The six criteria are as follows:  1.  publish a report in the form and content required by OMB—typically  an agency financial report (AFR) or a performance and accountability  report (PAR)—for the most recent fiscal year, and post that report on  the agency website;  2.  conduct a program-specific risk assessment, if required, for each  program or activity that conforms with IPIA as amended;  3.  publish improper payment estimates for all programs and activities  deemed susceptible to significant improper payments under the  agency’s risk assessments;  4.  publish corrective action plans for those programs and activities  assessed to be at risk for significant improper payments;  5.  publish and meet annual reduction targets for all programs and  activities assessed to be at risk for significant improper payments; and  6.  report a gross improper payment rate of less than 10 percent for  each program and activity for which an improper payment estimate  was published. Over Half of the CFO Act Agencies Were Reported as Noncompliant under IPERA for Fiscal Years 2016 and 2017, and Consecutive Years of Noncompliance Continue for Certain Programs

		Over Half of the Agencies Were Reported as Noncompliant for Fiscal Years 2016 and 2017

Seven years after the initial implementation of IPERA, over half of the 24  CFO Act agencies were reported as noncompliant by their IGs for fiscal  years 2016 and 2017. Nine of these agencies have been reported as noncompliant in one or  more programs every year since IPERA was implemented in 2011 (see  app. As shown in table  2, 14 of the 18 programs that were reported as noncompliant for 3 or  more consecutive years reported improper payment estimates that  accounted for an estimated $74.4 billion (about 53 percent) of the   $141 billion, while the other 4 programs did not report improper payment  estimates for fiscal year 2017 and were reported by their respective IGs  as noncompliant with the IPERA criterion to publish improper payment  estimates. The $74.4 billion is primarily composed of estimates reported  for 2 noncompliant programs—HHS’s Medicaid program ($36.7 billion)  and Treasury’s Earned Income Tax Credit program ($16.2 billion)— totaling $52.9 billion (or approximately 71 percent of the $74.4 billion). Three of  these agencies did not notify Congress of their program’s continued  noncompliance as required. In  June 2018, OMB updated its guidance to clarify agency reporting  requirements for each consecutive year a program is reported as  noncompliant. CFO Act Agencies with Programs Reported as Noncompliant for 3 or More Consecutive Years Did Not Always Notify Congress

Of the eight agencies with programs reported as noncompliant under  IPERA for 3 or more consecutive years as of fiscal year 2016, we found  that five agencies notified Congress of their noncompliance as required. The remaining three agencies—the U.S. Department  of Agriculture (USDA), the Department of Labor (DOL), and Treasury— did not notify Congress as required. We previously reported that  Treasury submitted proposed statutory changes to Congress for this  program in August 2014 and in June 2015. Certain Agencies Provided Additional Quality Information on IPERA Compliance Efforts in Their Notifications to Congress

We found that the five agencies—DOD, DHS, Education, HHS, and  SSA—that notified Congress regarding their programs’ reported  noncompliance for 3 or more consecutive years, as of fiscal year 2016,  also included additional information about their efforts to achieve IPERA  compliance. Although IPERA does not specifically require that agency  proposals for reauthorization or other statutory change provide such  information, including it could help Congress to better assess the  agencies’ proposals included in these notifications and to oversee agency  efforts to address long-standing challenges and compliance issues  associated with these programs. In addition, GAO’s Standards for Internal Control in the Federal  Government emphasizes the importance of communicating quality  information, such as significant matters related to risks, changes, or  issues affecting agencies’ efforts to achieve compliance objectives, to  external parties—such as legislators, oversight bodies, and the general  public. Although OMB updated its guidance in June 2018 to clarify agency  reporting requirements related to programs reported as noncompliant for  3 or more consecutive years, the updated guidance did not direct  agencies to include other types of quality information in their notifications,  such as those described above. As of September 2018, OMB  was in the process of making funding determinations for 12 programs that  were reported as noncompliant as of fiscal year 2017 and stated that any  determinations made would be developed in the President’s Budget for  fiscal year 2020. In April 2018, OMB  staff stated that when making funding determinations, they primarily rely  on the IGs’ recommendations in their annual IPERA compliance reports. Education IG’s fiscal  year 2017 IPERA compliance report stated that “If OMB recommends that  the Department needs additional funding or should take any other actions  to become compliant with IPERA, we recommend that the Department  implement OMB’s recommendations.” Also, the USDA IG’s fiscal year  2016 IPERA compliance report stated, “For agencies that are not  compliant for 2 consecutive years for the same program, the Director of  OMB will determine if additional funding would help these programs come  into compliance.” As a result, OMB’s reliance on IG recommendations as  the source of information to support additional funding determinations  may not provide sufficient information to effectively assess agencies’  funding needs to address noncompliance. OMB staff subsequently stated that they no longer need to conduct a  detailed review of the IGs’ IPERA compliance reports to identify  recommendations related to additional funding needs. A-123, Appendix C, and clarified that the funding determination process  will unfold as part of the annual development of the President’s Budget,  as described in OMB Circular No. This updated guidance also  directs agencies to submit proposals to OMB regarding additional funding  needs that may help them address IPERA noncompliance. Conclusions

Estimated improper payments reported government-wide total almost  $1.4 trillion from fiscal year 2003 through fiscal year 2017. Recommendation for Executive Action

The Director of OMB should take steps to update OMB guidance to  specify other types of quality information that agencies with programs  noncompliant for 3 or more consecutive years should include in their  notifications to Congress, such as significant matters related to risks,  issues, root causes, measurable milestones, designated senior officials,  accountability mechanisms, and corrective actions or strategies planned  or taken by agencies to achieve compliance. (Recommendation 1)

	Agency Comments and Our Evaluation

We provided a draft of this report to OMB and requested comments, and  OMB said that it had no comments. We also provided a draft of this report  to the 24 CFO Act agencies and their IGs and requested comments. In its comments, SSA stated that it provided information to Congress on  measurable milestones, designated senior officials, and accountability  mechanisms in its AFR. As such, we continue to  believe that OMB should take steps to update OMB guidance to help  ensure that agencies report such significant information and include it in  their notifications to Congress. The extent to which CFO Act agencies addressed requirements for  programs and activities reported as noncompliant with IPERA criteria  for 3 or more consecutive years, as of fiscal year 2016, and  communicated their strategies to Congress for reducing improper  payments and achieving compliance. 3. The extent to which the Office of Management and Budget (OMB)  made determinations regarding whether additional funding would help  CFO Act programs and activities reported as noncompliant with  IPERA criteria for 2 consecutive years, as of fiscal years 2016 and  2017, come into compliance. Appendix IV: CFO Act Agencies with Programs Reported by Their IGs as Noncompliant for 2 or More Consecutive Years, as of Fiscal Years 2016 and 2017

Table 7 details the Chief Financial Officers Act of 1990 (CFO Act)  agencies and programs reported by their inspectors general as  noncompliant under the Improper Payments Elimination and Recovery  Act of 2010 (IPERA) for 2 or more consecutive years, as of fiscal years  2016 and 2017.
Why GAO Did This Study

Government-wide estimated improper payments totaled almost $1.4 trillion from fiscal year 2003 through fiscal year 2017. IPERA requires IGs to annually assess and report on whether executive branch agencies complied with the six criteria to (1) publish an agency financial report or performance accountability report, (2) conduct program-specific improper payment risk assessments, (3) publish improper payment estimates, (4) publish corrective action plans, (5) publish and meet annual improper payment reduction targets, and (6) report a gross improper payment rate of less than 10 percent.
This report examines the extent to which
1. CFO Act agencies complied with IPERA criteria for fiscal years 2016 and 2017, and the trends evident since 2011, as reported by their IGs;
2. CFO Act agencies addressed requirements for programs reported as noncompliant with IPERA criteria for 3 or more consecutive years, as of fiscal year 2016, and communicated their strategies to Congress for reducing improper payments and achieving compliance; and
3. OMB made determinations regarding whether additional funding would help CFO Act agency programs reported as noncompliant with IPERA criteria for 2 consecutive years, as of fiscal years 2016 and 2017, come into compliance.
GAO analyzed the IGs' fiscal years 2016 and 2017 IPERA compliance reports; reviewed prior GAO reports on agencies' IPERA compliance; reviewed agency information submitted to Congress; and made inquiries to OMB, applicable agencies, and IGs; and assessed such information based on relevant IPERA provisions and OMB and other guidance.

What GAO Found

Over half of the 24 Chief Financial Officers Act of 1990 (CFO Act) agencies were reported by their inspectors general (IG) as noncompliant with one or more criteria under the Improper Payments Elimination and Recovery Act of 2010 (IPERA) for fiscal years 2016 and 2017. Nine CFO Act agencies have been reported as noncompliant in one or more programs every year since the implementation of IPERA in fiscal year 2011, totaling 7 consecutive years of noncompliance.
The IGs of the 14 noncompliant agencies reported that a total of 58 programs were responsible for the identified instances of noncompliance in fiscal year 2017. Further, 18 of the 58 programs at 9 agencies were reported as noncompliant for 3 or more consecutive years. Fourteen of these 18 programs accounted for an estimated $74.4 billion of the $141 billion total estimated improper payments for fiscal year 2017; the other 4 programs did not report improper payment estimates. This sum may include estimates that are of unknown reliability. The $74.4 billion is primarily composed of estimates reported for two noncompliant programs, the Department of Health and Human Services' Medicaid program and the Department of the Treasury's (Treasury) Earned Income Tax Credit program; estimated improper payments for these two programs are also a central part of certain high-risk areas in GAO's 2017 High-Risk List.
Agencies with any program reported as noncompliant for 3 or more consecutive years are required to notify Congress of their program's consecutive noncompliance and submit a proposal for reauthorization or statutory change to bring that program into compliance. GAO found that three agencies with one or more programs reported as noncompliant for 3 or more consecutive years, as of fiscal year 2016, did not notify Congress or submit the required proposals. The Departments of Labor and the Treasury submitted proposed legislative changes in response to their programs being previously reported as noncompliant, but did not notify Congress of the programs' continued noncompliance as of fiscal year 2016. The U.S. Department of Agriculture (USDA) has not notified Congress despite prior GAO and USDA IG recommendations to do so. To address these issues, in June 2018 the Office of Management and Budget (OMB) updated its guidance to clarify the notification requirements for each consecutive year a program is reported as noncompliant.
GAO found that five agencies did notify Congress as required, and included additional quality information that is not specifically required, but could be useful in updating Congress on their compliance efforts. For example, all five agencies provided information on the root causes, risks, changes, or issues affecting their efforts and corrective actions or strategies to address them; three agencies provided other quality information on accountability mechanisms, designated senior officials, and measurable milestones.
In June 2018, OMB updated its guidance to clarify agency reporting requirements for programs reported as noncompliant for 3 or more consecutive years. However, the updated guidance does not direct agencies to include the types of quality information included in these five agencies' notifications for fiscal year 2016. GAO's Standards for Internal Control in the Federal Government emphasizes the importance of communicating quality information, such as significant matters affecting agencies' efforts to achieve compliance objectives. Such information could be useful in understanding the current challenges of these programs and is essential for assessing agency efforts to address high-risk and other issues. As a result, Congress could have more complete information to effectively oversee agency efforts to address program noncompliance for 3 or more consecutive years.
When programs are reported as noncompliant for 2 consecutive years, IPERA gives OMB authority to determine whether additional funding is needed to help resolve the noncompliance. In April 2018, OMB staff stated that they determined that no additional funding was needed for the 15 programs that were reported as noncompliant for 2 consecutive years, as of fiscal year 2016, and that they primarily rely on the IGs' recommendations in their annual IPERA compliance reports when making funding determinations. OMB staff subsequently stated that they no longer need to conduct a detailed review of the IGs' IPERA compliance reports to identify recommendations related to additional funding needs. Instead, OMB updated its guidance in June 2018 to direct agencies to submit proposals to OMB regarding additional funding needs to help address IPERA noncompliance and clarified that the funding determination process will unfold as part of the annual development of the President's Budget. As of September 2018, OMB was in the process of making funding determinations for 12 programs that were reported as noncompliant as of fiscal year 2017 and stated that any determinations made would be developed in the President's Budget for fiscal year 2020.

What GAO Recommends

GAO recommends that OMB update its guidance to specify other types of quality information that agencies with programs noncompliant for 3 or more consecutive years should include in their notifications to Congress, such as significant matters related to risks, issues, root causes, measurable milestones, designated senior officials, accountability mechanisms, and corrective actions or strategies planned or taken by agencies to achieve compliance.
GAO provided a draft of this report to OMB and requested comments, and OMB said that it had no comments. GAO also provided a draft of this report to the 24 CFO Act agencies and their IGs and requested comments. In its written comments, the Social Security Administration (SSA) stated that it provided information on measurable milestones, designated senior officials, and accountability mechanisms in its agency financial report. However, SSA did not provide this information in its notifications to Congress for programs reported as noncompliant under IPERA as of fiscal year 2016. GAO believes that OMB should take steps to update OMB's guidance to help ensure that agencies report such significant information and include it in their notifications to Congress. In addition, several agencies and IGs provided technical comments, which were incorporated in the report as appropriate.