Improper payments must be identified by performing risk assessments.
Many federal agencies, even those with recognized weaknesses that result in improper payments, do not perform risk assessments to identify and estimate the magnitude of improper payments within their programs.