In addition, applicable agencies are required by OMB guidance to report  their efforts to recoup contract-related improper payments under section  831 of the National Defense Authorization Act for Fiscal Year 2002,  commonly referred to as the Recovery Auditing Act. USAID’s and NASA’s Risk Assessment Processes and Documentation Could Be Improved

For the first 3 years of IPIA implementation—fiscal years 2004 through  2006—both agencies performed various procedures to conduct their risk  assessments. Many of these procedures are positive steps to address the  requirements of IPIA. At the same time, we identified numerous  deficiencies in the procedures that warrant further improvement. For example, USAID and NASA had not developed a  standardized process to evaluate the results of their reviews, such as  weighting and scoring the results of risk conditions to determine  susceptibility. Furthermore, risk assessment documentation maintained by USAID and  NASA was lacking or insufficient to support their conclusions that no  programs or activities were susceptible to significant improper payments. This continued into fiscal year 2005 for both agencies. A lack of detailed written guidance may have contributed to the  deficiencies we identified. As part of its risk assessment, USAID reported  conducting a review of OIG and external audits, while NASA did not. Because of the lack of guidance and  insufficient review, USAID and NASA cannot be certain that these  payment reviews adequately support that payments made were not  susceptible to significant improper payments. Weaknesses Found in Recovery Auditing Procedures Raise Questions About the Validity and Accuracy of Reported Recovery Audit Amounts

Although USAID and NASA have reported on steps taken to recoup  improper contract payments, we found several weaknesses in their  recovery auditing procedures for fiscal years 2004 through 2006. In  particular, USAID and NASA did not report recovery auditing information  for each fiscal year, documentation was lacking or not adequately  supported, and neither agency adhered to all of the reporting requirements  outlined in OMB’s implementing guidance. Due to a lack of, or insufficient,  documentation, along with identified weaknesses, the validity and  accuracy of the reported recovery amounts are questionable. USAID and NASA Have Taken Steps to Strengthen Their Risk Assessment Processes and Recovery Auditing Procedures, but Challenges Remain

While USAID and NASA have experienced significant challenges in their  first 3 years of IPIA implementation, both agencies have taken steps to  strengthen their risk assessment processes and ultimately, IPIA reporting. Actions are also under way to improve recovery auditing efforts. However,  improvements are still needed to address some of the weaknesses related  to conducting risk assessments and performing recovery auditing  procedures. Specifically, we recommend that the  Administrator, USAID,    expand existing IPIA guidance to include detailed procedures for  addressing the four key steps—perform risk assessment, estimate  improper payments, implement a corrective action plan, annually  report—that OMB requires agencies to perform in meeting the  improper payment reporting requirements;    develop a risk assessment tool, such as a risk assessment matrix, to  determine if risks exist, what those risks are, and the potential or  actual impact of those risks on program operations;    use the risk assessment tool to institute a systematic approach to  identify programs and activities susceptible to significant improper  payments under IPIA;    maintain documentation of actions performed to address IPIA and the  Recovery Auditing Act requirements;    develop a comprehensive recovery auditing program that is specifically  designed to identify overpayments to contractors that are due to  payment errors; and    adhere to OMB’s guidance for reporting recovery auditing information  in the annual PAR. Appendix I: Objectives, Scope, and Methodology

The objectives of this review were to determine (1) the extent to which  USAID and NASA performed the required risk assessments to identify  programs and activities that were susceptible to significant improper  payments for fiscal year 2004 through fiscal year 2006, (2) steps USAID  and NASA have taken to recoup improper payments through recovery  audits, and (3) actions USAID and NASA have under way to improve their  IPIA and recovery audit reporting. Payments to Other Agencies. This payment stream consists of all  payments made to other federal agencies for services and/or goods  received. Contract. Grant.
Why GAO Did This Study

Agencies are required to report improper payment information under the Improper Payments Information Act of 2002 (IPIA) and recovery auditing information under section 831 of the National Defense Authorization Act for Fiscal Year 2002, commonly known as the Recovery Auditing Act. Since the first year of implementation, fiscal year 2004, limited improper payments reporting by the United States Agency for International Development (USAID) and the National Aeronautics and Space Administration (NASA) and concerns raised by NASA's auditors about its risk assessment process prompted scrutiny from the Senate Subcommittee on Federal Financial Management, Government Information, Federal Services, and International Security, during several oversight hearings. Because the subcommittee noted that USAID's and NASA's performance and accountability report (PAR) reporting on improper payments and recovery auditing was minimal, GAO was asked to review both agencies' IPIA risk assessment methodologies, recovery auditing procedures, and actions under way to improve their IPIA and recovery audit reporting.

What GAO Found

For the first 3 years of IPIA implementation, fiscal years 2004 through 2006, USAID and NASA performed various procedures to conduct their risk assessments. Many of these procedures are positive steps to address the requirements of IPIA. At the same time, GAO identified numerous deficiencies in the procedures that warrant further improvement. For example, neither USAID nor NASA had developed a systematic process to (1) identify risks that exist in their payment activities or (2) evaluate the results of their payment stream reviews, such as weighting and scoring the effectiveness of existing internal control over payments made and results from external audits. Furthermore, risk assessment documentation maintained by USAID and NASA was lacking or insufficient to support their conclusions that no programs or activities were susceptible to significant improper payments. A lack of detailed written guidance for both agencies may have contributed to the deficiencies identified. Due to inadequacies in their risk assessment process, USAID and NASA cannot be certain that they had no programs or activities susceptible to significant improper payments, and ultimately, had effectively implemented IPIA. Although USAID and NASA have reported on steps taken to recoup improper contract payments, GAO found several weaknesses in their recovery auditing procedures for fiscal years 2004 through 2006. In particular, USAID and NASA did not report recovery auditing information for each fiscal year, documentation was lacking or not adequately supported, and neither agency adhered to all of the reporting requirements outlined in Office of Management and Budget's (OMB's) implementing guidance. Other weaknesses noted were agency-specific. For example, USAID recovery auditing procedures were comprised of reviews of certain Office of Inspector General and external audit reports over USAID grant and contract programs. However, the methodology used for conducting those audits may not have constituted a recovery auditing program as defined by OMB guidance, and thus may be insufficient for this purpose. NASA, on the other hand, used IPIA contract payment review results to report amounts recovered for fiscal year 2005. However, the payment reviews were limited in scope and did not provide an adequate representation of the extent of contract overpayments. Due to a lack of, or insufficient, documentation, along with identified weaknesses, the validity and accuracy of the reported recovery amounts are questionable. While USAID and NASA have experienced significant challenges in their first 3 years of IPIA implementation, both agencies have taken steps to strengthen their risk assessment process and, ultimately, IPIA reporting. For example, USAID has developed an agencywide payment database that will be used to research and data mine for potential improper payments. NASA hired two different contractors to develop a methodology for conducting a risk assessment and testing of payment transactions. Actions are also under way to improve recovery auditing efforts. However, improvements are still needed to address some of the weaknesses identified related to conducting risk assessments and performing recovery auditing procedures.