Implementing effective fraud risk  management processes is important to help ensure that federal programs  fulfill their intended purpose, funds are spent effectively, and assets are  safeguarded. See figure 2 for additional details on FRDAA’s requirements and  implementation timeline. Agencies Have Taken Steps to Manage and Report on Fraud Risks as FRDAA Requires, but Have Identified Challenges

		Agencies Indicated They Are Planning or Implementing Activities to Manage Fraud Risks

Agencies’ steps to manage fraud risks at the agency-wide level—and in  response to FRDAA—are at varying stages of planning and  implementation, according to our survey of agencies subject to the act. With respect to overall status, most surveyed  agencies (85 percent) indicated that they have at least started planning  how they will meet FRDAA requirements (started or mature), and about  78 percent indicated that they have also started or are mature in their  efforts to implement the requirements. FRDAA specifies that, beginning in fiscal year 2017 and for the  following 2 fiscal years, agencies must include the following 11 elements  in their reports:
Agencies must report their progress implementing the financial and  administrative controls required to be established by the agency,  which include (1) conducting an evaluation of fraud risks and using a  risk-based approach to design and implement financial and  administrative control activities to mitigate identified fraud risks; (2)  collecting and analyzing data from reporting mechanisms on detected  fraud to monitor fraud trends and using that data and information to  continuously improve fraud-prevention controls; (3) using the results  of monitoring, evaluation, audits, and investigations to improve fraud  prevention, detection, and response; (4) implementing the fraud risk  principle as described in the Standards for Internal Control; and (5)  implementing the OMB Circular A-123 section related to leading  practices for managing fraud risk. The agency did  not discuss nonfinancial fraud. OMB Established Guidelines and a Working Group as Required by FRDAA, but Limited Details and Coordination Hindered Agencies’ Implementation of the Act

OMB has taken steps to establish guidelines and a working group for  agencies, as required by FRDAA, but limited guidelines and working- group coordination hindered some agencies’ implementation of the act. Our  analysis of survey responses, roundtable discussion results, and  agencies’ annual financial reports indicates that (1) agencies had mixed  perspectives on the usefulness of OMB’s guidelines for agencies to  establish controls; (2) limited details in OMB’s reporting guidelines  contributed to CFO Act agencies’ incomplete and insufficiently detailed  annual financial reports; and (3) agencies had challenges implementing  FRDAA in part due to their lack of involvement in and lack of  communication from the working group. OMB Updated Existing Guidelines to Meet FRDAA Requirements, but Agencies Have Mixed Perspectives on the Guidelines’ Usefulness

To comply with FRDAA, OMB updated existing guidelines for agencies to  establish financial and administrative controls to manage fraud risks, but  agencies indicated having challenges with the usefulness of these  guidelines, according to our survey and roundtable discussion results. OMB’s Guidelines on FRDAA Reporting Requirements Lack Information Needed for Agencies to Produce Complete and Detailed Reports

OMB updated existing guidelines to include a section on FRDAA  reporting requirements, but did not include enough information to  effectively assist agencies in producing complete and detailed reports,  according to our analysis of annual financial reports and survey and  roundtable responses. OMB Established a Working Group, but Agencies Identified Involvement and Information Sharing as Challenges

OMB established a working group of agencies as required by FRDAA, but  has not met all of the requirements for the working group, such as those  related to member composition, and meeting frequency. The working group also did not effectively facilitate  the sharing of controls, best practices, and data-analytics techniques,  according to our survey results and roundtable discussion. Agencies identified the lack of involvement in the working group as one of  the top challenges to implementing FRDAA. Finally, although OMB did not hold the required number of  meetings per year in 2017, it has done so for fiscal year and calendar  year 2018, as of November 2018. Appendix I: Objectives, Scope, and Methodology

This report reviews agencies’ and the Office of Management and  Budget’s (OMB) efforts to implement the Fraud Reduction and Data  Analytics Act of 2015 (FRDAA).
Why GAO Did This Study

Fraud poses a significant risk to the integrity of federal programs and erodes public trust in government. Implementing effective fraud risk management processes can help ensure that federal programs fulfill their intended purpose, spend their funding effectively, and safeguard assets.
FRDAA requires agencies to establish internal controls to manage their fraud risks and to report implementation progress for the first 3 years after enactment. It also directs OMB to (1) develop guidelines for agencies to establish fraud risk management controls and (2) establish a working group to share best practices in fraud risk management and data analytics.
GAO was asked to review agencies' and OMB's efforts to implement FRDAA. This report examines steps (1) agencies and (2) OMB have taken to implement FRDAA. GAO conducted a survey of the 72 agencies subject to the act, held a roundtable discussion with 14 selected agencies, reviewed 24 selected annual financial reports, examined OMB guidelines, and interviewed OMB staff.

What GAO Found

At varying stages, agencies have begun planning for and implementing fraud risk activities (like conducting an evaluation of fraud risks) required by the Fraud Reduction and Data Analytics Act of 2015 (FRDAA), according to GAO's survey of agencies subject to the act. Overall, most of the 72 surveyed agencies (85 percent) indicated that they have started planning how they will meet FRDAA requirements, and about 78 percent indicated that they have also started taking steps to implement the requirements.
To assist agencies in implementing fraud risk management activities, the Office of Management and Budget (OMB) established FRDAA-related guidelines and a working group, as required by the act. However, agencies experienced challenges with OMB's guidelines and the working group, among other things, according to GAO's survey and roundtable discussion results (see figure below).
Implementation guidelines. To meet FRDAA requirements, OMB updated Circular No. A-123 guidelines that govern executive agencies. However, this update included limited information on the methodologies agencies can use to assess, document, and report on internal controls required by FRDAA, according to GAO's review of the guidelines. Surveyed agencies had mixed perspectives on the usefulness of OMB's guidelines for implementing FRDAA controls. Similarly, agencies identified the lack of clear requirements and guidance as top challenges in GAO's roundtable discussion with 14 selected agencies.
Reporting on implementation progress. Although not required by FRDAA, OMB updated annual financial report guidelines to include FRDAA requirements, but GAO found that the guidelines did not contain enough information to aid agencies in producing complete and detailed progress reports in 2017, the first year of reporting. Additional guidelines from OMB could help agencies produce more complete and detailed reports for 2019, the final year of required reporting. Without a longer reporting period, however, Congress may not have the useful information for continued oversight of agencies' progress.
Working Group. OMB has taken steps to establish the working group, but GAO found the working group did not fully meet FRDAA requirements. As Chair, OMB did not (1) involve all agencies subject to the act in the working group or (2) hold the required number of meetings in 2017. Most surveyed agencies indicated a lack of involvement with and information from the working group as challenges in implementing FRDAA.

What GAO Recommends

GAO is making three recommendations, including that OMB (1) enhance its guidelines for establishing controls, (2) enhance guidelines for reporting on agencies' progress, and (3) fully implement the working group. OMB did not concur with the need for the recommendations. GAO continues to believe the recommendations are valid, as discussed in the report. Additionally, Congress should consider extending agencies' reporting requirements.