DOE Uses Cost- Surveillance Procedures to Manage Its Risk of Fraud and Other Improper Payments, but Challenges Limit the Effectiveness of This Approach DOE Uses Prepayment Invoice Reviews to Monitor Non-M&O Contract Costs, but Shortcomings in Its Control Activities and Resource Challenges Limit the Effectiveness of These Reviews

DOE uses prepayment invoice reviews to monitor the costs of non-M&O  contracts but has shortcomings in its control activities at the six site  offices that oversee them, as well as resource challenges that limit the  effectiveness of these reviews. We have reported previously on DOE’s invoice review policies and  procedures at one of DOE’s largest clean-up sites. However, as discussed above, DOE’s  Acquisition Guide does not contain the details necessary to be an  operating procedure. The Fraud Reduction  and Data Analytics Act of 2015, which Congress passed in June 2016,  establishes requirements aimed at improving federal agencies’ controls  and procedures for assessing and mitigating fraud risks and directs OMB  to establish implementation guidelines that incorporate the leading  practices identified in the Fraud Risk Framework. DOE officials told us that they plan to meet the requirements of the Fraud  Reduction and Data Analytics Act of 2015 but should not be expected to  implement private industry leading practices prior to the issuance of OMB  guidance. Without implementing these selected leading practices for  managing its risk of fraud, DOE is missing an opportunity to better  position itself to meet the requirements of the Fraud Reduction and Data  Analytics Act of 2015 and to organize and focus its resources in a way  that would allow the department to mitigate the likelihood and impact of  fraud. Moreover, DOE is  missing an opportunity to allow managers to monitor large amounts of  data more efficiently. Data Analytics Helped Identify Potentially Improper Charges, but Billions in Costs Could Not Be Analyzed Because Contractor Data Were Not Sufficiently Detailed

In applying data analytics to identify potential indicators of fraud or other  improper payments associated with selected DOE contracts, we found  that much of the cost data we requested from two DOE contractors for the  purpose of performing data analytics was not suitable for analysis. The  data were not suitable either because they were not for a complete  universe of transactions that was reconcilable with amounts billed to DOE  or because they were not sufficiently detailed. According to the Fraud Risk Framework, effective  fraud risk managers collect and analyze data on identified fraud trends  and use them to improve fraud risk management activities. Without a department-wide  invoice review policy or well-documented procedures, DOE management  does not have assurance that invoice reviews are being performed or that  these control activities are operating as intended. DOE has  not required that its contractors maintain sufficiently detailed transaction- level cost data that are reconcilable with amounts charged to the  government. Without requiring contractors to maintain such data— including cost data that, at a minimum, represent a full data population  and contain the details necessary to determine the nature of each cost  transaction—DOE will not be well positioned to meet the requirements of  the Fraud Reduction and Data Analytics Act of 2015 and employ data  analytic techniques as a means to more efficiently monitor contractor  costs and manage its risk of fraud and other improper payments. DOE generally concurred in principle with five of our  recommendations. In its letter, DOE agreed to (1) establish a DOE-wide  invoice review policy that includes requirements for sites to establish well- documented invoice review operating procedures; (2) create a structure  with a dedicated entity within DOE to design and oversee fraud risk  management activities—but stated that it will have to consider the cost,  benefits, and need for a separate organization before implementing a  dedicated antifraud entity to design and oversee fraud risk management  activities; (3) conduct fraud risk assessments that are tailored to each  program and use the assessments to develop a fraud risk profile; (4)  develop and document an antifraud strategy that describes the programs’  approaches for addressing the prioritized fraud risks identified during the  fraud risk assessment; and (5) design and implement specific control  activities, including fraud awareness training and data analytics, to  prevent and detect fraud and other improper payments. Therefore, we continue to believe  that DOE needs to implement our recommendation and require  contractors to maintain sufficiently detailed transaction-level cost data  that are reconcilable with amounts charged to the government. Our report examined the extent to which  DOE’s approach to managing its risk of fraud and other improper  payments incorporates leading practices, such as the use of data  analytics. To examine the extent to which DOE’s approach incorporates leading  practices, such as the use of data analytics, through our review of  standards and guidance of the Institute of Internal Auditors, federal  internal control standards, and our Fraud Risk Framework, we identified  key leading practices for managing the risk of fraud and improper  payments in the federal government.
Why GAO Did This Study

Over the past decade, incidents of fraud by DOE contractors have occurred. From 2003 through 2008, employees of one contractor at DOE's Hanford site in Washington state made hundreds of fraudulent purchases and solicited and received kickbacks. In another case, Hanford contractors agreed to pay a combined $125 million to settle disputed claims regarding federal dollars spent on nonnuclear-compliant parts. To help federal program managers combat fraud, in July 2015, GAO issued leading practices for managing fraud risks.
GAO was asked to review DOE's processes, programs, and practices for managing its risk of fraud. This report examines (1) DOE's approach to managing its risk of fraud and other improper payments and challenges, if any, that may limit the effectiveness of this approach; (2) the extent to which DOE's approach incorporates leading practices; and (3) the application of data analytics in identifying potential indicators of fraud or other improper payments associated with selected DOE contracts.

What GAO Found

The Department of Energy (DOE) manages the risk of fraud and improper payments through its internal controls program, which includes, among other things, prepayment invoice reviews and post payment audits. However, several challenges limit the effectiveness of this approach. For example, DOE does not have a department-wide invoice review policy or well-documented procedures at five of the six sites with invoice review responsibilities. Consequently, DOE has no assurance that control activities at these sites are operating as intended. Time constraints also limit the effectiveness of invoice reviews. For example, some invoices can have numerous associated transactions and the reviews must be completed within a limited time frame before payment, which may be as short as 10 days.
DOE's approach to managing fraud risk does not incorporate leading practices such as creating a dedicated antifraud entity to lead fraud risk management activities; conducting regular fraud risk assessments that are tailored to the program; developing and documenting a strategy to mitigate assessed fraud risks; or designing and implementing specific control activities, such as data analytic activities, to prevent and detect fraud. By not implementing leading practices, DOE is missing an opportunity to organize and focus its resources in a way that would allow it to mitigate the likelihood and impact of fraud. Moreover, the Fraud Reduction and Data Analytics Act of 2015 establishes requirements aimed at improving federal agencies' controls and procedures for assessing and mitigating fraud risks through the use of data analytics. The legislation also directs the Office of Management and Budget (OMB) to, among other things, establish implementation guidelines that incorporate fraud risk management leading practices. DOE officials told GAO that they plan to meet the requirements of the act but should not be expected to implement private industry leading practices prior to the issuance of OMB guidance. Incorporating leading practices could also help DOE more effectively implement the act's requirements once OMB guidance is available.
It is not possible to fully employ data analytics as a tool to identify potential indicators of fraud or other improper payments at DOE because of limitations in contractor-maintained cost data. Much of the cost data maintained by the two DOE contractors GAO selected for data analytic purposes could not be used because these data did not include a complete universe of transactions that was reconcilable with amounts billed to DOE or did not contain details necessary to determine the nature of costs charged to DOE. Because DOE does not require its contractors to maintain sufficiently detailed transaction-level cost data that are reconcilable with amounts charged to DOE, it is not well positioned to employ data analytics as a fraud detection tool. Effective fraud risk managers collect and analyze data and identify fraud trends and use them to improve fraud risk management activities, according to leading practices that GAO has previously identified. Without the detailed data necessary to conduct such analysis, DOE is missing an opportunity to develop, refine, and improve its experience with data analytic tools and techniques, and better position itself to meet the requirements of the Fraud Reduction and Data Analytics Act.

What GAO Recommends

GAO is making six recommendations, including that DOE establish invoice review policies and procedures, employ leading practices such as data analytics to help manage fraud risk, and require that its contractors maintain sufficiently detailed cost data for reconciling with amounts charged. DOE generally concurred with five of GAO's six recommendations but did not agree to require contractors to maintain detailed data. GAO continues to believe that the recommendation is valid, as discussed in the report.