Specifically, this OMB guidance directs agencies to  disclose the following in their AFRs or PARs: (1) the basis for grouping  programs and activities for improper payment risk assessments; (2) the  risk factors considered during their risk assessment; and (3) a listing of all  programs that were assessed for a given year, regardless of whether a  program or activity was deemed susceptible to significant improper  payments. During fiscal  years 2015 through 2016, the applicable CFO Act agencies, except for  the U.S. Agency for International Development (USAID), adhered to the  reporting directive for listing all programs and activities assessed during  the agencies’ improper payment risk assessments. In our analysis, we found that six  agencies failed to adhere to OMB reporting directives either in fiscal year  2015, fiscal year 2016, or both. OMB staff stated that their  primary motivation for eliminating the risk assessment reporting directives  from OMB guidance was to reduce the administrative burden on  agencies. In addition, although the basis for grouping programs and  activities for improper payment risk assessments and the risk factors  considered during the risk assessments will not be required to be  reported in fiscal year 2017 AFRs and PARs, OMB staff stated that they  plan to revise the guidance for fiscal year 2018 so that agencies report  such information in their AFRs and PARs. Six Selected CFO Act Agencies Did Not Have Properly Designed Control Activities That Included All Programs and Activities in Their Improper Payment Risk Assessments

We found that three of the nine selected CFO Act agencies that we  reviewed, Energy, the Department of Justice, and USAID, had  documented procedures for performing the required improper payment  risk assessments and these procedures included the design of control  activities necessary to help ensure that all programs and activities were  assessed at least once every 3 years. However, the remaining six  agencies did not properly design control activities for this purpose. Three Selected CFO Act Agencies Did Not Have Documented Procedures for Conducting Their Improper Payment Risk Assessments but Have Now Documented Them

Three of the nine selected CFO Act agencies—Commerce, the National  Science Foundation (NSF), and the Nuclear Regulatory Commission  (NRC)—did not have documented procedures for conducting improper  payment risk assessments for fiscal years 2014 through 2016. Three Selected CFO Act Agencies Did Not Properly Design Control Activities to Help Ensure That All Programs and Activities Were Assessed

Although the Departments of the Interior and State and the National  Aeronautics and Space Administration (NASA) had documented  procedures for conducting improper payment risk assessments, we  found that these agencies did not have properly designed control  activities to help ensure that all programs and activities were assessed for  susceptibility to improper payments. Department of the Interior (Interior). Department of State (State). NASA. Conclusions

Performing improper payment risk assessments and reporting on such  assessments are key to identifying programs and activities that may be  susceptible to significant improper payments. Appendix I: Objectives, Scope, and Methodology

This report examines the extent to which (1) the 24 agencies subject to  the Chief Financial Officers Act of 1990 (CFO Act) followed Office of  Management and Budget (OMB) guidance for reporting on improper  payment risk assessments in their agency financial reports (AFR) or  performance and accountability reports (PAR) for fiscal years 2014  through 2016 and (2) selected CFO Act agencies have designed control  activities to include all of their programs and activities in an improper  payment risk assessment at least once during a 3-year period, as  required by the Improper Payments Information Act of 2002 (IPIA), as  amended by the Improper Payments Elimination and Recovery Act of  2010 and the Improper Payments Elimination and Recovery Improvement  Act of 2012. IPIA, as amended,  identifies seven risk factors and OMB guidance includes two additional  risk factors that agencies are to consider in their improper payment risk  assessment to determine susceptibility to significant improper payments. Specifically, in September 2017, OMB staff told us that  they plan to direct agencies to provide a listing of all programs and  activities assessed during their risk assessments on  www.paymentaccuracy.gov for fiscal year 2017 reporting, and that they  plan to continue to direct agencies to report this listing for subsequent  fiscal years. For this objective, we selected  nine CFO Act agencies that did not report improper payment estimates  for any programs or activities in fiscal year 2015 or 2016 except those  estimates that were required to be reported pursuant to the Disaster  Relief Appropriations Act, 2013.
Why GAO Did This Study

Reported improper payment estimates totaled over $1.2 trillion government-wide from fiscal years 2003 through 2016. Agencies are statutorily required to perform improper payment risk assessments to identify programs and activities that may be susceptible to significant improper payments and are required to report an improper payment estimate for ones that are susceptible to significant improper payments.
GAO was asked to review federal agencies' improper payment risk assessments. This report examines the extent to which (1) the 24 CFO Act agencies followed OMB guidance for reporting on improper payment risk assessments and (2) selected CFO Act agencies properly designed control activities to include all of their programs and activities in an improper payment risk assessment at least once every 3 years, as statutorily required. GAO analyzed the 24 CFO Act agencies' AFRs and PARs and reviewed the procedures at 9 selected agencies. GAO selected 9 agencies that did not report improper payment estimates in fiscal year 2015, except for those estimates that were mandated to be reported pursuant to the Disaster Relief Appropriations Act, 2013. For this review, GAO did not evaluate the quality of improper payment risk assessments completed.

What GAO Found

GAO's review of the 24 Chief Financial Officers Act of 1990 (CFO Act) agencies' fiscal years 2014 through 2016 agency financial reports (AFR) and performance and accountability reports (PAR) found that these agencies generally adhered to the Office of Management and Budget's (OMB) improper payment risk assessment reporting directives. However, GAO found instances of nonadherence, including the following:
There were two instances of nonadherence to OMB's directive for agencies to report the basis for how they grouped programs and activities, both of which occurred in fiscal year 2014. All agencies that completed risk assessments adhered to this directive for fiscal years 2015 and 2016.
The Improper Payments Information Act of 2002, as amended, identifies seven risk factors and OMB guidance includes two additional risk factors that agencies are to consider when conducting risk assessments. For fiscal years 2015 and 2016 reporting, OMB directed agencies to report the risk factors considered in their risk assessments. However, GAO found six agencies that did not report one or more of the nine risk factors in their AFRs or PARs.
OMB's revised guidance for fiscal year 2017 no longer directs agencies to report on their risk assessments. OMB staff stated that their primary motivation for removing such reporting was to reduce the administrative burden. After GAO notified OMB of the importance of certain data, OMB staff plan to direct agencies to provide additional data, including a listing of risk assessed programs and activities, on www.paymentaccuracy.gov for reporting beginning in fiscal year 2017. OMB staff also plan to revise the guidance for fiscal year 2018 for agencies to report the other risk assessment information in their AFRs or PARs.
GAO also found that three of the nine selected agencies (the Departments of Energy and Justice and the U.S. Agency for International Development) that it reviewed had designed and documented control activities to help ensure that all programs and activities were assessed every 3 years. For the remaining six agencies, GAO found that the agencies did not properly design control activities for this purpose. Specifically, GAO found the following:
Three agencies—the Department of Commerce, the National Science Foundation, and the Nuclear Regulatory Commission—did not have documented procedures for conducting risk assessments during fiscal years 2014 through 2016 but subsequently documented them.
Three agencies—the Departments of the Interior (Interior) and State (State) and the National Aeronautics and Space Administration (NASA)—documented procedures for conducting risk assessments but did not include all programs and activities in their risk assessments. Interior later drafted revisions to its procedures and State updated its procedures to include them.
Without properly designed and documented control activities, there is a risk that an agency may not identify all programs and activities that require a risk assessment, which could result in the agency failing to develop and report improper payment estimates for programs and activities that should have been identified as susceptible to significant improper payments.

What GAO Recommends

GAO recommends that NASA revise its procedures to help ensure that all programs and activities are assessed for susceptibility to significant improper payments at least once every 3 years. NASA concurred with the recommendation.