As the steward of taxpayer dollars, the  federal government is accountable for how its agencies and grantees  spend hundreds of billions of taxpayer dollars and is responsible for  safeguarding those funds against improper payments as well as having  mechanisms in place to recoup those funds when improper payments  occur. DHS Has Made Some Progress in Implementing the Requirements of IPIA, but Remains Noncompliant

While DHS has taken actions over the last 3 fiscal years to implement IPIA  requirements, much more work needs to be done. Until DHS is able to fully assess its programs, the  potential magnitude of improper payments cannot be estimated. Over   $6 billion of this amount related to payments for grant programs. Required Risk Assessments Not Completed for All Programs for Fiscal Year 2006

Although DHS made progress in identifying its programs in fiscal year  2006, the agency did not perform a risk assessment for all programs and  activities—covering approximately $13 billion of its more than $29 billion  in disbursements subject to IPIA. Since DHS did not perform the required first step—a risk assessment—on  programs with approximately $13 billion of its more than $29 billion in  disbursements subject to IPIA, it is unknown whether these programs are  at high risk for issuing improper payments. Developing a plan to assess risk and potentially test grant payments is  important because of noted financial management weaknesses of DHS  grantees. Assessing and, if necessary, testing these grant  programs will allow DHS to gain an understanding of its risk in this area  related to improper payments and potentially reduce future improper  payments. DHS’s planning and assessment process to develop its IPIA corrective  action plan enabled the agency to update its guidance for its components  and, according to DHS, the agency plans to focus on program  identification and risk assessments during fiscal year 2007. DHS Has Developed Plans to Reduce Improper Payments for FEMA’s Two Disaster-Related Programs, but Effects Remain Unknown

In addition to its overall corrective action plan to comply with IPIA, DHS,  as required by IPIA and related OMB implementing guidance, has  developed plans to reduce improper payments related to the two high-risk  programs it identified in its fiscal year 2006 testing—FEMA’s IHP  assistance payments and disaster-related vendor payment programs. DHS’s Efforts to Comply with the Recovery Auditing Act and to Recover Improper Payments Need to Be Enhanced

For the last 3 years, DHS has contracted with a recovery auditing firm to  perform recovery audit work to comply with the Recovery Auditing Act;  however, activities in this area could be improved. Specifically, DHS  encountered problems that kept it from reporting on recovery audit efforts  during fiscal year 2006. In addition, DHS did not perform recovery auditing efforts at  the fourth component identified as meeting the criteria. However,  DHS’s internal guidance does not require components to include  information in its annual PAR related to its efforts to recover improper  payments identified during IPIA testing and, as a result, DHS has not yet  reported on its efforts to recover improper disaster-related vendor  payments identified and has reported limited information on its efforts to  recover identified improper IHP assistance payments. Having components  report this information in the annual PAR would provide a more complete  picture of the agency’s actions to recover payments that it has identified as  being improper. DHS noted that  significant actions under way include strengthening the department’s  financial management and oversight functions to improve the DHS control  environment and implementing risk assessments to build a foundation for  a sustainable IPIA program. Appendix I: Scope and Methodology

To determine to what extent the Department of Homeland Security (DHS)  has implemented the requirements of the Improper Payments Information  Act of 2002 (IPIA), we compared the IPIA legislation, and the related  Office of Management and Budget (OMB) implementing guidance, with  DHS improper payment risk assessment methodologies, and IPIA  Performance and Accountability Report (PAR) information for fiscal years  2004 through 2006.
Why GAO Did This Study

The federal government is accountable for how its agencies and grantees spend more than $2 trillion of taxpayer dollars and is responsible for safeguarding those funds against improper payments as well as for recouping those funds when improper payments occur. The Congress enacted the Improper Payments Information Act of 2002 (IPIA) and the Recovery Auditing Act to address these issues. Fiscal year 2006 marked the third year that agencies were required to report improper payment and recovery audit information in their Performance and Accountability Reports. The Department of Homeland Security (DHS) reported limited information during these 3 years. GAO was asked to (1) determine the extent to which DHS has implemented the requirements of IPIA, (2) identify actions DHS has under way to improve IPIA compliance and reporting, and (3) determine what efforts DHS has in place to recover improper payments. To accomplish this, GAO analyzed DHS's internal guidance and action plans, and reviewed information reported in its Performance and Accountability Reports.

What GAO Found

DHS has made some progress in implementing IPIA requirements, but much more work remains for the agency to become compliant with IPIA. For example, while DHS has made progress in identifying its programs, for fiscal year 2006, the agency did not perform the required first step--a risk assessment--on approximately $13 billion of its more than $29 billion in disbursements subject to IPIA. Until DHS fully assesses its programs, the potential magnitude of improper payments is unknown. For the remaining $16 billion, DHS determined that two programs-- Individuals and Households Program (IHP) assistance payments and disaster-related vendor payments--were at high risk for issuing improper payments and reported related estimates. For the $13 billion for which no risk assessment was performed, DHS has encountered challenges with IPIA implementation. Of this amount, over $6 billion relates to payments for grant programs. Developing a plan to assess risk and potentially test grant payments is important given that the DHS Office of Inspector General, GAO, and other auditors have identified weaknesses in grant programs. This will allow DHS to gain a better understanding of its risk for improper payments and potentially reduce future improper payments. DHS has actions under way to improve IPIA reporting and compliance, but does not plan to be fully compliant in fiscal year 2007. DHS has prepared a plan to address its noncompliance with IPIA, which included updating its guidance to focus on program identification and risk assessments to build a foundation for a sustainable IPIA program. In addition, DHS has developed plans to reduce improper payments related to its two identified high-risk programs. However, until DHS fully completes the required risk assessments for all of its programs and then estimates for risk-susceptible programs, it is not known whether other programs have significant improper payments that also need to be addressed. In addition, DHS's efforts to recover improper payments could be improved. According to DHS, four of its components meet the criteria for recovery auditing as specified in the Recovery Auditing Act. These four components make at least $4 billion of contractor payments each fiscal year. DHS encountered problems that kept it from reporting on recovery audit efforts during fiscal year 2006 for three of the four components, and did not perform recovery auditing at the fourth component. In March 2007, DHS revised its guidance to clarify what is expected; however, ongoing oversight will be necessary to monitor the components' progress. In addition, DHS has reported limited information on its efforts to recover specific improper payments identified during its testing of high-risk programs. Although DHS is not currently required to do so, reporting this information would provide a more complete picture of the agency's actions to recover payments that it has identified as being improper.