IPIA defines “significant” improper payments as improper  payments in the preceding fiscal year that may have exceeded either   (1) 1.5 percent of program outlays and $10 million or (2) $100 million  (regardless of the improper payment rate). Four of the Five Risk Assessments Lacked Documentation to Support Their Risk Determinations, and Many of HHS’s Programs Were Not Assessed

		HHS’s Improper Payment Risk Assessment for Head Start Lacked Documentation to Support Its Low Risk Determination, and Many Other Programs Were Not Assessed HHS’s Improper Payment Risk Assessment for Head Start Lacked Documentation to Support Its Low Risk Determination

In its fiscal year 2016 qualitative risk assessment, HHS assessed its  Head Start program as at low risk of susceptibility to significant improper  payments. HHS’s improper payment risk assessment template  included the nine risk factors, among other factors, and described how  the divisions should consider each risk factor. However, HHS did not have  documentation to demonstrate how it determined the weighting of the risk  factors or how the numerical risk level ranges from the risk assessment  template related to a program’s susceptibility to significant improper  payments. HHS Did Not Conduct Risk Assessments for Many of Its Programs and Activities

During our agency and program selection process, we found that HHS did  not assess many of its programs and activities at least once during the 3- year period from fiscal years 2015 through 2017, as required by IPIA. Without properly designed  control activities to help ensure that all programs and activities are  assessed for susceptibility to significant improper payments at least once  every 3 years, as required by IPIA, there is an increased risk that HHS  may not identify all risk-susceptible programs and activities, resulting in  incomplete improper payment estimates. Treasury’s risk assessments for Interest on the Public Debt and HAMP  also did not document or effectively demonstrate how the total scores for  all risk factors led to the determinations that the programs were not  susceptible to significant improper payments. Additionally, based on our analysis of Treasury’s risk assessment  template, a bureau could identify areas of risk related to each of the nine  risk factors for a program, but because of the assigned weights given to  each of the nine risk factors, Treasury’s final risk calculation would still not  determine the program to be at high risk of susceptibility to significant  improper payments. Without documenting the basis for the assigned weights, Treasury cannot  demonstrate, and we cannot determine, that its process for determining  its programs’ susceptibility to significant improper payments was  reasonable. As  such, DOJ did not always provide sufficient documentation or support for  us to determine how the components arrived at their risk determinations  for each risk factor. For example, the template stated that “a risk rating of high risk  for the purposes of this assessment does not mean that the payment type  is susceptible to significant improper payments but may indicate that  additional focus and testing should be placed on that payment type to  better estimate the improper payment rate for the payment type.” DOJ  officials stated that DOJ held internal discussions and considered the  severity of the impact on the program’s improper payments when  developing its weights for each risk factor. We found that the quantitative evaluation,  based on statistical sampling, provided a reasonable basis for USDA’s  determination that the program was at low risk for susceptibility to  significant improper payments. We continue to believe that our recommendation to DOJ is valid to help  ensure that DOJ’s risk assessment reliably results in determining whether  Law Enforcement may be susceptible to significant improper payments. Appendix I: Objective, Scope, and Methodology

This report examines the extent to which certain federal agencies’  improper payment risk assessments for selected programs provided a  reasonable basis for determining susceptibility to significant improper  payments. Through our  selection process, we noted that the Department of Health and Human  Services (HHS) did not assess at least 140 of its programs and activities  in the 3-year period from fiscal years 2015 through 2017, and therefore  our program selection for HHS was limited to approximately 70 programs  or activities. Our selection was primarily based on the  size of program and activity gross outlays reported for fiscal year 2017.
Why GAO Did This Study

Improper payments are a long-standing problem in the federal government, estimated at almost $141 billion for fiscal year 2017. Agencies are required to perform risk assessments to identify programs that may be susceptible to significant improper payments.
GAO was asked to review federal agencies' improper payment risk assessments. This report examines the extent to which certain agencies' improper payment risk assessments for selected programs provided a reasonable basis for determining their susceptibility to significant improper payments. GAO analyzed the most recent risk assessments, from 2015 through 2017, for the following five programs: USDA's Agriculture Risk Coverage and Price Loss Coverage programs; HHS's Head Start; DOJ's Law Enforcement; and Treasury's Interest on the Public Debt and Home Affordable Modification Program. GAO selected these programs, focusing on programs that recently underwent a risk assessment and size of programs' gross outlays—which totaled about $330 billion in fiscal year 2017 for the five programs GAO selected.

What GAO Found

The Improper Payments Information Act of 2002, as amended (IPIA), defines “significant” improper payments as improper payments in the preceding fiscal year that may have exceeded either (1) 1.5 percent of program outlays and $10 million or (2) $100 million (regardless of the improper payment rate). GAO found that the Departments of Health and Human Services (HHS), the Treasury (Treasury), Justice (DOJ), and Agriculture (USDA) assessed the five programs GAO selected for review as at low risk for susceptibility to significant improper payments; however, HHS, Treasury, and DOJ lacked sufficient documentation to assess the extent to which their risk assessments provided a reasonable basis for their risk determinations. On the other hand, USDA's quantitative risk assessment of its program's susceptibility to significant improper payments provided a reasonable basis for its low-risk determination.
Although HHS, Treasury, and DOJ considered, among other factors, the nine risk factors from IPIA and Office of Management and Budget guidance, they did not document or effectively demonstrate how these factors affected their programs' susceptibility to significant improper payments. These programs' risk assessments did not contain sufficient documentation to determine how the agencies arrived at their risk determinations for each risk factor, or how the total scores for all risk factors led to low-risk determinations. For example, HHS determined that its Head Start program was at high risk for several risk factors—including complexity per transaction and volume of payments—but did not document how these high-risk ratings informed its overall determination that Head Start was not susceptible to significant improper payments.
Further, the agencies did not have documentation to demonstrate how they determined the weighting of each risk factor or the risk level ranges from the risk assessment templates as they relate to the programs' susceptibility to significant improper payments. For example, based on GAO's analysis of Treasury's risk assessment template, the agency could identify areas of risk related to each of the nine risk factors. But because of the assigned weights given to each risk factor, Treasury's final risk calculation would still not determine the program to be at high risk of susceptibility to significant improper payments. Without documenting the basis for the assigned weights, Treasury cannot demonstrate, and GAO cannot determine, that its process for determining its programs' susceptibility to significant improper payments was reasonable. Until HHS, Treasury, and DOJ revise their risk assessment processes to help ensure that they result in reliable assessments, they cannot be certain whether their programs are susceptible to significant improper payments and therefore whether they are required to estimate the amount of improper payments.
GAO also found that HHS did not assess many of its programs and activities at least once during the 3-year period from fiscal years 2015 through 2017, as required by IPIA. Based on the analysis of HHS information, GAO identified at least 140 programs or activities that were not assessed during the 3-year period. When not all eligible programs are reviewed as required, there is an increased risk that the agency may not identify all risk-susceptible programs and activities, resulting in incomplete improper payment estimates.

What GAO Recommends

GAO recommends that Treasury, DOJ, and HHS revise their improper payment risk assessment processes, and that HHS revise its procedures to help ensure that all programs are assessed at least once every 3 years. In their responses, Treasury and HHS agreed with the recommendations, and DOJ disagreed with GAO's recommendation. GAO continues to believe that the recommendation is valid, as discussed in the report.