Weaknesses in NFIP Transaction Controls and Processing Limited Accountability and Financial Reporting

Control weaknesses impaired FEMA’s ability to maintain effective  transaction-level accountability. At the WYO level, WYO  companies did not adhere to policies and procedures regarding required  claims file documentation, and therefore almost one third of the claims  loss files we reviewed were missing supporting documents. Further, incomplete BSA  premium data files, such as missing insureds’ names and addresses,  prevented our assessment of the reliability of reported premium amounts. BSA-level controls were ineffective in verifying the accuracy of WYO- submitted data. At the FEMA level, financial reporting process controls  were not based on transaction-level data—instead FEMA relied primarily  on summary data compiled using error-prone manual data entry. Similarly, almost 71 percent (125 out of 177) of the  statistically sampled claim losses paid files we reviewed failed at least one  internal control test. The Design of FEMA’s Financial Reporting for NFIP Activity Increases Risk

Along with the internal control weaknesses discussed previously, the  design of FEMA’s NFIP financial reporting process increased the risk of  inaccurate or incomplete data because it did not include a process of  analyzing the detailed data for accuracy or analyzing the financial reports  in relation to the transaction-level data currently submitted by WYO  companies for statistical purposes. Weaknesses in FEMA’s Oversight Structures Limited Effectiveness in Monitoring NFIP Financial Activity

Weaknesses in the broad oversight structures that FEMA relies on to  monitor NFIP financial activity in three key areas limited the effectiveness  of FEMA’s oversight: (1) FEMA did not have processes to monitor WYO  company audits by independent public accountants and other parties,  including required biennial audits, state insurance department audits, and  audits for cause; (2) FEMA did not perform triennial operational reviews  of all WYO insurance companies; and (3) FEMA’s claims reinspection  program used flawed sampling procedures. As a result of these  oversight deficiencies, FEMA’s ability to identify and address NFIP  financial transaction control breakdowns when processing transactions  related to the 2005 Gulf Coast hurricanes was limited. Therefore, we  expected that FEMA would have done an operational review of all the  WYO companies during the 3-year period covering 2005 to 2007. However, we found that FEMA did not  use a statistical sampling basis for selecting claims for reinspection. These findings are consistent with findings from previous audits. FEMA has a system development and implementation effort, referred to as  NextGen, under way. This effort has experienced delays and it is too  soon to determine whether planned program efficiencies—such as  confirmation of insured’s property address—will be achieved under the  new system. Revise required internal control activities for the BSA to provide for  verifying and validating the reliability of WYO-reported financial  information based upon a review of a sample of the underlying  transactions or events, or obtain verification that these objectives have  been met through independent audits of the WYO companies. Because  reinspections are conducted principally on open claims files to document  the appropriateness of the original claims adjuster’s work, the lack of a  statistically representative sample not only precludes FEMA from  projecting the results of these reinspections to determine the overall  accuracy of claims, it also limits FEMA’s ability to continuously assess the  overall performance of insurance companies and adjusters in fulfilling  their NFIP responsibilities. Appendix I: Scope and Methodology

To assess whether controls were effective in providing accountability and  reliable financial reporting for National Flood Insurance Program (NFIP)  transactions during the 2005 to 2007 time frame, we obtained and reviewed  available transaction data and financial reports for NFIP for fiscal years  2005 through 2007. We also  interviewed Federal Emergency Management Agency (FEMA), FEMA  contractors, and Department of Homeland Security (DHS) Office of  Inspector General (OIG) officials to document and obtain an  understanding of the financial reporting process and related internal  controls for NFIP transactions. To assess whether recent and planned actions to improve NFIP controls  and the overall control environment are likely to address identified  financial control weaknesses, we reviewed NFIP policy and procedural  guidance that has been issued subsequent to the 2005 Gulf Coast  hurricanes.
Why GAO Did This Study

Due to the federal government's role as guarantor, floods impose an enormous potential financial burden on the federal government. Consequently, decision makers at the Department of Homeland Security (DHS), the Federal Emergency Management Agency (FEMA), and the Congress need accurate and timely financial information to assess the effectiveness of the National Flood Insurance Program (NFIP). This report assesses whether controls in place during the 2005 to 2007 time frame were effective and whether actions to improve controls are likely to address identified weaknesses. The Government Accountability Office (GAO) reviewed and analyzed FEMA/NFIP guidance, data, and financial reports, reviewed prior audit reports, interviewed FEMA officials and contractors, and selected a sample of claim losses paid to determine whether claim files contained key documents.

What GAO Found

Weaknesses in internal controls impaired FEMA's ability to maintain effective transaction-level accountability. These weaknesses limited FEMA's ability to assure accurate NFIP financial data during the 3-year period from fiscal year 2005 through 2007, which included the financial activity related to the 2005 Gulf Coast hurricanes. FEMA relies heavily on Write Your Own (WYO) insurance companies to carry out NFIP financial activities such as documenting and maintaining claim files. FEMA's Bureau and Statistical Agent (BSA) serves as a liaison between the government and WYO insurance companies. GAO identified weaknesses at three levels of the NFIP transaction accountability and financial reporting process. First, at the WYO level, our internal control testing of a statistical sample determined that almost 71 percent of WYO company claims loss files did not have the necessary documents to support the claims, or reports were filed late. Second, incomplete BSA-level premium data files (lacking key information such as insureds' names and addresses) prevented an assessment of the reliability of reported NFIP premium amounts. Further, BSA-level internal control activities were ineffective in verifying the accuracy of WYO-submitted data. Lastly, FEMA's financial reporting process uses summary data that is overly reliant on error-prone manual data entry. GAO found that FEMA's broader oversight structures were also of limited effectiveness. Specifically, GAO found weaknesses in three key structures FEMA relies on to provide oversight over NFIP and monitor financial activity: (1) WYO company audits--specifically, we found that FEMA did not collect the results of state insurance department audits related to flood insurance activity and did not perform any audits for cause; (2) triennial operational reviews of WYO insurance companies--we found that FEMA did not perform operational reviews at almost one third of all WYO companies over the 3-year period; and (3) FEMA's claims reinspection program--we found that FEMA used flawed sampling procedures in the claims reinspection program. These findings are consistent with weaknesses GAO has previously identified. These oversight weaknesses limited FEMA's ability to identify and address financial transaction control breakdowns resulting from the 2005 hurricanes. FEMA's initiatives to improve specific internal control weaknesses and the overall NFIP control environment since the 2005 Gulf Coast hurricanes have done little to address many of the NFIP financial data deficiencies highlighted by these catastrophic events. FEMA has made improvements such as revising its claim reinspection selection methodology to provide for review of a random selection of a statistically representative sample of claim files. However, the modified reinspection methodology still does not include all claims. FEMA has also implemented a tracking system to monitor the number of WYO biennial audits obtained and reviewed. Further, FEMA has a system modernization development and implementation effort under way. It is too soon to determine the extent to which these efforts will achieve program efficiencies.