency at the roundtable discussion identified the lack of  information from their Office of Inspector General limiting their ability  to address fraud risks, some agencies appear to be reaching out to  their respective Offices of Inspector General for this information. We  spoke with the Council of the Inspectors General on Integrity and  Efficiency, which comprises representatives of Offices of Inspector  General in the executive branch. During the Council of the Inspectors  General on Integrity and Efficiency meeting, representatives from  three agency Inspectors General told us that their agencies reached  out to them to discuss fraud, such as how an agency can use  databases to look for fraud. At least one representative expected to  coordinate with the representative’s agency to strengthen internal  controls as the agency continues to implement FRDAA. OMB Established  Guidelines and a  Working Group as  Required by FRDAA,  but Limited Details  and Coordination  Hindered Agencies’  Implementation of the  Act OMB has taken steps to establish guidelines and a working group for  agencies, as required by FRDAA, but limited guidelines and working- group coordination hindered some agencies’ implementation of the act.  Specifically, OMB issued guidelines for agencies to implement FRDAA’s  requirement to establish controls and report on their progress and has  established a FRDAA working group, but agencies indicated the need for  additional guidance and involvement in working-group activities. Our  analysis of survey responses, roundtable discussion results, and  agencies’ annual financial reports indicates that (1) agencies had mixed  perspectives on the usefulness of OMB’s guidelines for agencies to  establish controls; (2) limited details in OMB’s reporting guidelines  contributed to CFO Act agencies’ incomplete and insufficiently detailed  annual financial reports; and (3) agencies had challenges implementing  FRDAA in part due to their lack of involvement in and lack of  communication from the working group. In addition to FRDAA, OMB has  issued guidance on other government-wide reform and burden-reduction  initiatives that could shape how agencies address FRDAA  implementation, such as reforms that may change the structure of  agencies and related programs or how agencies collect data used in  managing fraud risks. While it is still too early to determine the effect of  these broader initiatives on agencies’ efforts to implement FRDAA, we  have previously reported that broader reform efforts can be leveraged by  OMB and agencies to address the high-risk areas and government-wide  challenges that present vulnerabilities to fraud, waste, abuse, and  mismanagement. OMB Updated Existing  Guidelines to Meet  FRDAA Requirements, but  Agencies Have Mixed  Perspectives on the  Guidelines’ Usefulness To comply with FRDAA, OMB updated existing guidelines for agencies to  establish financial and administrative controls to manage fraud risks, but  agencies indicated having challenges with the usefulness of these  guidelines, according to our survey and roundtable discussion results.  Specifically, OMB incorporated guidelines to meet FRDAA requirements  into its July 2016 update of Circular A-123, Management’s Responsibility  for Enterprise Risk Management and Internal Control, within 90 days of  enactment, as required by the act. This particular update of Circular  A-123 introduced requirements for agencies to implement ERM and  integrate with existing internal control capabilities to improve mission  delivery, reduce costs, and focus corrective actions on key risks. The  update to Circular A-123 also included a discussion of the Fraud Risk  Framework and aligned internal control processes with the 2014 update  to the Standards for Internal Control—such as the reference to the fraud  risk principle (Principle 8)—which OMB staff stated provided agencies  with a broad context for why fraud risk management is expected of  agencies. According to OMB staff, including the reference to the Fraud Risk  Framework in the circular met the FRDAA requirement to issue guidelines  for agencies to establish financial and administrative controls to identify  and assess fraud risks. The guidelines have a section on “Managing  Fraud Risks in Federal Programs” that encourages agencies to develop  the same financial and administrative controls that are listed in FRDAA  requirements. This section also directs agencies to adhere to the leading  practices described in the Fraud Risk Framework as part of their efforts to  effectively design, implement, and operate an internal control system that  addresses fraud risks. However, based on our review of the guidance,  because FRDAA is never mentioned in the guidelines, there is a risk that  agencies may not be aware that the guidelines directly apply to  implementing FRDAA’s requirement to establish financial and  administrative controls. In addition, OMB’s guidelines provide limited  information related to steps that agencies should take to implement  FRDAA’s requirement to establish financial and administrative controls,  according to our review of the guidelines. Agencies indicated having mixed views on the sufficiency of OMB’s  guidelines. For example, 65 percent of the agencies surveyed indicated  that OMB’s Circular A-123 guidelines were moderately or very useful.  However, 40 percent of the agencies surveyed also identified the  sufficiency of OMB’s guidelines as a great or moderate challenge in  implementing the act. Among other things, these challenges included  agencies’ uncertainty about how ERM and FRDAA requirements differ,  given that OMB included the guidelines for managing fraud risk as a  subsection of ERM requirements. These challenges contributed to  agencies’ lack of clarity, among other things, on the actions they should  take to implement FRDAA, as described below. Challenges using OMB guidelines to implement FRDAA’s  requirement to establish controls. Some agencies indicated that using  OMB guidelines for FRDAA implementation was a challenge, according to  our analysis of survey responses. Specifically, 40 percent of agencies  indicated the sufficiency of the guidelines was a great or moderate  challenge to their implementation efforts. CFO Act agencies reported  this challenge more often than non–CFO Act agencies (61 and 30  percent, respectively). Selected Agency Officials’ Perspectives on  Office of Management and Budget (OMB)  Fraud Reduction (FRDAA) and Data  Analytics Act of 2015 Guidelines  “What does compliance mean specifically  when it comes to FRDAA?”  “aving looked at other guidance that’s  come out of OMB, particularly like the DATA  Act or even ERM [enterprise risk  management], there was lots of guidance. . . .  In this particular case I think it has not been  as robust” Lack of guidance and unclear requirements were also identified as top  challenges in our roundtable discussion on implementation of FRDAA  required controls. For example, some roundtable participants stated that  clearer requirements, such as information on what activities would be  considered compliant with the act, would be helpful to better implement  FRDAA. In particular, two agencies identified grants and contracts as an  area where additional guidance on managing fraud risks would be helpful. In contrast, a theme of the roundtable discussion was that there were  trade-offs in having clarity on the objectives and having the flexibility to  tailor requirements to different programs. One roundtable participant said that agencies had different definitions of fraud and that it would be difficult  to create standardized tools that met every agency’s needs. In order to  better understand what steps they should take to implement the controls  required by FRDAA, two roundtable participants sought out alternative  sources of information to determine whether they were complying with  Circular A-123, such as a previously issued GAO report on the Fraud  Risk Framework. Other roundtable participants described using non-OMB  guidance to implement FRDAA, such as the ERM playbook developed by  the CFO Council and Performance Improvement Council, and materials  developed by the Association of Certified Fraud Examiners. While relying  on other sources of information can be helpful, agencies that do not have  knowledge of or access to additional resources such as these may not  have sufficient information to effectively implement the act. This point is  underscored by the 40 percent of agencies that identified the sufficiency  of OMB’s guidance as a great or moderate challenge to their  implementation of FRDAA. Selected Agency Officials’ Perspectives on  Office of Management and Budget Fraud  Reduction and Data Analytics Act of 2015  (FRDAA) Guidelines  “I would like some clarification on the intent of  , like what will it achieve that the  other  A-123 or ERM [enterprise risk  management] is not achieving?” Uncertainty about the difference between ERM and FRDAA  requirements. Many agencies are leveraging existing ERM processes to  implement fraud risk activities, according to our survey results, but OMB  guidelines were unclear on the relationship between FRDAA and ERM  requirements, according to our review of the guidelines and roundtable  discussion responses. Under ERM, agencies are required to assess the  full spectrum of an organization’s risks, and identify those that are  enterprise-level risks. For enterprise risks, agencies are expected to rate  those risks in terms of impact and build internal controls to monitor and  assess the risk developments at various time points and incorporate risk  awareness into the agencies’ culture and operations. Our survey results  indicate that more agencies (56 percent) are currently incorporating fraud  risk activities into broader ERM compared with before FRDAA enactment  in June 2016 (34 percent). Additionally, some roundtable participants  stated that they leveraged their existing ERM process and teams to  implement FRDAA’s control requirements. While Circular A-123 directs  agencies to assess fraud risks as part of a broader assessment of  enterprise risk, it does not provide information on how ERM and fraud risk  management requirements differ. For example, it does not clarify that  FRDAA encompasses a broad set of actions that agencies must take to  manage fraud risks, regardless of whether the fraud risk is identified as  an enterprise risk. Additionally, Circular A-123 does not specify how to implement the  strategies identified in the Fraud Risk Framework within the context of  ERM. According to the circular, managers should adhere to the leading  practices identified in the framework and are responsible for determining  the extent to which the leading practices are relevant to their program.  Managers are also responsible for tailoring the practices to align with the  program’s operations. While the Fraud Risk Framework does state that  the leading practices can be tailored, it enumerates four components and  overarching concepts that are necessary for an effective risk  management approach. These four components of the framework— commit, assess, design and implement, and evaluate and adapt— collectively encompass the control activities for managing fraud risks and,  as outlined in the framework and Standards of Internal Control, should be  present in some form to be effective. Therefore, even if agency officials  identify fraud risks in a particular program that are not determined to be  enterprise-level risks, the officials are still responsible for designing and  implementing controls to address them and evaluating and adapting  improvements to these controls over time, in line with the Fraud Risk  Framework requirements. However, OMB staff informed us that if a fraud  risk does not rise to the level of an enterprise risk for an agency in the  ERM process, the agency may not go through all of the steps outlined in  the Fraud Risk Framework or required by FRDAA to assess and respond  to that risk. The Fraud Risk Framework acknowledges that agencies may  use initiatives like ERM efforts to assess their fraud risks, but it does not  eliminate the separate and independent fraud risk management  requirements of FRDAA. In response to our draft report, OMB staff stated that other parts of  Circular A-123 helped to fulfill their requirement to establish guidelines for  agencies to establish financial and administrative controls. According to  OMB, if agencies identify fraud risks that are not discussed in ERM, they  will still be addressed by the broader risk management requirements in  Circular A-123. These other sections of Circular A-123 existed prior to  FRDAA and therefore, were not developed in response to FRDAA’s  requirement that OMB establish guidelines for agencies. However, our  review of Circular A-123 found that there are some references to  managing fraud risks that are in alignment with the spirit of the financial  and administrative controls identified in FRDAA. For example, other sections of Circular A-123 describe requirements for agencies to develop  a risk profile and state that agency risk profiles must include an  operational objective related to administrative and major program  operations, including financial and fraud objectives. Further, agencies  should identify the existing management process that will be used to  implement and monitor proposed actions to address the risks. However,  according to Circular A-123, these sections of the document define  management’s responsibilities for ERM, which is focused on enterprise  level risks. Further, these sections of Circular A-123 do not encourage  agencies to incorporate the leading practices outlined in the Fraud Risk  Framework to manage their fraud risks, as required by FRDAA. According to OMB staff, if agencies identify fraud risks that are not  discussed in ERM, they will still be addressed by the broader risk  management requirements in Circular A-123. These other sections of  Circular A-123 existed prior to FRDAA and therefore were not developed  in response to OMB’s requirement to provide guidance on FRDAA.  However, our review of Circular A-123 found that there are some  references to managing fraud risks that are in alignment with the spirit of  the financial and administrative controls identified in FRDAA. For  example, other sections of Circular A-123 describe requirements for  agencies to develop a risk profile and state that agency risk profiles must  include an operational objective related to administrative and major  program operations, including financial and fraud objectives. Further,  agencies should identify the existing management process that will be  used to implement and monitor proposed actions to address the risks.  However, according to Circular A-123, these sections of the document  define management’s responsibilities for ERM, which is focused on  enterprise-level risks. Further, these sections of Circular A-123 do not  encourage agencies to incorporate the leading practices outlined in the  Fraud Risk Framework to manage their fraud risks, as required by  FRDAA. In addition, OMB staff stated that they believe that, along with Circular  A-123, the Standards for Internal Control and the Fraud Risk Framework  provide all the guidance that agencies need to implement and comply  with FRDAA. However, based on the results of our survey and  roundtable, we informed OMB that agencies reported experiencing  confusion about the similarities and differences between FRDAA and  other requirements, including ERM. According to OMB staff, Circular A- 123 and its focus on ERM is the appropriate place for the FRDAA  guidelines because fraud is one type of risk an agency might face.  However, OMB staff noted that it is the agencies’ responsibility to  determine how to implement the act’s requirements in a way that aligns  with the agency’s mission, and accordingly does not have immediate  plans to update Circular A-123 to provide more-detailed guidelines for  agencies to implement the financial and administrative controls required  by FRDAA. The Standards for Internal Control state that management should  implement control activities through policies. Documentation of  responsibilities through policies and periodic review of control activities  contribute to the design, implementation, and operating effectiveness of  control activities. In addition, management should externally communicate  the necessary quality information to achieve the entity’s objectives. These  standards are practices that can assist any entity that is providing  guidance to agencies with ensuring that intended objectives are  accomplished. To better understand the type and level of detail in  guidance that agency managers need to implement management  controls, OMB and other similar oversight bodies often seek input and  comments from agencies on draft guidance. In this case, OMB staff has  not provided evidence that it consulted with agencies on whether the  update to Circular A-123 met their needs in implementing FRDAA. While  OMB staff stated they held three solicitations for agency comments on a  draft update of Circular A-123 prior to FRDAA’s enactment, they did not  obtain input from agencies on whether the updates provided the guidance  agencies needed to implement the controls in FRDAA’s final enacted  requirements. Without input from agencies, OMB does not have the information it needs  to determine what additional guidance agencies need to effectively  implement the controls required by the act. In addition, without clarifying  that FRDAA’s requirements must be addressed for all fraud risks— including those that agencies may have assessed and determined are not  enterprise-level risks—agencies may not follow through on the additional  steps of designing, implementing, evaluating, and improving controls for  their remaining fraud risks. Lastly, without additional detailed guidelines  for implementing FRDAA’s control requirements, agencies will continue to lack clarity on the actions they should take to effectively implement the  act. OMB’s Guidelines on  FRDAA Reporting  Requirements Lack  Information Needed for  Agencies to Produce  Complete and Detailed  Reports OMB updated existing guidelines to include a section on FRDAA  reporting requirements, but did not include enough information to  effectively assist agencies in producing complete and detailed reports,  according to our analysis of annual financial reports and survey and  roundtable responses. FRDAA directs agencies to report to Congress  on the progress of FRDAA implementation in their annual financial reports  for each of the 3 fiscal years after enactment. Although FRDAA does not  require OMB to establish guidelines for agencies to comply with the act’s  reporting obligations, OMB generally provides guidance to support  agencies’ annual financial-reporting requirements in Circular A-136,  Financial Reporting Requirements, and accordingly updated this  guidance to include a section on FRDAA reporting requirements first in  August 2017 and again in July 2018. There were no significant changes  to the FRDAA section of Circular A-136 in the July 2018 update. Agencies are to include in their annual financial reports to Congress their  progress in: (1) implementing the financial and administrative fraud  controls as required by FRDAA, the fraud risk principle in the Standards  for Internal Control, and the OMB Circular A-123 section related to  leading practices for managing fraud risk; (2) identifying risks and  vulnerabilities to fraud, including with respect to payroll, beneficiary  payments, grants, large contracts, and purchase and travel cards; and (3)  establishing strategies, procedures, and other steps to curb fraud.  However, as previously discussed, our analysis of the 24 CFO Act  agencies’ annual financial reports found that many reports issued in  2017—the first year of reporting—were incomplete and lacked detail.  Some agencies did not report on their progress in identifying risks and  vulnerabilities with respect to payroll, beneficiary payments, and other  elements specified in the act and did not address nonfinancial fraud risks.  In addition, according to our survey results, some agencies considered  reporting on implementation progress in the annual financial reports a  challenge. Specifically, 31 percent of agencies indicated that reporting  was a great or moderate challenge, see figure 7. Further, some of our roundtable participants indicated that they needed  more detailed guidance on what should be reported to comply with  FRDAA. In the absence of more-detailed guidance from OMB, some  agencies turned to each other for help. For example, some roundtable  participants indicated that they looked at other agencies’ annual financial  reports to see what they were reporting. While relying on other agencies’  reports can be helpful, agencies may be reviewing incomplete information  based on our review of the annual financial reports, and may not have  appropriate examples of how FRDAA information should be reported. OMB’s guidance to agencies on FRDAA reporting did not include  information on the level of detail agencies should report. The FRDAA  section of Circular A-136 is a near-exact replication of the reporting  elements listed in FRDAA and specifies the period in which agencies are  to report on their progress implementing FRDAA. According to OMB  staff, they included the content of FRDAA verbatim in Circular A-136  because the reporting requirements are outlined in the act. However, the  act provides high-level information on what should be included in agency  reports, not operational guidance on how to address the reporting  requirements, which is typically outlined in executive guidance to  agencies. Further, OMB staff informed us that they instructed agencies to  provide a status update of fraud-reduction efforts undertaken in the final  quarter of fiscal year 2016 through fiscal year 2017, but did not provide  agencies with any specific guidance on how detailed that reporting should  be in their annual financial reports. The Standards for Internal Control  state that management should implement control activities through  policies and documentation and externally communicate the necessary  quality information to achieve the entity’s objective. Until OMB provides  additional guidelines directing agencies to report more-complete and  more-detailed information related to their progress on both financial and  nonfinancial risks, some agencies may continue to report incomplete  information on their full range of fraud risks and activities they are  performing to manage these risks. On the basis of the limitations we identified in agencies’ annual financial  reports, Congress and OMB do not have complete and detailed  information about agencies’ progress implementing FRDAA’s  requirements to establish fraud controls as intended by the act. For  example, as previously mentioned, 12 of the 24 CFO Act agencies did not  report on payroll fraud risks, which are applicable to all agencies, and 16  did not report on nonfinancial risks such as effect on reputation and  compliance with laws, regulations, or standards. The agency reporting  requirement was intended to help Congress monitor the progress made  by agencies in addressing and reducing fraud risk, including the success  or failures of the guidelines created by OMB as a result of the act.  Similar to reporting requirements for improper payments, agencies’  reports on their progress implementing FRDAA serve as important  oversight tools that can be used to evaluate agency efforts to make  needed changes to their processes and policies. In the absence of  additional OMB guidelines that include more-complete and more-detailed  information for reporting on both financial and nonfinancial risks, some  agencies may continue to produce incomplete information on their full  range of fraud risks and fraud risk management activities. However, as  noted, OMB did not make changes to the FRDAA section in its July 2018  update of Circular A-136, which might have informed agencies’ 2018  reporting efforts. On the basis of FRDAA’s requirements, Congress sought 3 years of  reporting on FRDAA implementation, and therefore agencies’ obligation  to report on their progress expires after fiscal year 2019. Even if OMB  makes changes to its guidelines in 2019 to support more-complete and  more-detailed reporting, agencies would report only one time after that— in their 2019 annual financial reports, due in November 2019. We have  previously reported on the importance of reporting information that helps  facilitate proper stewardship of federal resources, congressional  oversight, transparency, and public accountability, among other things.  Without an extension of reporting requirements, Congress will not have  access to useful information through this reporting mechanism to support oversight and accountability of agencies’ progress implementing the fraud  risk management practices required by FRDAA. OMB Established a  Working Group, but  Agencies Identified  Involvement and  Information Sharing as  Challenges OMB established a working group of agencies as required by FRDAA, but  has not met all of the requirements for the working group, such as those  related to member composition, and meeting frequency. As a result of  these and other working-group limitations, agencies identified a lack of  involvement in and limited information sharing from the working as two of  the top challenges to implementing the act. As required, OMB established  a working group within 180 days of enactment to improve the sharing of  financial and administrative controls and other best practices for  detecting, preventing, and responding to fraud, including improper  payments, and the sharing and development of data-analytics techniques.  OMB also submitted to Congress—but not within 270 days of  enactment—a plan for the establishment and use of a federal interagency  library of data analytics and data sets to facilitate fraud risk management.  However, OMB did not initially include the CFO of each agency in earlier  working-group meetings, or, according to OMB, meet four times per year  in 2017 as required. The working group also did not effectively facilitate  the sharing of controls, best practices, and data-analytics techniques,  according to our survey results and roundtable discussion. OMB  encountered challenges that limited its ability to fulfill some of these  requirements, but did not take the necessary actions to implement others. Plan for data library. In May 2017, OMB submitted a letter to Congress  describing the working group’s plan to use a phased approach to  establish a federal interagency library of data analytics and data sets, as  required by FRDAA. However, OMB did not do so within 270 days of  enactment, as required by FRDAA. According to OMB’s letter, the  working group is taking a phased approach to develop the plan to  establish an interagency data library and took some steps, but identified  challenges in the process. When developing the plan, the working group  identified two challenges to developing the interagency data library: (1)  standardizing how agencies define fraud in their programs, and (2)  developing a fraud taxonomy to accurately compile fraud risks and  categories. According to the letter, to address these challenges, the  working group is creating a fraud-classification system that leverages the  existing Association of Certified Fraud Examiners fraud-classification  system. OMB’s letter also states that the working group performed an  initial inventory of existing tools and materials that will be used to  populate the first phase of the library, which is currently located in the  OMB MAX Information System. According to the letter, the working  group is partnering with agencies to identify a permanent location for the  library as well as to develop future enhancements based on the needs of  agencies. OMB stated in the letter that it plans to provide Congress  additional information once the next phase of the library is implemented. Working-group composition. FRDAA requires the working group to  include the CFO of each agency. OMB, in its role as Chair, did not involve  all of the relevant agencies in the working group by inviting them to  participate or otherwise providing access and input into the working group  as required by FRDAA, according to agencies we surveyed and our  assessment of OMB documents. In addition to the statutory  requirement, we have previously reported that early outreach to  participants to identify shared interests is a key practice for enhancing  interagency collaboration. However, OMB’s initial working-group efforts  in particular did not include some CFO Act agencies or most non–CFO  Act agencies subject to FRDAA, representing missed opportunities to  share practices and collaborate on ways to advance federal efforts to  reduce fraud, waste, and abuse. While the May 2017 letter to Congress  states that the CFO from every agency was invited to participate in the  working group, OMB staff later noted that only the 24 CFO Act agencies and the Small Agency Council representative from the CFO Council were  invited to the working-group meetings. OMB staff indicated that they did  not independently reach out to non–CFO Act agencies to invite them to  participate because they believed the Small Agency Council  representative was responsible for communicating this information to its  members. Nevertheless, FRDAA requires the working group to include  the CFO of each agency subject to the act, as well as other parties  determined to be appropriate by OMB. According to our survey results, about half of the agencies subject to  FRDAA were not at all familiar with the working group and about two- thirds did not have an entity responsible for participating in it. Non–CFO  Act agencies indicated these responses more often than CFO Act  agencies. Specifically, 71 percent of non–CFO Act agencies indicated  they were not at all familiar with the working group compared with 21  percent of CFO Act agencies. In addition, 90 percent of non–CFO Act  agencies indicated they did not have a designated person or entity  participating in the working group, compared with 29 percent of CFO Act  agencies (see fig. 8). Similarly, two roundtable participants stated that they thought the working  group was geared towards the CFO Act agencies. Most of the CFO Act  agencies that participated in our discussion noted that they had been  involved in the FRDAA working group. In contrast, almost all of the non– CFO Act agencies that participated in our discussion stated that they  were not aware of the working group. Selected Non–Chief Financial Officers  (CFO) Act Agency Officials’ Perspectives  on Lack of Communication from and  Participation in the Working Group  “There’s been nothing that I’m aware  at   Small Agency Council level that’s had  meetings or anything to give extra guidance  … and I think that would have been very  helpful. In most things in small agencies we  wait for things to trickle down from the larger  agencies if OMB [Office of Management and  Budget] doesn’t give us guidance, and we just  haven’t gotten any sort of feedback.” It is also unclear how many and which CFO Act agencies attended the  working-group meetings. In particular, OMB and agencies provided  conflicting information about which agencies attended the working-group  meetings. For example, according to one CFO Act agency roundtable  participant, the representative was invited to the first meeting and not  invited to the next. The participant further stated that the agency recently  started to receive information from OMB. However, the information OMB  provided about this agency’s involvement in working-group meetings  conflicted with this participant’s description of the agency’s attendance at  the first four meetings. Agencies identified the lack of involvement in the working group as one of  the top challenges to implementing FRDAA. Most CFO and non–CFO Act  agencies indicated that their lack of involvement was a moderate or great  challenge to implementing FRDAA (see fig. 9). Agencies that indicated  having these challenges also more frequently reported challenges with  sharing best practices and data-analytics techniques about fraud with  other agencies, which was the purpose of the working group. The need  for this coordination underscores the importance of identifying shared  interests and developing collaborative solutions to help achieve  outcomes. OMB and the working group did consult with the Offices of Inspector  General on fraud risk matters, as required by FRDAA, by including them  in working-group meetings. In OMB’s May 2017 letter to Congress, the  agency reported that the working group coordinated with the Council of  the Inspectors General on Integrity and Efficiency and other interagency  working groups to discuss and share best practices in mission-specific  areas. In addition, two agencies’ Offices of Inspector General are listed as  having attended the first four working-group meetings. This coordination  between the working group and Inspectors General—who often identify  and investigate instances of fraud in agencies—is a positive step for the  working group. Inspectors General may be able to provide agencies with  information that can assist the agencies in analyzing data for potential  fraud, such as fraud indicators. In addition, we have previously reported  that if collaborative efforts, like the working group, do not consider the  input of all relevant stakeholders, important opportunities’ for achieving  outcomes may be missed. Frequency of meetings. The working group did not meet the FRDAA  requirement to hold at least four meetings per year. OMB staff stated that  there have been eight working-group meetings to date—one in 2016,  three in 2017, and four in 2018—but these meetings do not meet the  FRDAA requirement to meet at least four times per year in 2017. As of  October 2018, OMB has shown improvements towards meeting this  particular FRDAA requirement in 2018. Specifically, the working group  has met at least four times in fiscal year and calendar year 2018, as of  October 2018. Vacant appointment positions at OMB and the agencies have slowed  efforts to establish the working group, according to OMB staff. FRDAA  requires the OMB Controller to serve as the chairperson of the working  group, but as of October 2018 the Senate has not made a confirmation  for this position. During the roundtable discussion, one participant shared  that there was a period when there was no OMB leadership and the  working group was largely silent for months. According to OMB staff, it  has also been difficult to establish agency membership of the working  group due to the lack of confirmed CFOs at some of the 24 CFO Act  agencies. As of September 2018, 7 of the 24 CFO Act agencies did not  have a CFO. However, OMB and the working group could have held the  required minimum number of meetings regardless of OMB and agency  vacancies, as evidenced by the seven meetings that were held in the  midst of these vacancies. Further, according to OMB staff, aside from the  first meeting led by the former Controller, all working-group meetings  have been led by the Deputy Controller and other OMB staff, while the  Controller position was vacant. Information sharing about controls, best practices, and data- analytics techniques. It is unclear whether OMB, as chair of the working  group, documented working-group meetings or any work products that  were developed to facilitate sharing information about financial and  administrative controls, best practices for fraud management, and data- analytics techniques. OMB staff stated that they do not have documented  minutes or notes from working-group meetings, but in August 2018 stated  that they uploaded work products to the FRDAA federal community site  on the MAX Information System website. However, apart from two  screenshots of the MAX website provided to us in February 2018, which  indicated that a fraud taxonomy was among the materials produced by  the working group, we were not able to obtain documentation of these  work products. We have previously reported that one key practice for  enhancing and sustaining agency collaboration is using plans and reports  to reinforce accountability for collaborative efforts. Without documented  discussions, plans, or reports for these collaborative meetings, OMB is  unable to share the lessons learned from the meetings with those who  cannot attend, and does not have a record of the plans and actions that  the working group has agreed to take. This documentation is also  important to maintaining the continuity of the working group’s initiatives  when leadership changes occur within the agencies and OMB. With respect to the information that was shared at some of the initial  working-group meetings, roundtable participants stated that the topics  discussed were related to the interagency data library and the working- group plan required to be submitted to Congress, as OMB described in  the May 2017 letter. For example, some participants confirmed that the  first few meetings were spent discussing ways to establish a standard  definition of fraud, the implementation plan due to Congress, and the  difficulties agencies experience in sharing data. Our survey results  indicate that most agencies identified the sufficiency of information  coming from the working group as a great or moderate challenge in their  efforts to implement FRDAA (see fig. 10). Roundtable participants also identified data access and sharing, and  inter- and intra-agency communication and collaboration, as top  challenges for implementing FRDAA. We have previously reported that  collaborative mechanisms can be used for a range of purposes such as  information sharing. Without participation in appropriately recurring  working-group meetings and documentation to facilitate information  sharing, agencies will continue to miss opportunities to learn from each  other’s experiences and share solutions for establishing financial and  administrative controls to prevent, detect, and respond to fraud risks in  their programs. FRDAA Implementation  during Broader Reforms OMB has recently issued guidance on other government-wide reform and  burden-reduction initiatives that could shape how agencies address  FRDAA implementation, such as reforms that may change the structure  of agencies and related programs or how agencies collect data used in  managing fraud risks. These changes may present challenges and  opportunities in establishing the fraud risk management practices outlined  in the FRDAA. As examples of these recent reforms, in March 2017 the  President issued an executive order requiring a proposed plan to  reorganize executive branch agencies. In April 2017, OMB provided  guidance to federal agencies for developing their reform and workforce- reduction plans, as required by the President’s executive order. Executive  Order 13781—Comprehensive Plan for Reorganizing the Executive  Branch—and other recent administration actions prompted OMB to issue  a memorandum (M-17-22), that required agencies to submit an agency  reform plan to OMB by September 2017. These reform plans were part  of the agencies’ fiscal year 2019 budget submission to OMB that included  long-term workforce reductions. In addition, OMB issued a memorandum  (M-17-26) that required agencies to streamline reporting requirements— an initial effort at removing duplicative, outdated reporting requirements,  with the goal of making the federal government more efficient and  effective. In March 2018, OMB released the President’s Management Agenda,  which provided updated information on the status of government  reorganization efforts and is connected with these reform efforts. The  President’s Management Agenda also identified a set of cross-agency  priority goals, required under the GPRA [Government Performance and  Results Act] Modernization Act of 2010, to target those areas where  multiple agencies must collaborate to effect change and report progress  in a manner the public can easily track. One of these collaborative  efforts is focused on reducing the amount of dollars lost to taxpayers  through improper payments, including payments resulting from fraud. In  addition to the President’s Management Agenda, OMB was required by  the March 2017 executive order to develop a comprehensive  government-wide reform plan, including, as appropriate,  recommendations for both legislative proposals and administrative  actions based on agency reform plans, OMB-coordinated crosscutting  proposals, and public input. In June 2018, OMB released the government-wide reform plan, which  consists of government-wide reorganization and reform proposals with  the goal of increasing focus on integrated mission, service, and  stewardship delivery. While it is too early to tell whether or how all of  these reforms will affect agencies’ efforts to implement FRDAA, we have  previously reported that OMB and agencies can leverage these broader  reform efforts to address the high-risk areas and government-wide  challenges that present vulnerabilities to fraud, waste, abuse, and  mismanagement, or are in need of transformation. We surveyed the 72  agencies about whether their plans to implement reforms have had an  effect on their efforts to implement FRDAA. About 83 percent of the  agencies surveyed reported that they did not address aspects of their  fraud risk management in their agency reform plans. Further, OMB  reported to us that these plans are still evolving, and have not yet been  finalized. However, as we have previously reported, OMB and agencies  can consider whether (1) the agency has addressed ways to decrease  the risk of fraud, waste, and abuse of programs as part of its proposed  reforms and (2) the size of the workforce or resources dedicated to fraud  risk management activities may be affected by any of the organizational  reforms or efforts to reduce burden, and to make decisions with these  considerations in mind. Conclusions Fraud is one contributor to financial and nonfinancial risks that cost  taxpayers dollars, threaten national security, or put consumers at risk.  Therefore, agencies must take a more-rigorous preventive approach to  managing the risk of fraud in their programs. Compliance with FRDAA  provisions can support these efforts. We recognize that effective  implementation of the act will take time, and each program and agency  may evolve at a different pace. While a small number of agencies  reported being mature in their implementation of FRDAA activities, most  are in the process of developing key fraud risk activities, and others have  yet to start developing them. Wherever agencies fall on this spectrum, it is  important that they continue taking actions to enhance their ability to  prevent, detect, and respond to fraud risks in their programs and  operations. OMB plays an important role in supporting agencies’ efforts to manage  fraud risks by providing clear guidelines and facilitating agencies’  involvement with the working group. OMB has taken steps to assist  agencies, such as updating ERM guidelines and chairing working-group  meetings, but improvements to these efforts could better facilitate  agencies’ abilities to implement the act. Specifically, agencies reported  the need for additional guidance and clarity on the actions they should  take to effectively establish the required controls and report their progress  on implementation of the act’s requirements, uncertainty about the  difference between ERM and FRDAA requirements, and the need for  more involvement and information from the working group. With  enhanced guidelines from OMB and improvements to collaboration,  agencies would be better positioned to improve controls and procedures  to assess and mitigate fraud risks, as FRDAA intends. Promoting the oversight and accountability of agency fraud risk activities  through reporting is an important aspect of congressional oversight, as  agencies enhance their fraud risk management controls. However, the  progress reports submitted by agencies as part of their annual financial  reports were incomplete and lacked detailed information to effectively  inform Congress of agencies’ implementation status. Further, agencies  are only required to report their progress in implementing the  requirements of FRDAA through fiscal year 2019. However, it is not clear  that more-complete information will be reported by then. Until OMB  provides additional guidelines directing agencies to report more-complete  and more-detailed information related to both financial and nonfinancial  risks, agencies may continue to produce incomplete information on their  fraud risk management activities. Requiring agencies to report on the  progress of their implementation efforts beyond 2019 could better position  Congress to ensure oversight and accountability. Matter for  Congressional  Consideration We are making the following matter for congressional consideration. Congress should consider extending the requirement in FRDAA for  agencies to report on their implementation of fraud controls, identification  of fraud risks, and strategies for mitigating them, beyond the current 2019  expiration. (Matter for Consideration 1) Recommendations for  Executive Action We are making the following three recommendations to OMB: The Director of OMB should enhance the guidelines for agencies  to establish the controls required by FRDAA, by clarifying the  difference between FRDAA and ERM requirements, and through  collaboration with agencies to determine what additional  information agencies need to implement the controls.  (Recommendation 1) The Director of OMB should enhance FRDAA reporting guidelines  by directing agencies to report complete and detailed information  on each of the reporting elements specified by FRDAA, which  should include information related to financial and nonfinancial  fraud. (Recommendation 2) The Director of OMB should ensure the working group’s  composition meets FRDAA requirements by involving the CFO of  all agencies subject to the act by inviting them to participate or  otherwise providing access and input into the working group, and  ensure that mechanisms to share controls, best practices, and  data-analytics techniques are in place. (Recommendation 3) Agency Comments  and our Evaluation We provided a draft of this report to OMB for review and comment. OMB  staff provided oral comments that disagreed with our three  recommendations, which we summarize below. OMB staff also provided  technical comments that we incorporated as appropriate. OMB disagreed with our first recommendation that it should enhance the  guidelines for agencies to establish the controls required by FRDAA by  clarifying the difference between FRDAA and ERM requirements, and  through collaboration with agencies to determine what additional  information agencies need to implement the controls. According to OMB  staff, Circular A-123 incorporates all of the guidance that agencies need  to implement FRDAA and, outside of the current guidance in Circular A- 123 which OMB staff stated incorporates both GAO’s Standards for  Internal Control and GAO’s Fraud Risk Framework, agencies are in the  best position to make decisions about how they should implement  FRDAA.  Further, OMB staff stated that they did not believe that our  survey of the 72 agencies and the roundtable with the 14 agencies  provided sufficient evidence that a change in their guidance is needed  because these responses are based on agencies’ opinions. While Circular A-123 contains a section on Managing Fraud Risks in  Federal Programs, we identified important limitations to that section of  guidance in our report. In its comments on our report, OMB staff stated  that other parts of Circular A-123 provide guidance on FRDAA  requirements. These sections of Circular A-123 existed prior to FRDAA  and therefore, were not developed in response to FRDAA’s requirement  that OMB establish guidelines for agencies. Our review of Circular A-123  found that there are some references to managing fraud risks that are in  alignment with the financial and administrative controls identified in  FRDAA, and therefore we incorporated that additional information into our  report. However, as we reported, agencies stated that they needed  additional guidance on how to effectively establish the controls required  by FRDAA. OMB was required by FRDAA to establish guidelines.  Specifically, lack of guidance and unclear requirements were identified as  top challenges during the roundtable discussion, and the sufficiency of  OMB’s guidelines was a challenge for 40 percent of the agencies we  surveyed. OMB staff stated that they did not believe that our survey and  roundtable results are sufficient evidence to warrant a change in their  guidance because these responses are based on agencies’ opinions.  However, because the purpose of OMB’s guidance is to assist agencies  in implementing the administrative controls required by FRDAA, agencies’  experiences and perspectives on the sufficiency of the guidance is an  essential part of assessing its effectiveness. Therefore, we reiterate the  positions expressed by many agencies that they do not have sufficient  guidance on implementing FRDAA requirements related to the  establishment of financial and administrative controls. As a result, our  recommendation on improving this guidance is still warranted. OMB also disagreed with our second recommendation that it should  enhance FRDAA reporting guidelines by directing agencies to report  complete and detailed information on each of the reporting elements  specified by FRDAA, which should include information related to financial  and nonfinancial fraud. According to OMB staff, Circular A-136 is  sufficient guidance because it includes the requirements stated in  FRDAA, and incorporating this guidance into Circular A-136 was not a  requirement of the act. Although not required by FRDAA, OMB’s  guidance to agencies on FRDAA reporting is important because these  reports can be used to evaluate agency efforts to make changes to their  processes and policies. OMB Circular A-136 establishes reporting  guidance for executive branch entities required to submit agency financial  reports, among other things. Agencies were required to report on their  progress implementing FRDAA in these reports. However, FRDAA  provides high-level information on what should be included in agency  reports, not operational guidance on how to address the reporting  requirements, which is typically outlined in executive guidance to  agencies. Consequently, the initiative that OMB took to provide guidance  on FRDAA in Circular A-136 was an important step in the right direction.  However we found that the 24 CFO Act agencies’ annual financial reports  for 2017 were incomplete and lacked details, which can be attributed in  part to the limited guidance provided by OMB. We found that 31 percent  of surveyed agencies indicated that reporting on FRDAA progress was a  great or moderate challenge. The agency reporting requirement was  intended to help Congress monitor the progress made by agencies in  addressing and reducing fraud risks, including the success and failures of  the guidelines created by OMB as a result of the act. Therefore, our  recommendation to improve OMB’s reporting guidelines is still  appropriate. OMB also disagreed with our third recommendation that it should ensure  that the FRDAA working group’s composition meets the act’s  requirements by involving the CFO of all agencies subject to the act by  inviting them to participate or otherwise providing access and input into  the working group, and ensuring mechanisms to share controls, best  practices, and data-analytics techniques are in place. According to OMB  staff, they disagreed because they believe that OMB provided an  opportunity for all agencies to attend the working group meeting and they  have held four working group meetings in 2018. However, evidence  submitted by OMB throughout our review and agencies’ responses to our  survey indicate that not all agencies had the opportunity to participate in  the working group. The working group was required to include the CFOs  of every agency subject to FRDAA, including those that are not subject to  the CFO Act. However, 71 percent of non–CFO Act agencies were not at  all familiar with the working group, and ninety percent did not have a  designated person or entity that participated in the working group,  according to our survey. Moreover, 21 percent of CFO Act agencies,  which represent the largest federal agencies, were not at all familiar with  the working group, and 29 percent did not have a designated person or  entity that participated in it, according to our survey results, as of March  2018. To ensure that we obtained information from the right contacts  regarding agency participation, we surveyed the CFO or the CFO’s  designee of each agency subject to FRDAA. During our audit, OMB  indicated that it did not have a list of CFO contacts for all agencies  subject to the act, and requested that we share our list of contacts. We  have agreed to do so consistent with our protocols, upon public release of  the report. Given our findings, our recommendation for OMB to ensure  that every agency is then given the opportunity to participate is still  warranted. Our survey results also indicated that most agencies identified the  sufficiency of information coming from the working group as a great or  moderate challenge in their efforts to implement FRDAA. Further, OMB  staff stated that they do not have documented minutes or notes from  working-group meetings. As we stated in our report, without documented  discussions, plans, or reports for these collaborative meetings, OMB is  unable to share the lessons learned from the meetings with those who  cannot attend, and does not have a record of the plans and actions that  the working group has agreed to take. This documentation is also  important to maintaining the continuity of the working group’s initiatives  when leadership changes occur within the agencies and OMB. As we  previously noted, without participation in working-group meetings and  documentation to facilitate information sharing, agencies will continue to  miss opportunities to learn from each other’s experiences and share  solutions for establishing financial and administrative controls to prevent,  detect, and respond to fraud risks in their programs. Therefore, we  believe that our recommendation on ensuring mechanisms are in place to  share controls, best practices, and data-analytics techniques is still  warranted. Finally, although OMB did not hold the required number of  meetings per year in 2017, it has done so for fiscal year and calendar  year 2018, as of November 2018. Therefore, we modified our  recommendation to reflect the new actions taken. We are sending copies of this report to appropriate congressional  committees and OMB. In addition, the report is available at no charge on  the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact  Rebecca Shea at (202) 512-6722 or shear@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. GAO staff who made key contributions to  this report are listed in appendix III. Appendix I: Objectives, Scope, and  Methodology This report reviews agencies’ and the Office of Management and  Budget’s (OMB) efforts to implement the Fraud Reduction and Data  Analytics Act of 2015 (FRDAA). Specifically, it examines (1) federal  agencies’ progress and challenges in implementing fraud risk  management practices, including those required by FRDAA, and (2) the  extent to which OMB has taken steps that complied with FRDAA  requirements and that facilitated agencies’ implementation of the act. To  address both of these objectives, we developed and implemented a  government-wide survey of agencies subject to the act, conducted a  roundtable discussion with selected agencies, reviewed the 24 Chief  Financial Officer (CFO) Act agencies’ annual financial reports,  interviewed staff from OMB, the CFO Council and the Council of the  Inspectors General on Integrity and Efficiency, and reviewed relevant  OMB circulars and documents. Survey Determination of  Executive Branch  Agencies Subject to  FRDAA To determine which agencies were subject to FRDAA and subsequently  surveyed, we first sent information requests to 93 federal executive  branch entities to determine whether their organization met the definition  of “agency” in 5 U.S.C. § 551(1). FRDAA requires the CFO of each  agency to be a member of the FRDAA working group. Therefore we  identified each entity’s CFO or equivalent using publicly available  websites. We sent an email to the 93 entities’ CFO or equivalent and  GAO liaison, if present, to notify the agency that we planned to administer  a government-wide survey related to the act and requested that an official  from the entity’s Office of the General Counsel confirm whether the entity  is an “agency” as defined in 5 U.S.C. § 551(1). If the CFO was not the  official who was most appropriate to answer our survey about activities  related to the act, we requested that the agency identify who should  receive our survey. Of these 93 entities, 72 indicated they met this  definition of agency, 20 reported that they did not, and 1 entity, the  Central Intelligence Agency, did not respond. See table 1 for a list of the  72 executive branch agencies that identified themselves as being subject  to the act. Survey Questionnaire  Development To improve the response rate of agencies receiving our survey, while  mitigating respondent burden and reducing total survey error, we  developed the survey using a variety of quality-assurance techniques.  Survey error can arise from population coverage, measurement,  nonresponse, and processing errors associated with questionnaire  surveys. GAO survey specialists determined survey design parameters  and developed, tested, revised, and finalized the questionnaire, in  consultation with subject-matter experts on the engagement team. The  survey design parameters included population coverage, mode of  administration, respondent communication methods, and protection from  disclosure of identifiable information. To reduce measurement error, we pretested the questionnaire with  selected agency representatives using cognitive interviewing techniques,  such as nondirective probing of answers and asking respondents to think  aloud when formulating answers. This process allowed us to determine  whether questions were understood and answered as intended.  Specifically, pretests examined respondent issues related to  comprehension of the questions, ability to accurately respond to the  questions, perceptions of bias in the questions or scales, and  completeness of answer responses. For example, during pretesting we  probed respondents on whether our scales were appropriately balanced,  and whether individual questions were likely to be applicable to all  respondents. We conducted pretests over the phone with CFOs or other  FRDAA designated officials from three types of agencies for a total of six  agencies: two executive-department CFO Act agencies; two CFO Act  agencies that are not executive departments, and two non-CFO Act  agencies that are not executive departments. As a result of these  pretests, we made modifications to question wordings, scale categories,  and other response options to improve respondent comprehension,  reduce respondent burden, and mitigate risks of inaccurate or biased  responses. An additional survey specialist, who had not been involved in the  development of the questionnaire, also reviewed the questionnaire. We  then modified the questionnaire based on suggestions made by the  reviewer and subject-matter experts. The final version of the  questionnaire was copy edited for grammatical and editorial errors. The final questionnaire included questions designed to capture  information about FRDAA implementation government-wide and obtain a  high-level status update of agencies’ implementation of the act including,  but not limited to, the steps agencies had taken since the enactment of  the act, fraud risk management activities, challenges they have  experienced implementing FRDAA, and their perspectives about OMB’s  support of these efforts. It was composed of questions with  predetermined answer choices (closed-ended questions) and questions  without predetermined answer choices requiring written response (open- ended questions). See appendix II for survey questions and frequencies  of agencies’ responses. Survey Administration To administer the survey, we emailed each agency a fillable PDF  questionnaire. We fielded the survey from January 18, 2018, through  March 27, 2018. To follow up with agencies that did not respond to the  initial notice, we emailed or called multiple times to encourage survey  participation or provide technical assistance, as appropriate. We received  usable questionnaire responses from all 72 agencies, for a response rate  of 100 percent. Because this survey was sent to all agencies that were  identified as being subject to FRDAA, there is no error as a result of  sampling, and results cover the entire population. However, the practical  difficulties of conducting any survey may also introduce other types of  errors, commonly referred to as nonsampling errors. For example,  difficulties in how a particular question is interpreted, in the sources of  information available to respondents, or in how the data were entered into  a database or analyzed can introduce unwanted variability into the survey  results. With this survey, we took a number of steps to minimize these  nonsampling errors. For example, our staff with subject-matter expertise  designed the questionnaire in collaboration with our survey specialists,  and all questions were cognitively pretested with knowledgeable  respondents. When the survey data were received from agencies and  analyzed, a second independent analyst on our staff verified the analysis  programs to ensure the accuracy of the code and the appropriateness of  the methods used for the computer-generated analysis. Since this was an  electronic survey, respondents entered their answers directly into the  questionnaire, thereby mitigating the need to have the data keyed into a  database, thus avoiding a source of data-entry error. Roundtable  Discussion To collect information about agencies’ experiences implementing FRDAA,  we also facilitated a roundtable discussion with selected agencies subject  to FRDAA that had completed the survey. The purpose of the roundtable  discussion was to obtain agency officials’ perspectives on  the strategies and activities used to establish fraud controls and  related fraud risk management activities;  the guidance and resources used to facilitate the implementation of  FRDAA;  their challenges in implementing FRDAA; and potential solutions to improve implementation of the act, including any  additional guidance or resources that may be useful to implementing  the act. We randomly selected and invited a diverse group of agencies that are  subject to FRDAA. We planned for a group of agencies that were diverse  in terms of the following:  1.  agency type, such as whether the agency was a CFO Act agency, an  executive department or non–executive department, and membership  in the Small Agency Council; and  2.  FRDAA implementation status as indicated by their responses to two  survey questions. These two survey questions were “overall, what is  the status of your agency-wide efforts to implement FRDAA” and “as  of today, does your agency do the following to manage fraud risk at  the agency-wide level.” We used the survey responses to divide  agencies into two groups, a more-mature implementation group and a  less-mature implementation group. We invited a total of 27 agencies to participate in our roundtable, an initial  group of 20 agencies and 7 backup agencies. Fourteen agencies  attended our roundtable: six executive-department CFO Act agencies;  two CFO Act agencies that are not executive departments; and six Small  Agency Council member agencies. Agency representatives included  agency officials with responsibility for antifraud activities, including either  the agency’s CFO, Chief Risk Officer, or other staff responsible for fraud  risk management activities. The roundtable discussion was held March 26, 2018, and included three  sessions: an opening session, a breakout session, and a closing session.  In the opening session, all 14 of the roundtable participants were given an  overview of our researchable questions and the agenda for the day. Then  the agencies were split into two breakout groups based on their response  to our survey questions about the maturity of their implementation of  FRDAA. In the two breakout groups, roundtable participants discussed  the guidance and resources they used for implementation of the act, their  approaches used for implementation of the act, and the strategies and  challenges associated with implementation of the act. In each breakout  group, roundtable participants identified and voted on their top challenges  in implementing FRDAA. After the breakout session, GAO facilitators and  subject-matter experts on the engagement team then met to create a new  list of the top voted challenges of both groups as well as any crosscutting  challenges. Finally, in the closing session, all 14 agencies came back  together to recap the breakout discussions and have a broader  discussion about experiences of successful implementation and potential  solutions to improve implementation, including any additional guidance or  resources that may be useful to implementing the act. Roundtable  participants identified and voted on their top challenges to implementing  FRDAA. These results are not generalizable to agencies beyond the 14  that participated. Fiscal Year 2017  Annual Financial  Reports To further assess steps that agencies have taken to implement fraud risk  management practices, as required by FRDAA, we also reviewed the  fiscal year 2017 annual financial reports for the 24 agencies subject to the  CFO Act. FRDAA required agencies to report to Congress on the status  of their efforts to implement financial and administrative controls that  incorporate leading practices from GAO’s Fraud Risk Framework, identify  fraud risks, and establish strategies to mitigate fraud in these reports. We  selected these 24 agencies because they were known at the time of our  selection to be agencies that were subject to FRDAA, and are estimated  to account for over 99 percent of the government-wide improper  payments in fiscal year 2015. These agencies also are required to  submit their reports directly to GAO. We conducted a content analysis to  determine the completeness and quality of the information provided in  these reports related to these FRDAA requirements. Because content analysis relies on the judgment of coders to determine  whether qualitative data reflects particular categories, we took several  steps to ensure that this judgment remained objective, accurate, and  consistent. Prior to beginning the content analysis, we worked with  subject-matter and legal experts to develop a codebook and definitions  for the different kinds of information that FRDAA requires agencies to  report, as well as supplemental coding categories related to leading  practices in fraud risk management identified in our framework. In order to  test the clarity of these codes, we had four independent analysts pretest  the content analysis on two annual financial reports, and found high levels  of interrater reliability. Specifically, each of the categories had at least 95  percent agreement between coders. As a result to this pretest, minor  changes were made to the category definitions. We used two independent coders within GAO to ensure consistent  judgment of categories. For the content analysis, each of the 24 annual  financial reports was coded by two independent analysts, including one  subject-matter expert familiar with fraud risk management and another  familiar with each of the CFO Act agencies. Agreement among coders  exceeded 99 percent across all of the coding categories. On the basis of  this high level of agreement between coders, we are confident that our  content analysis represents an objective, accurate, and consistent  assignment of these coding categories. Because these coding categories  would be further reviewed in making our determinations about  completeness and detail, we decided to resolve any intercoder  disagreements by keeping all coded material for that review. To assess the completeness of agencies’ reporting on FRDAA  implementation, we broke out the unique requirements in each of the  three broad categories outlined in FRDAA’s reporting requirements. As a  result, our analysis included an assessment of 11 coding categories,  which are listed with their definitions in table 2 below. An element was  considered present if the corresponding code was applied one or more  times in the annual financial reports, and missing if the corresponding  code was applied zero times. Each annual financial report was then  categorized into one of four categories of completeness, based on these  assessments:  1.  Fully complete: agencies with reports that contained information on all  11 elements.  2.  Mostly complete: agencies with reports that contained information on  6–10 elements.  3.  Partially complete: agencies with reports that contained information on  1–5 elements.  4.  Not at all complete: agencies with reports that contained information  on 0 elements. In addition to assessing whether the annual financial report contained  these elements, as required by FRDAA, we also reviewed the content of  each of these coding categories, as well as additional categories related  to leading practices in fraud risk management. In order to demonstrate  the range of the quality and level of detail provided for each element, and  for the overall reporting on fraud risk management efforts, we reviewed  the specific coded excerpts in NVivo for each agency and summarized  the level of detail, length, and other observations specific to each  category. To address our second objective, determining the extent to which OMB  has taken steps that complied with FRDAA requirements and that  facilitated agencies’ implementation of the act, we reviewed relevant  documents produced to support the implementation of FRDAA. We also  assessed the extent to which the guidelines were consistent with leading  practices from the Fraud Risk Framework and the Standards for Internal  Control in the Federal Government. To determine the extent to which OMB has taken steps that complied with  FRDAA requirements and facilitated agencies’ implementation of the act,  we did the following:  1.  We interviewed staff from OMB’s Office of Federal Financial  Management and Office of Personnel and Performance Management  regarding their development of guidelines, the working group, and any  challenges OMB may have experienced while implementing the act’s  requirements, to determine the extent to which OMB’s efforts to  facilitate agency implementation of the act were viewed as helpful by  agencies.  2.  We reviewed relevant memorandum, circulars, and other OMB  documents including Circular A-123, Management’s Responsibility  for Enterprise Risk Management and Internal Control, and Circular  A-136, Financial Reporting Requirements, and compared these with  the requirements for OMB outlined in FRDAA.  3.  We evaluated agencies’ perspectives and experiences using OMB’s  guidelines and other initiatives to implement the act by assessing our  survey responses, annual financial-report analysis, and roundtable  discussion for responses related to OMB guidelines and other efforts,  and related strengths and challenges.  4.  We also interviewed officials from the CFO Council and Council of the  Inspectors General on Integrity and Efficiency to get a broader opinion  about the effectiveness of OMB and agency efforts to implement  FRDAA. We conducted this performance audit from August 2017 to December  2018 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. Appendix II: Results of GAO’s Survey on  Agencies’ Implementation of the Fraud  Reduction and Data Analytics Act of 2015 To obtain information about the extent to which executive branch  agencies have taken steps required by the Fraud Reduction and Data  Analytics Act of 2015 (FRDAA), we identified 72 agencies subject to the  act and surveyed these agencies about their fraud risk management  practices and related challenges. We received responses from all 72  agencies, for a response rate of 100 percent. The questions we asked in  our survey and the percentage of agencies’ responses are shown below.  Our survey was composed of questions with predetermined answer  choices (closed-ended questions) and questions without predetermined  answer choices requiring written response (open-ended questions). In  this appendix, we include all survey questions and results of responses to  the closed-ended questions; we do not provide information on responses  to open-ended questions. The tables below represent the percentage of agencies’ responses to the  close-ended questions. The percentages we report are rounded to the  nearest whole number. For a more-detailed discussion of our survey  methodology, see appendix I. Survey question 13: What other information, if any, should GAO know  about your agency’s efforts to implement FRDAA or manage fraud risks?  (open-ended response) Survey question 14: Do you have any additional explanations for your  answers or comments on any of the issues in this questionnaire?   (open-ended response) Survey question 15: Please enter the contact information for the primary  person who completed this survey. (open-ended response) Appendix III: GAO Contact and Staff  Acknowledgments GAO Contact Staff  Acknowledgments In addition to the contact named above, Latesha Love (Assistant  Director); Georgette Hagans (Analyst in Charge); Sarah Cantatore, Joy  Kim, Grant Mallie, James Murphy, Eve Nealon, Steven Putansu, Kristen  Timko, and Shana Wallace made key contributions to this report. Other  contributors include Marcus Corbin, Carrie Davidson, Colin Fallon,  Barbara Lewis, and Maria McMullen.
Fraud poses a significant risk to the integrity of federal programs and erodes public trust in government. Implementing effective fraud risk management processes can help ensure that federal programs fulfill their intended purpose, spend their funding effectively, and safeguard assets. FRDAA requires agencies to establish internal controls to manage their fraud risks and to report implementation progress for the first 3 years after enactment. It also directs OMB to (1) develop guidelines for agencies to establish fraud risk management controls and (2) establish a working group to share best practices in fraud risk management and data analytics. GAO was asked to review agencies' and OMB's efforts to implement FRDAA. This report examines steps (1) agencies and (2) OMB have taken to implement FRDAA. GAO conducted a survey of the 72 agencies subject to the act, held a roundtable discussion with 14 selected agencies, reviewed 24 selected annual financial reports, examined OMB guidelines, and interviewed OMB staff. At varying stages, agencies have begun planning for and implementing fraud risk activities (like conducting an evaluation of fraud risks) required by the Fraud Reduction and Data Analytics Act of 2015 (FRDAA), according to GAO's survey of agencies subject to the act. Overall, most of the 72 surveyed agencies (85 percent) indicated that they have started planning how they will meet FRDAA requirements, and about 78 percent indicated that they have also started taking steps to implement the requirements. To assist agencies in implementing fraud risk management activities, the Office of Management and Budget (OMB) established FRDAA-related guidelines and a working group, as required by the act. However, agencies experienced challenges with OMB's guidelines and the working group, among other things, according to GAO's survey and roundtable discussion results (see figure below). Implementation guidelines. To meet FRDAA requirements, OMB updated Circular No. A-123 guidelines that govern executive agencies. However, this update included limited information on the methodologies agencies can use to assess, document, and report on internal controls required by FRDAA, according to GAO's review of the guidelines. Surveyed agencies had mixed perspectives on the usefulness of OMB's guidelines for implementing FRDAA controls. Similarly, agencies identified the lack of clear requirements and guidance as top challenges in GAO's roundtable discussion with 14 selected agencies. Reporting on implementation progress. Although not required by FRDAA, OMB updated annual financial report guidelines to include FRDAA requirements, but GAO found that the guidelines did not contain enough information to aid agencies in producing complete and detailed progress reports in 2017, the first year of reporting. Additional guidelines from OMB could help agencies produce more complete and detailed reports for 2019, the final year of required reporting. Without a longer reporting period, however, Congress may not have the useful information for continued oversight of agencies' progress. Working Group. OMB has taken steps to establish the working group, but GAO found the working group did not fully meet FRDAA requirements. As Chair, OMB did not (1) involve all agencies subject to the act in the working group or (2) hold the required number of meetings in 2017. Most surveyed agencies indicated a lack of involvement with and information from the working group as challenges in implementing FRDAA.