Control activities  include both preventive and detective controls. DOE  officials cite the Cooperative Audit Strategy as a key internal control. federal agencies are required to review all programs and  IPERA requires that agencies, in performing their risk assessments, take  into account those risk factors that are likely to contribute to significant  improper payments, such as  1.  whether the program or activity reviewed is new to the agency;  2.  the complexity of the program or activity reviewed, particularly with  respect to determining correct payment amounts;  3.  the volume of payments made annually;  4.  whether payments or payment eligibility decisions are made  outside of the agency, for example, by a state or local  government, or a regional federal office;  5.  recent major changes in program funding, authorities, practices, or  6.  the level, experience, and quality of training for personnel  responsible for making program eligibility determinations or  certifying that payments are accurate; and  7.  significant deficiencies in the audit reports of the agency including  but not limited to the agency Inspector General or the Government  Accountability Office report audit findings or other relevant  management findings that might hinder accurate payment  certification. DOE concurred  with this recommendation. DOE Developed a Process for Assessing Improper Payment Risks, but Those Assessments Do Not Fully Evaluate Risk

DOE developed a process to assess its programs for risks of improper  payments in fiscal year 2011 that included both a qualitative risk  assessment and quantitative information on improper payments. However, based on our evaluation of the department’s fiscal year 2011  risk assessment process, we found that DOE did not prepare risk  assessments for all of its programs, and the quantitative information  reported was not reliable; DOE’s risk assessments did not always include  a clear basis for the risk determination; and DOE’s risk assessments did  not fully evaluate other relevant risk factors. Another revision directs DOE’s Loan Guarantee Program  Office to prepare a risk assessment for DOE’s loan programs. For those that did, the support for their conclusions varied widely,  and some assessments did not contain enough information for us to  determine how the payment sites arrived at their risk determination. Based on our analysis, we determined that at least 6 of the 29 sites that  prepared risk assessments did not take into account the eight risk factors,  making the basis of their risk assessment determinations unclear. However, its  guidance does not provide further direction on what should be provided in  the assessment to address each risk factor. However, the 2014 guidance does not specify how  payment sites should address each factor and what documentation they  are to include in support of their risk determinations, which is inconsistent  with federal standards for internal control. In particular, DOE’s guidance does not require programs  to consider, as part of their risk assessments, weaknesses in key controls  for preventing and detecting improper payments. However, DOE’s 2011 guidance  did not require that programs consider risk factors related to internal  control weaknesses—such as untimely contract audits or inadequate  subcontractor oversight. Without providing in its guidance specific examples of other risk factors  that present inherent risks likely to contribute to improper payments and  directing payment sites to consider those other factors when performing  their improper payment risk assessments, DOE will not have reasonable  assurance that its payment sites consistently consider other relevant risk  factors to fully evaluate risks. DOE reported that it did  not have any programs susceptible to significant improper payments in  2011. As previously discussed, we found that DOE did not fully consider  program risks in its fiscal year 2011 risk assessments and included  unreliable data, which raises questions about whether the 2011  assessments were reliable. Nonetheless, because of its 2011  determination that it did not have programs susceptible to significant  improper payments, the department was not required under IPERA to  prepare risk assessments in 2012 and 2013. Recommendations for Executive Action

To help improve its ability to assess the risk of improper payments and  make more effective use of DOE and contractor resources, we  recommend the Secretary of Energy direct the department’s Chief  Financial Officer to take the following four actions to revise the  department’s IPERA guidance: direct field office sites with responsibility for non-M&O contractor risk  assessments to address risk factors as they relate to those sites and  take steps to ensure sites implement it;  clarify how payment sites are to address risk factors and document  the basis for their risk rating determinations and take steps to ensure  sites implement it;  clarify who is responsible at DOE for reviewing and approving risk  assessments for consistency across sites and take steps to ensure  those entities implement it; and provide specific examples of other risk factors that present inherent  risks likely to contribute to significant improper payments, in addition  to the eight risk factors, direct payment sites to consider those when  performing their improper payment risk assessments, and take steps  to ensure sites implement it. Appendix I: Objective, Scope, and Methodology

This report examines the extent to which the Department of Energy  (DOE) assesses its programs’ risks for improper payments. To determine  this, we reviewed the Improper Payments Elimination and Recovery Act  of 2010 (IPERA). For fiscal years 2011 through 2013, we analyzed DOE’s IPERA reporting,  including qualitative risk assessments and quantitative information.
Why GAO Did This Study

Improper payments are a significant problem in the federal government. To address this problem, IPERA requires that federal agencies review their programs and identify those that are susceptible to significant improper payments—a process known as a risk assessment. DOE's history of inadequate management and oversight of its contractors led GAO to designate DOE's contract management as a high-risk area vulnerable to fraud, waste, abuse, and mismanagement. However, DOE reported that it does not have any programs susceptible to significant improper payments.
GAO was asked to review DOE's internal control environment, as it relates to IPERA, to determine whether the department was at low risk for significant improper payments. This report examines the extent to which DOE assessed its programs' risks for improper payments in fiscal years 2011 through 2013.
GAO reviewed IPERA, analyzed all risk assessments and related information for this period, and interviewed DOE officials and six contractors selected to represent the types of contractor payments made.

What GAO Found

The Department of Energy (DOE) developed a process to assess its programs for risks of improper payments, but its assessments do not fully evaluate risk. To comply with the Improper Payments Elimination and Recovery Act of 2010 (IPERA), in fiscal year 2011, DOE directed its programs to develop risk assessments using eight qualitative risk factors, such as recent major changes in program funding, and report quantitative information on improper payments. GAO found that 26 of 55 programs did not prepare risk assessments in 2011 and that the quantitative information reported, including the estimated amount of improper payments, was not reliable because, for example, it did not include information for all programs. In reviewing DOE's 2011 risk assessments, GAO also found the following:
DOE did not always include a clear basis for risk determinations . At least 6 of the 29 programs that prepared risk assessments did not take into account the eight qualitative risk factors, making the basis of their risk determinations unclear. At most, the assessments for 23 programs took into account the risk factors. However, support for their determinations varied widely, and some did not contain enough information to identify how the program arrived at its risk determination, which is inconsistent with federal standards for internal control. DOE's guidance directs personnel to prepare a risk assessment that considers these eight factors but does not provide further direction on what to include. Absent such direction, DOE personnel may not have a consistent understanding of how to complete their risk assessments.
DOE did not fully evaluate other relevant risk factors . DOE's risk assessments did not fully evaluate other relevant risk factors, such as weaknesses in key controls for preventing and detecting improper payments—including inadequate subcontractor oversight. GAO found that some risk assessments included information from internal control evaluations, but many did not. DOE guidance does not instruct personnel to consider weaknesses in key controls for preventing and detecting improper payments. Without providing specific examples of other relevant risk factors in guidance and directing personnel to consider them when performing risk assessments, DOE will not have reasonable assurance that each of its programs fully evaluates risks.
Based on its 2011 assessments, DOE was not required under IPERA to prepare risk assessments or report on the amount of improper payments in 2012 and 2013. However, not fully considering program risks in its 2011 assessments and including unreliable data raises questions about whether the 2011 assessments were reliable.

What GAO Recommends

GAO recommends that DOE take steps to improve its risk assessments including revising guidance on how programs are to address risk factors and providing examples of other risk factors likely to contribute to improper payments and directing programs to consider those factors. DOE concurred with GAO's recommendations.