Child Care and Development Fund: Office of Child Care Should Strengthen Its Oversight and Monitoring of Program-Integrity Risks

The CCDF is administered as a block grant to the states by OCC, an agency within the Department of Health and Human Services (HHS). Recent reports by the HHS Office of the Inspector General show that OCC's monitoring of CCDF state program-integrity efforts remains a challenge. CCDF has also been designated as a program susceptible to significant improper payments, as defined by the Office of Management and Budget.

GAO was asked to review CCDF program-integrity efforts. This report discusses, among other things, the extent to which OCC provides oversight of (1) states' CCDF program-integrity activities, including encouraging that all requested information is included within State Plans; and (2) improper-payment risks and relevant corrective actions in states' CCDF programs. GAO analyzed 51 approved CCDF State Plans, including from the District of Columbia, for the fiscal years 2019–2021 grant period. GAO also reviewed OCC policies and procedures and compared them to relevant laws, regulations, and Standards for Internal Control in the Federal Government , and interviewed relevant federal officials.

The Child Care and Development Fund (CCDF) provided states more than $8 billion in federal funds in fiscal year 2019. The Office of Child Care (OCC) oversees the integrity of the CCDF, which subsidizes child care for low-income families. A key part of OCC's oversight includes reviewing and approving State Plans. OCC requested but did not require states to describe in their State Plans the results of their program-integrity activities, which describe the processes that states use to identify fraud risk. Further, OCC has not defined or communicated what information it considers to be the “results” of program-integrity activities to the states and its own staff. Without defining and communicating its informational needs, OCC may continue to lack quality information that could help ensure states' accountability over their program-integrity activities.

OCC oversees states' improper payment risks through a process that includes a requirement for states to submit corrective action plans (CAP) when they estimate their annual payment error rates are at or above 10 percent. Since 2013, seven states have submitted 14 CAPs. These CAPs describe states' proposed actions for reducing improper payments. However, OCC does not have documented criteria to guide its review and approval of the CAPs to ensure the proposed corrective actions are aimed at root causes of improper payments and are effectively implemented. Without developing this guidance, OCC does not have assurance that proposed corrective actions are specifically aimed at root causes of improper payments, leaving the CCDF program at continued risk of improper payments.

GAO is making nine recommendations, including that OCC define and communicate its informational needs on the results of states' program-integrity activities, and that OCC develop criteria to guide the review of CAPs to ensure that proposed corrective actions are aimed at root causes of improper payments and are effectively implemented. HHS concurred with our recommendations and provided technical comments, which GAO incorporated as appropriate.

The Child Care and Development Fund (CCDF) Program subsidizes child  care to help low-income families with children under age 13 whose  parents work or attend educational or job-training programs. Congress  appropriated more than $8 billion in federal funds to the CCDF program in  fiscal year 2019. The CCDF is administered as a block grant to the  states by the Office of Child Care (OCC) within the Administration for  Children and Families (ACF), a division of the U.S. Department of Health  and Human Services (HHS). Each state has a lead agency that is  responsible for the funding provided and administering the program in the  state. Public agencies and private entities (including center-based and  relative providers) can receive grant funding from the lead agency to  provide child-care services to eligible children and families.

OCC and state lead agencies share responsibility for overseeing and  protecting the financial integrity of the CCDF program. To receive CCDF  grant funds, OCC requires state lead agencies to submit a Child Care and  Development Fund Plan (State Plan) for approval. The approved State  Plans are effective during a 3-year program period, which currently runs  from fiscal years 2019 to 2021. Among other things, the State Plans are  to include a section for ensuring grantee program integrity and  accountability, which encompass both fraud and improper-payment risks.  In addition, OCC oversees regular reviews of the state lead agencies’  improper payments, which are payments that should not have been made  or were made in incorrect amounts, including overpayments and  underpayments, under statutory, contractual, administrative, or other  legally applicable requirements. When a lead agency reports an  improper payment rate at or above 10 percent, it is required to submit a  comprehensive corrective action plan (CAP). More recently, beginning in  fiscal year 2019, OCC launched its Monitoring System, which is focused  on monitoring states’ CCDF programs in several topic areas including  program integrity and accountability.

In September 2010, we reported the results of undercover tests of CCDF  programs in five states. Those undercover tests revealed the five states  lacked controls over child-care assistance applications and billing  processes for unregulated relative providers, leaving the program  vulnerable to fraud and abuse. In response, many of the tested states  noted that they had plans to implement new controls, and HHS officials  said that they had taken action to address CCDF program integrity, such  as issuing program guidance on verification procedures. More-recent  reports from state auditors and the HHS Office of the Inspector General  (OIG) have also discussed challenges in managing fraud risks in the  CCDF program.

You asked us to review CCDF program-integrity efforts. This report  discusses the extent to which OCC (1) provides oversight of states’  CCDF program-integrity activities and encourages that all requested  information is included within State Plans, (2) provides oversight of  improper-payment risks and relevant corrective actions in states’ CCDF  programs, (3) monitors states’ program-integrity activities and evaluates  their effectiveness, and (4) uses a fraud risk assessment to inform  program-integrity activities.

To determine the extent to which OCC provides oversight of states’  CCDF program-integrity activities and encourages that all needed  information is included within State Plans, we reviewed relevant laws and  regulations and interviewed OCC officials to collect information related to  their process for reviewing and approving State Plans and efforts to  oversee state lead agencies during the fiscal years 2019–2021 grant  period. We compared this information to Standards for Internal Control in  the Federal Government that were most relevant to our objectives. We  also reviewed HHS OIG reports on antifraud and program-integrity topics  across the CCDF program. We reviewed documentation related to OCC’s  State Plan review and approval process, including all 51 of the fiscal  years 2019–2021 State Plans that OCC approved in December 2018.  Specifically, we reviewed the State Plan subsections where OCC added a  new instruction requesting states to describe in their fiscal years 2019– 2021 State Plans the results of their program-integrity activities, including  activities to identify and prevent fraud. We analyzed the approved State  Plans to determine whether such descriptions were present and  discussed our findings with agency officials. We did not visit or interview  staff from the regional offices.

To determine the extent to which OCC provides oversight of improper- payment risks and relevant corrective actions in states’ CCDF programs,  we reviewed policy and procedure documents from the overall improper- payments reporting process. We compared this information to relevant  Office of Management and Budget (OMB) guidance related to payment- integrity improvement requirements and applicable rules and regulations.  Further, we reviewed all 14 CAPs submitted by states in response to  OCC’s improper-payment reviews, covering fiscal years 2013–2018, and  their associated OCC review and follow-up documents. Some of these  documents included results of internal error-rate reviews conducted by  certain states; however, we did not assess the reliability of the results.

To determine the extent to which OCC monitors states’ program-integrity  activities and evaluates their effectiveness, we interviewed OCC officials  and reviewed documentation related to OCC’s monitoring of states’  activities. Specifically, we interviewed officials regarding their efforts to  monitor states’ program-integrity activities through the OCC Monitoring  System, and OCC’s use of technical assistance to help improve states’  program-integrity activities. We compared this information with applicable  regulations, Standards for Internal Control in the Federal Government,  and selected leading practices from the Fraud Risk Framework.

To determine the extent to which OCC uses a fraud risk assessment to  inform program-integrity activities, we compared OCC policy and  procedure documents to Standards for Internal Control in the Federal  Government, selected leading practices from the Fraud Risk Framework,  and applicable CCDF laws and regulations related to fraud risk  management.

We conducted this performance audit from September 2018 to January  2020 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

The Child Care and Development Block Grant (CCDBG) Act, as  amended, is the main federal law governing state child-care programs for  low-income working families. The act was reauthorized in 2014, and the  reauthorization included a focus on improving the overall quality of child- care services and development of participating children. In September  2016, OCC published new rules (CCDF regulations) to provide clarity to  states on how to implement this law and administer the program in a way  that best meets the needs of children, child-care providers, and families.  The CCDBG Act and CCDF regulations allow states flexibility in  developing CCDF programs and policies that best suit the needs of  children and parents within that state. According to OCC, these new rules  also align child-care requirements with new Head Start regulations,  including certain requirements for background checks, annual monitoring,  and prelicensure inspections for some CCDF providers. OCC also  added regulatory requirements for state lead agencies to describe in their  State Plans effective internal controls that are in place to ensure integrity  and accountability including  1.  processes to ensure sound fiscal management,  2.  processes to identify areas of risk,  3.  processes to train child-care providers and staff of the lead agency  and other agencies engaged in the administration of the CCDF about  program requirements and integrity, and  4.  regular evaluation of internal control activities.

Lead agencies are also required to describe in their State Plans the  processes that are in place to identify fraud or other program violations,  and to investigate and recover fraudulent payments and to impose  sanctions in response to fraud.

OCC is a program office within ACF that works with the states to  administer the CCDF program. OCC and states each have responsibility  for overseeing and protecting the integrity of the CCDF program. Each  state must develop, and submit to OCC for approval, a State Plan that  identifies the purposes for which CCDF funds will be spent for a 3-year  grant period and designates a lead agency responsible for administering  child-care programs. To administer CCDF funds, federal law and  regulations require that states report their CCDF expenditures and data  on the number of children served by CCDF subsidies. The current  reporting structure as described by OCC and ACF officials is shown in  figure 1.

To request funding from the CCDF, states submit a State Plan for  administering their CCDF programs to OCC. OCC provides states with a  Plan Preprint, which serves as a template and includes instructions and  guidance on developing the State Plans and providing information  required by law and regulations. Further, OCC has used the Plan Preprint  to request additional information from the states. The Plan Preprint  developed for fiscal years 2019–2021 State Plans consists of eight  sections and is the first to include the new CCDF regulatory requirements,  added in September 2016 as required by the 2014 reauthorization. One  of the new requirements is for state lead agencies to describe in their  State Plans effective internal controls that are in place to ensure integrity  and accountability. In addition, OCC modified the Plan Preprint for fiscal  years 2019–2021 State Plans to add the instruction requesting states to  report information about the results of their program-integrity and fraud- fighting activities, in addition to providing descriptions of the activities  themselves.

The Secretary of Health and Human Services, through OCC, has the  responsibility to approve State Plans that satisfy the requirements, and  review and monitor state compliance with the approved State Plan.  According to OCC officials, the Program Operations Division within OCC,  in partnership with the OCC regional program unit staff (regional offices),  reviews the State Plans and approves those that they determine have  satisfied the requirements of the CCDBG Act and CCDF regulations.

The CCDF has been designated as a high-priority program, as defined by  OMB, under the Improper Payments Elimination and Recovery  Improvement Act of 2012 (IPERIA), meaning that it is a program  susceptible to significant improper payments. Federal statutes require  federal agencies to evaluate programs for improper-payment risk and, for  programs susceptible to significant improper payments, to report on  actions taken to reduce improper payments. CCDF regulations  implement these requirements by requiring states to calculate and report  estimates of their improper payments, including proposed actions to  address sources of error. These reports are developed by the states on a  3-year rotational cycle, and HHS reports the aggregate results in its  Agency Financial Report. The CCDF gross improper payment estimate  for fiscal year 2019 is approximately $325 million, and the estimated  improper payment rate is 4.53 percent.

OCC oversees states’ compliance with the prescribed procedures for  estimating improper-payment error rates by approving the preliminary  documents, approving any changes to the case samples, conducting the  Joint Case Reviews, and reviewing and approving the final State  Improper Payments Report and CAP submissions. If a state reports an  error rate at or above 10 percent, it must also submit a CAP, which  includes detailed descriptions of specific activities planned to reach a  targeted reduction in errors. It must then submit an update on its progress  and a new CAP the following year if it has not completed the proposed  corrective actions or if the error rate is still at or above 10 percent. The  improper-payment reporting process is illustrated in figure 2.

In fiscal year 2019, OCC launched a formal Monitoring System to review  a selection of states annually over the course of the 3-year State Plan  period. According to OCC officials, the three main purposes of the  Monitoring System are to: (1) ensure compliance with the CCDBG Act,  CCDF regulations, and the approved State Plans; (2) identify state  technical-assistance needs; and (3) identify promising practices to inform  continuous quality improvement. The Monitoring System focuses on 11  topic areas, which include program integrity and accountability. In  addition, other topic areas include disaster preparedness, consumer  education, and health and safety requirements.

OCC officials told us that monitoring is completed on a rolling basis, and  that they plan to monitor one-third of states each fiscal year, from fiscal  years 2019 to 2021. According to OCC officials, they scheduled the  monitoring to ensure that a state will not be submitting an improper- payment report in the same year that it participates in the monitoring.  Figure 3 provides additional details regarding the OCC Monitoring System  process, which includes an on-site visit to monitored states.

Fraud and “fraud risk” are distinct concepts. Fraud risk exists when  individuals have an opportunity to engage in fraudulent activity, have an  incentive or are under pressure to commit fraud, or are able to rationalize  committing fraud. Although the occurrence of fraud indicates there is a  fraud risk, a fraud risk can exist even if fraud has not yet been identified  or occurred. For example, suspicious billing patterns or complexities in  program design may indicate a risk of fraud even though fraud has not  been identified or occurred. When fraud risks can be identified and  mitigated, fraud may be less likely to occur.

According to federal standards and guidance, executive-branch agency  managers are responsible for managing fraud risks and implementing  practices for combating those risks. Specifically, federal internal control  standards state that management should consider the potential for fraud  when identifying, analyzing, and responding to risks. As part of these  standards, management assesses risks the entity faces from both  external and internal sources. In addition, in July 2015, GAO issued the  Fraud Risk Framework, which provides a comprehensive set of key  components and leading practices that serve as a guide for agency  managers to use when developing efforts to combat fraud in a strategic,  risk-based way. The Fraud Risk Framework describes leading practices  in four components, as shown in figure 4.

The Fraud Reduction and Data Analytics Act of 2015, enacted in June  2016, required OMB to establish guidelines for federal agencies to create  controls to identify and assess fraud risks, and design and implement antifraud control activities. The act further required OMB to incorporate  the leading practices from the Fraud Risk Framework in the guidelines.  In July 2016, OMB published guidance about enterprise risk management  and internal controls in federal executive departments and agencies.  Among other things, this guidance affirms that managers should adhere  to the leading practices identified in the Fraud Risk Framework.

OCC Provides Oversight by Approving State Plans but Has Not Established Policies for Reviewing State Plans and Has Not Defined Its Informational Needs

As part of its oversight of states’ CCDF programs, OCC reviewed and  approved State Plans for the current grant period (fiscal years 2019– 2021). However, OCC has not established written policies to guide staff  review and approval of these State Plans, a process that occurs every 3  years. OCC’s lack of established policies limits its ability to ensure that  staff follow appropriate protocols for consistency when reviewing and  approving State Plans and to retain organizational knowledge in the event  of staff turnover, which OCC noted as occurring during each review  period. Further, OCC requested that states report information about the  results of states’ program-integrity activities. However, most of the State  Plans that it approved did not provide the results of states’ program- integrity activities as requested. OCC officials told us that they plan to  continue to request that states report on the results of their program- integrity activities, but OCC has not identified what it considers to be  “results” of program-integrity activities. Without taking additional steps to  define its informational needs and encourage states to report the results  of their program-integrity activities, OCC will not have this information to  help determine whether states are effectively ensuring the integrity of the  CCDF program.

To provide oversight of states’ CCDF program-integrity activities, OCC  reviewed and approved State Plans for the current grant period, covering  fiscal years 2019–2021. To do so, OCC officials described to us a  process that began with a high-level review of the draft State Plans  submitted through an electronic system. After an initial review for  completeness, OCC staff focused on the contents of the State Plans  including states’ responsiveness to each requirement. For example, one  requirement is to describe the processes that the state will use to identify  risk in its CCDF program. OCC officials also stated that they consider  clarity, consistency, and compliance when assessing State Plans. OCC  officials also explained that they reviewed the responses to determine  whether they were sufficiently detailed, and sought clarification from the  states when necessary. OCC officials stated that, prior to the final  approval of the State Plans, staff completed a validation form that  consists of a table listing the State Plan subsections with checkboxes  next to each subsection. Figure 5 outlines the timeline for review and  approval of State Plans.

OCC Does Not Have Finalized Written Policies to Implement the Review Process

OCC has developed a draft procedure for the State Plan review and  approval process, but had neither finalized written policies before  beginning its review of the fiscal years 2019–2021 State Plans, nor  finalized written policies for future review periods that occur every 3  years. Instead, OCC officials told us that for the review and approval  process completed in 2018, they provided their staff a variety of training  materials and draft documents that encouraged discussion among those  involved. These documents contained information and guidance on the  process, such as explaining the overall operational processes for  reviewing and approving State Plans and general roles and  responsibilities. However, none of the documents were finalized as  OCC’s written policies for staff to follow when implementing the fiscal  years 2019–2021 State Plan review and approval process, or for  subsequent review periods.

In response to our request for finalized policies pertaining to how OCC  reviewed and approved State Plans, OCC provided documents that have  substantial limitations for explaining to OCC staff how they should review  and approve State Plans. For example, OCC provided what it  characterized as a three-page summary protocol, which, in part,  contained a historical record of what occurred during the recently  completed review period rather than guidance that would help OCC  achieve its State Plan review objectives on a continuous basis.  Specifically, the protocol describes the regular internal meetings and  interactions that OCC staff had from September 2018 to December 2018.  As such, the protocol does not describe the process that OCC staff  should follow, or the meetings that should occur, when reviewing and  approving State Plans in future years (i.e., on a continuous basis).

OCC also developed in August 2018 a more-detailed draft procedure for  reviewing and approving State Plans. The draft procedure contains  information on the communication process between the central and  regional offices, recognizes that there may be variation in internal  processes among regional offices and from one review period to the next,  and includes guidance on steps for resolving questions about State  Plans, among other guidance. Unlike the three-page summary protocol,  the draft procedure explicitly states its applicability to future review  periods as well as the current State Plan review period, and therefore  would have provided guidance for staff on a continuous basis had a  finalized version been shared with staff and established as OCC’s written  policies. However, because of the volume of work and differences in  caseloads among regional offices, OCC officials stated that they did not  share a finalized procedure with staff and that staff were neither expected  nor required to use the draft procedure when conducting their review of  State Plans for the fiscal years 2019–2021 review period. As such, this  draft procedure did not represent the formal policies for staff to follow in  performing their roles.

In explaining why it relies on the three-page summary protocol and draft  procedure rather than finalized written policies to guide its State Plan  review and approval process, OCC officials stated that OCC needs  flexibility in its policies during the review period. Specifically, there are  staffing changes in both the central and regional offices for each State  Plan review period, and having flexibility within the framework provided by  the three-page summary protocol allows them to accommodate those  changes. OCC officials noted that some of the processes are unique to  each of the 10 regional offices because of differences in their structure,  staffing, and caseloads. Likewise, OCC officials stated that the regional  offices need flexibility to continuously adjust processes and timelines so  that they can accommodate varying responsiveness from states, and  evaluate the State Plans without undermining the flexibility afforded to  states through the block grant. However, it is possible for OCC to  establish written policies to guide processes that are common from one  review period to the next, and across all regions, while still maintaining  the necessary flexibility to accommodate staffing changes and regional  differences, as it had already begun to do by developing its August 2018  draft procedure.

In this regard, Standards for Internal Control in the Federal Government  states that management should implement control activities through  policies. In doing so, management communicates the policies to  personnel so that personnel can implement the control activities for their  assigned responsibilities. Further, Standards for Internal Control in the  Federal Government includes minimum documentation requirements,  such as that management develop and maintain documentation of its  internal control system. An internal control system is a continuous built-in  component of operations that provides reasonable assurance that an  entity’s objectives will be achieved. Internal control is not one event, but a  series of actions that occur throughout an entity’s operations. Further,  internal control is recognized as an integral part of the operational  processes management uses to guide its operations, and internal control  is built into the entity as a part of the organizational structure to help  managers achieve the entity’s objectives on an ongoing basis. As such,  documentation of the internal control system should reflect a continuous,  built-in component of operations rather than a historical record of a past  event. Documentation also provides a means to retain organizational  knowledge and mitigate the risk of having that knowledge limited to a few  personnel. OCC’s lack of established written policies limits its ability to  ensure that staff follow appropriate protocols on a continuous basis when  implementing the State Plan review and approval process, and limits its  ability to provide a means to retain organizational knowledge and mitigate  the risk of having that knowledge limited to a few personnel. Without  finalizing written policies, an effort that could include leveraging its  previously developed August 2018 draft procedure, OCC risks losing that  knowledge each time there are staffing changes among central and  regional offices.

OCC Has Not Defined Information Needed to Analyze States’ Program- Integrity Results

In response to a 2016 HHS OIG report, OCC has attempted to collect  information about the results of states’ program-integrity and fraud- fighting activities by adding a new instruction to the fiscal years 2019– 2021 Plan Preprint requesting states to report such information in their  State Plans. Specifically, the HHS OIG recommended that collecting  data on program-integrity and fraud-fighting results would be an important  step in monitoring states’ efforts to safeguard the CCDF program.  Additionally, OCC officials told us that obtaining information on the results  of program-integrity activities is important for understanding national  trends and helping to inform OCC’s technical assistance to states and  ensure states’ accountability over their program-integrity activities.  However, our review of 51 approved State Plans found that 43 State  Plans (about 84 percent) did not report the results of program-integrity  activities as requested (see fig. 6). The other eight states (about 16  percent) reported the results of program-integrity activities.

State Plans must meet the requirements set forth in the law and the  CCDF regulations to be approved. OCC officials told us that the State  Plans were approved without the information on the results of program- integrity activities because, although there are instructions in the Plan  Preprint for states to report this information, the CCDF regulations do not  require it. Further, OCC officials told us that when OCC submitted the  Plan Preprint to OMB for approval under the Paperwork Reduction Act,  OCC had indicated that the program-integrity results would be collected  on an informational basis, and states would not be required to provide this  information. According to an OCC official, only portions of the Plan  Preprint with instructions for states to report on the results of program- integrity activities were requested on an informational basis, and all other  information in that section was required for approval of the State Plans.

OCC officials also told us that OCC will continue to request that states  report on the results of their program-integrity activities in the State Plans,  but OCC has not defined what information it needs regarding the “results”  of states’ program-integrity activities and has not communicated the need  to states or its staff. OCC officials told us that they will ensure that states  submit this information by providing guidance to states on the purpose of  collecting this information. However, OCC was not able to provide us with  a definition or examples of what it considers to be “results” of program- integrity activities that would be helpful for ensuring states’ accountability  over their program-integrity activities. In addition, OCC officials said that  OCC did not communicate to states that the information about the results  of program-integrity activities was being requested on an informational  basis only. According to OCC officials, OCC did not specifically  communicate its intention to states because it wanted states to provide a  response, if possible. Similarly, OCC had not developed any specific  internal criteria for its staff to use when reviewing State Plans to  determine whether certain responses were sufficient for their  informational needs, such as to better understand national trends. OCC  officials also stated that there was no internal written guidance explaining  to OCC staff that such information was not required for State Plan  approval. Rather, this standard was communicated to staff during weekly  meetings.

Standards for Internal Control in the Federal Government states that  management should use quality information to achieve the entity’s  objectives. In doing so, management identifies the information  requirements needed and defines the information requirements at the  relevant level and requisite specificity for appropriate personnel. Further,  Standards for Internal Control in the Federal Government states that  management should internally and externally communicate the necessary  quality information to achieve the entity’s objectives. In this context, after  defining its informational needs regarding the results of program-integrity  activities, OCC’s internal and external communication could include  communication to the states, which are requested to include this  information in the State Plans, and to its staff who will be responsible for  analyzing this information. Until OCC defines what information it needs  regarding program-integrity activity results, it will be limited in its ability to  obtain quality information. By not communicating informational needs to  states and staff, OCC will continue to lack quality information about the  results of states’ program-integrity efforts and will not be able to use that  information to analyze national trends and help ensure states’  accountability over their program-integrity activities, as described.

OCC Provides Oversight of States’ Improper Payment Risks but Lacks Documented Guidance for Assessing States’ Corrective Actions

Since 2013, seven states with improper-payment rates at 10 percent or  above have submitted 14 corrective action plans (CAP) to OCC for  review. However, OCC does not have any documented criteria to guide  the review of the CAPs submitted by states to ensure the proposed  actions are aimed at root causes of improper payments and are  effectively implemented. OCC also has not documented the procedures it  uses to follow up with states subject to CAPs, but said it is planning to.

OCC Lacks Guidance for Ensuring Corrective Actions Are Aimed at Root Causes and Effectively Implemented

Federal improper-payment statutes require federal agencies to review  programs susceptible to significant improper-payment risks and develop  actions to reduce improper payments. For example, the Improper  Payments Elimination and Recovery Act of 2010 (IPERA) specifically  requires agencies administering programs that are susceptible to  significant improper payments, such as the CCDF, to report on actions  the agency is taking to reduce improper payments. Because the CCDF is  administered by states, this requirement is implemented in CCDF  regulations by requiring states reporting improper-payment error rates at  or above 10 percent to develop and implement CAPs. The OMB guidance  implementing IPERA states that agencies should ensure that each  corrective action is specifically aimed at a root cause of improper  payments and that the actions are effectively implemented to prevent and  reduce improper payments. According to this guidance, a root cause is  something that would directly lead to an improper payment and, if  corrected, would prevent the improper payment. In the proposed  rulemaking in which OCC introduced the CAPs, OCC stated that the  CAPs are intended to be comprehensive and detailed, so as to improve  upon the descriptions of corrective actions already reported on a 3-year  cycle, which sometimes lack detail or specificity.

OCC officials told us that OCC reviewers use their CAP Review Tool to  evaluate the CAPs for approval, which also lays out the protocol for  conducting reviews. However, the CAP Review Tool does not require  reviewers to document whether the corrective actions proposed by states  are aimed at root causes of improper payments, or effectively  implemented. Further, the written review procedure that accompanies the  CAP Review Tool does not contain guidance for reviewers on evaluating  whether corrective actions are aimed at root causes and are effectively  implemented. OCC officials explained to us that, in their view, states are  in the best position to identify the most-feasible approach to corrective  actions based on their individual circumstances. We acknowledge that  states should have flexibility to identify corrective actions based on their  individual circumstances. However, according to OMB guidance, it is  federal agencies that are to ensure that corrective actions are aimed at  root causes of improper payments and effectively implemented. Further,  in the proposed rulemaking in which OCC introduced the CAPs, OCC  stated that it intended the CAPs to be used for OCC to hold states  accountable as part of its compliance with IPERA. Accordingly, without  providing additional guidance to its reviewers, OCC will lack assurance  that states’ proposed corrective actions are aimed at root causes and  effectively implemented.

OCC officials also stated that the majority of the seven states subject to  CAPs reduced their error rates over time, specifically to below 10 percent.  OCC officials explained that this determination is based on the  submission of the State Improper Payment Report for the next required  reporting cycle or on states’ voluntarily conducting a review of a sample of  cases and submitting the results to OCC to demonstrate they had  reduced their error rate to below 10 percent. We did not independently  corroborate OCC’s determination because assessing the reliability of the  self-attested internal error-rate reviews conducted by certain states and  reviewing this information was outside the scope of our work. However,  as part of our review of the 14 CAPs that have been submitted to OCC in  response to OCC’s improper-payment reviews since 2013, we found that  one state was required to submit CAPs for 3 consecutive years and  consistently proposed the same error-rate reduction targets, with different  dates. This observation underscores the need to ensure the corrective  actions a state proposes are specifically aimed at root causes of improper  payments and are effectively implemented. OCC does not have guidance  in place for its reviewers to determine whether the ongoing corrective  actions a state proposes to reduce improper payments will be specifically  aimed at root causes of improper payments and effectively implemented.  This could leave the CCDF program at continued risk of improper  payments.

OCC Plans to Document Its CAP Follow-up Process

OCC does not have written policies for its CAP follow-up process or  documentation that follow-up has been completed for past CAPs. OCC  officials told us that they plan to develop such written policies, but officials  did not specify a timeline for completion. OCC officials described their  process used to monitor states while they are subject to a CAP, which  includes additional contact when the same state has been subject to  CAPs for consecutive years. This CAP follow-up process is illustrated in  figure 7.

According to OCC officials, OCC intends to develop written policies for  the CAP follow-up process but did not provide a time frame for  completion. This will include, at a minimum, a written protocol for the  activities illustrated above, which will be included in the next revision of  the instructions given to states for improper-payment reporting. According  to OCC officials, each region currently has its own process for  documenting discussions with CAP states. Having established written  policies for the CAP follow-up process will help ensure that OCC’s  oversight and monitoring of CAPs is carried out consistently.

OCC Has Taken Some Steps to Monitor States’ Program-Integrity Activities but Does Not Evaluate Their Effectiveness

OCC Has Initiated a Monitoring System, but the System Does Not Assess Effectiveness of States’ Program-Integrity Control Activities

OCC officials told us that their Monitoring System, initiated in fiscal year  2019, plays a part in OCC’s role to ensure that states’ program-integrity  activities are effective. According to OCC officials, OCC uses two tools as  part of its Monitoring System—a Compliance Demonstration Packet and  Data Collection Tool. States complete the Compliance Demonstration  Packet to outline how they propose to demonstrate compliance with  regulatory requirements and implementation of the approved State Plans  throughout the Monitoring System’s phases. For example, to show  effective internal controls are in place to ensure integrity and  accountability, states may provide OCC with state or local policies and  manuals (previsit phase), and may submit to interviews or provide system  demonstrations (on-site visit phase). OCC staff use the Data Collection  Tool to record comments about the evidence observed, and to note  whether additional follow-up is needed. Both of these tools contain  language indicating that the effectiveness of states’ program-integrity and  fraud-fighting activities are evaluated by OCC staff.

For purposes of the Monitoring System, OCC officials said that states  have broad flexibility to propose, in the Compliance Demonstration  Packet, what documents and evidence to provide. In addition, states have  the flexibility to propose how the state will demonstrate compliance with  regulatory requirements. This includes the requirement to describe in its  State Plan effective program-integrity control activities, which includes  fraud-fighting activities. OCC officials further told us that OCC does not  collect the same set of information or evidence across the country.  Rather, OCC collects state-specific information based on what each  individual state proposes. For example, the Compliance Demonstration  Packet allows states to propose an approach for demonstrating their  compliance with the requirement to describe in their State Plans effective  internal controls that are in place to ensure integrity and accountability.

OCC officials said the primary purpose of the Monitoring System is to  ensure that states are in compliance with CCDF regulations and  implementing the State Plans as approved, rather than to make an  assessment of the efficacy of the State Plans. When we asked OCC  officials how they determine whether a state has provided appropriate  and adequate documentation for the purposes of the Monitoring System,  these officials told us that staff develop specific questions for each state  and look for evidence showing that states are implementing the State  Plans as approved. For example, OCC officials might look for evidence of  a state’s implementation of certain program-integrity activities described  in its approved State Plan to verify that the activities described are in  place. OCC officials also stated that staff decide what is acceptable  through consensus and attempt to build consistency through internal  discussions regarding the appropriateness of the material that states  provide. However, there are no specific criteria to guide OCC staff’s  assessment of the effectiveness of states’ program-integrity activities  during these discussions. For example, there are no specific criteria to  help OCC staff assess whether states’ implemented control activities are  effective at identifying areas of risk. OCC officials stated that the CCDF  regulations and the approved State Plans are the most-detailed criteria  that they use to assess data collected for the Monitoring System.  However, neither the CCDF regulations nor the State Plans include  specific criteria for assessing whether the control activities are effective.

OCC is responsible for monitoring states’ compliance with the CCDF  regulations, and these regulations explicitly require that states describe in  their State Plans “effective internal controls that are in place to ensure  integrity and accountability.” According to Standards for Internal Control  in the Federal Government, an effective internal control system has a  monitoring component that is effectively designed, implemented, and  operating. Additionally, a leading practice of the Fraud Risk Framework is  to examine the suitability of existing fraud controls. Managers who  effectively implement an antifraud strategy monitor and evaluate the  effectiveness of preventive activities in this strategy and take steps to  help ensure external parties with responsibility over fraud control activities  effectively implement those activities. Without developing and using  criteria to assess whether states’ program-integrity control activities are  effective, OCC cannot ensure that states’ internal controls for program  integrity are effective. Likewise, without examining the suitability of, and  monitoring the effectiveness of, the states’ fraud control activities, OCC  will be challenged in effectively implementing an antifraud strategy to  minimize the risk of fraud in the CCDF program.

OCC Has Developed Technical Assistance to Improve Program Integrity and Has Further Opportunities to Use These Tools to Monitor States’ Program-Integrity Activities

OCC developed the Grantee Internal Controls Self-Assessment  Instrument (Self-Assessment Instrument) in 2010 and makes the  technical-assistance tool available to the states through its website. In  response to a 2016 HHS OIG report, ACF officials said that OCC would  use the Self-Assessment Instrument to address the report’s  recommendations to request that states examine the effectiveness of  their program-integrity and fraud-fighting activities, and examine with  states the benefits of expanding such activities. The Self-Assessment  Instrument contains five sections: (1) Eligibility Determination and  Review; (2) Improper Payment Case Review Process; (3) Fraud and  Overpayment Prevention, Detection, and Recovery; (4) Federal  Reporting; and (5) Audits and Monitoring. According to OCC officials, as  of August 2019, 19 states have completed the Self-Assessment  Instrument since its inception.

OCC officials stated that use of the Self-Assessment Instrument is based  entirely on states’ self-identified risks, and states are free to choose  which, if any, of the sections to complete. OCC officials have noted  benefits as a result of states completing the Self-Assessment Instrument.  Specifically, OCC officials said that states have improved their  implementation processes and policies, and improper-payment error rates  have decreased. In addition to making the tool available to states, OCC  officials told us that OCC also provides technical assistance in completing  the Self-Assessment Instrument, which may include an on-site facilitated  discussion. The facilitated discussion may cover areas including control  activities to identify and prevent fraud, and strategies to investigate and  collect improper payments. Following the on-site facilitated discussion, an  OCC contractor compiles a report summarizing state-identified issues to  address in states’ policies and procedures, according to one OCC official.

However, OCC officials told us that states are not required to act on this  report.

In addition to the Self-Assessment Instrument, OCC has recently  coordinated on the development of the Fraud Toolkit, which is a series of  electronic spreadsheets that states can use to respond to questions about  their fraud risk management activities—such as staff training, procedures  for addressing suspected fraud, and program administration. The tools  assign risk levels to these areas based on the state’s responses, and will  also include recommended next steps for each of those areas and  generate a report to summarize overall risk. For example, data from these  tools would indicate whether states’ CCDF program staff are trained to  identify forms, such as wage stubs or employer letters that may have  been forged or altered. The data would also indicate whether the state  has a fraud referral process in place to expedite investigations. OCC  makes the Fraud Toolkit available for states to use upon request.  However, other than making the tool available, OCC officials said that  OCC does not usually have any further involvement in states’ use of the  tool.

OCC officials told us that they do not plan to use either the Self- Assessment Instrument or the Fraud Toolkit to collect data about states’  CCDF programs because both the Self-Assessment Instrument and the  Fraud Toolkit are intended as primarily technical-assistance tools rather  than monitoring tools or data-collection instruments. OCC officials also  told us that, to formally collect information from states’ use of such tools,  they would need to seek approval from OMB. OCC officials stated that  OCC’s goal is to develop technical assistance that best meets the needs  of the states, and not to impose additional reporting requirements on the  states. Officials also noted a concern that states could cease to  participate in or accept technical assistance if such assistance is seen as  increasing reporting requirements. However, according to OCC officials,  OCC has not conducted a cost-benefit analysis of collecting such  information.

Leading practices in the Fraud Risk Framework are to monitor and  evaluate the effectiveness of preventive activities; collect and analyze  data; and adapt activities to improve fraud risk management. Further,  although external parties—in this case, the state lead agencies—may be  responsible for specific fraud control activities, Standards for Internal  Control in the Federal Government states that management should  establish and operate monitoring activities to monitor the internal control  system and evaluate the results. As part of these standards, management  retains responsibility for monitoring the effectiveness of internal control  over the assigned processes performed by external parties. Management  is responsible for meeting internal control objectives, and may decide how  the entity evaluates the costs versus benefits of various approaches to  implementing an effective internal control system. However, cost alone is  not an acceptable reason to avoid implementing internal controls, and  cost-benefit considerations support management’s ability to effectively  design, implement, and operate an internal control system that balances  the allocation of resources and other factors relevant to achieving the  entity’s objectives. By not evaluating the feasibility of collecting  information from the Self-Assessment Instrument or the Fraud Toolkit— such as evaluating the feasibility of doing so during its Monitoring System  process—OCC may be missing an opportunity to monitor the  effectiveness of the internal control system to help states adapt control  activities to improve fraud risk management.

OCC’s Program- Integrity and State- Oversight Activities Are Not Informed by a Fraud Risk Assessment

As described above, OCC has developed several program-integrity  activities that could help assess and manage fraud risk if they were part  of an antifraud strategy. For example, the improper-payment reporting  process and Monitoring System are not specific to fraud but may  generate information relevant to fraud risks. However, according to OCC  officials, ACF has not completed a fraud risk assessment for the CCDF,  which would provide a basis for the development of an antifraud strategy  that describes the program’s approach for addressing prioritized fraud  risks identified, as described in the Fraud Risk Framework.

The Assess component of the Fraud Risk Framework calls for federal  managers to plan regular fraud risk assessments and to assess risks to  determine a fraud risk profile. Furthermore, Standards for Internal  Control in the Federal Government states that management should  consider the potential for fraud when identifying, analyzing, and  responding to risks. Leading practices for planning fraud risk  assessments include tailoring the fraud risk assessment to the program  and planning to conduct the assessment at regular intervals and when  there are changes to the program or operating environment. The leading  practices also include identifying the tools, methods, and sources for  gathering information about fraud risks and involving relevant  stakeholders in the assessment process. The Fraud Risk Framework also  identifies leading practices for conducting fraud risk assessments and  documenting the program’s fraud risk profile, as illustrated in figure 8. As  discussed in the Fraud Risk Framework, the fraud risk profile provides a  basis for managers to develop and document an antifraud strategy that  describes the program’s approach for addressing prioritized fraud risks  identified.

According to ACF, there is currently a process in place at the ACF level  that will lead to the development of a Fraud Risk Assessment.  Specifically, ACF is in the process of developing a Fraud Risk  Assessment template, which will include a program fraud risk profile. The  CCDF will be part of the pilot program for this effort. The Fraud Risk  Assessment template will consider the Fraud Risk Framework as well as  guidance contained in OMB Circular A-123, Management’s Responsibility  for Enterprise Risk Management and Internal Control, according to OCC  officials. These officials also stated that ACF will leverage its previously  developed and implemented risk assessments, including the Program  Risk Assessment that was completed for the CCDF between fiscal years  2011 and 2016 as part of the HHS Program Integrity Initiative.

However, according to ACF, the development of a Fraud Risk  Assessment template is currently on hold due to competing priorities. The  ACF stated the agency expects to resume the process by December  2019, and OCC expects that the draft template will be completed by the  end of the first quarter of fiscal year 2020. Because the CCDF is serving  as the pilot for the new template, OCC expects that the initial assessment  of the program will be complete by the end of the third quarter of fiscal  year 2020. Until ACF finalizes its template and conducts a risk  assessment for the CCDF, ACF will not be able to develop a fraud risk  profile for the CCDF. The fraud risk profile is an essential piece of the  antifraud strategy and informs the specific control activities managers  design and implement. Although there is currently a process in place for  ACF to develop a fraud risk assessment template, until ACF carries out  the assessment of the CCDF and develops an associated fraud risk  strategy, it will lack assurance that OCC’s program-integrity activities are  suitable and targeted at prioritized fraud risks.

Both state lead agencies and OCC play an important role in overseeing  and protecting the integrity of the CCDF program. However, OCC has not  finalized written policies that describes how staff should implement or  document the State Plan review and approval process, which is an  important part of OCC’s oversight of the CCDF program. OCC’s lack of  established written policies limits its ability to ensure that staff follow  appropriate protocols when implementing the State Plan review and  approval process, and limits its ability to retain organizational knowledge  in the event of staff turnover, which OCC noted as occurring during each  review period. In addition, most of the State Plans submitted to OCC for  the fiscal years 2019–2021 grant period did not contain information on the  results of their states’ program-integrity activities. OCC also has not  defined or communicated what it considers to be the “results” of program- integrity activities for states, which are requested to include this  information in State Plans, or for its staff who will be responsible for  analyzing this information. Until OCC defines its informational needs  regarding program-integrity activity results and communicates this  information to the states and its own staff, OCC may continue to lack  quality information to help ensure states’ accountability of their program- integrity activities.

Further, OCC does not have documented criteria to guide the review of  the CAPs to ensure the proposed corrective actions are aimed at root  causes of improper payments and are effectively implemented to prevent  and reduce improper payments. Without criteria for its staff to use in  reviewing the CAPs, OCC does not have assurance that the corrective  actions a state proposes to reduce improper payments will be specifically  aimed at root causes of improper payments and effectively implemented,  leaving the CCDF program at continued risk of improper payments. OCC  also does not have written policies for its CAP follow-up process or  documentation that follow-up has been completed for past CAPs. In  addition, OCC officials told us that they plan to develop a written protocol  for this process, but did not specify a timeline for completion. Having  established written policies for the CAP follow-up process will help ensure  that OCC’s oversight and monitoring of CAPs is carried out consistently.

OCC’s Monitoring System process does not currently contain criteria to  assess the effectiveness of states’ program-integrity control activities,  including fraud-fighting activities. Without developing and documenting  criteria to assess whether states’ program-integrity control activities are  effective, OCC cannot ensure that such program-integrity control activities  are effective. In addition, OCC does not plan to collect any data from its  technical-assistance tools that could potentially help it to monitor and  evaluate the effectiveness of states’ program-integrity activities. However,  OCC has not evaluated the benefits of using these tools to collect  information on program-integrity activities against any costs of doing so— such as the cost of seeking OMB approval to do so. By not evaluating the  feasibility of collecting information from technical-assistance tools to  monitor the effectiveness of states’ program-integrity control activities,  OCC may be missing an opportunity to help states adapt control activities  to improve their fraud risk management.

All of the foregoing program-integrity oversight and monitoring activities  could contribute to a strategy for managing fraud risks in the CCDF.  However, OCC has not completed a fraud risk assessment or risk profile  for the program. Although there is currently a process in place for ACF to  develop a fraud risk assessment template, until ACF completes this  template and carries out the assessment of the CCDF, it will lack a robust  antifraud strategy and assurance that OCC’s current program-integrity  activities are suitable and targeted at prioritized risk.

We are making the following nine recommendations, eight to the Director  of OCC and one to the Assistant Secretary for ACF:

The Director of OCC should establish internal written policies to  effectively implement and document the State Plan review and  approval process for future review and approval periods.  (Recommendation 1)

The Director of OCC should define the informational needs related to  the results of program-integrity activities. (Recommendation 2)

The Director of OCC should communicate externally to the states its  informational needs related to the results of states’ program-integrity  activities. (Recommendation 3)

The Director of OCC should communicate internally to staff its  informational needs related to the results of states’ program-integrity  activities. (Recommendation 4)

The Director of OCC should develop documented criteria to guide the  review of CAPs submitted by states to ensure that proposed  corrective actions are aimed at root causes of improper payments and  are effectively implemented. (Recommendation 5)

The Director of OCC should timely complete its effort to develop  established written policies for the CAP follow-up process to ensure  that OCC’s oversight and monitoring of CAPs is carried out  consistently. (Recommendation 6)

The Director of OCC should develop and document criteria to assess  the effectiveness of states’ program-integrity control activities.  (Recommendation 7)

The Director of OCC should evaluate the feasibility of collecting  information from the Grantee Internal Controls Self-Assessment  Instrument (Self-Assessment Instrument) and Fraud Toolkit, such as  during its Monitoring System process, to monitor the effectiveness of  states’ program-integrity control activities. (Recommendation 8)

The Assistant Secretary for ACF should ensure that ACF conducts a  fraud risk assessment to provide a basis for the documentation and  development of an antifraud strategy that describes the CCDF  program’s approach to address prioritizing fraud risks identified.  (Recommendation 9)

We provided a draft of this report to HHS for review and comment. In its  comments, reproduced in appendix I, HHS concurred with our  recommendations.  HHS also provided technical comments, which we  incorporated as appropriate.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Health  and Human Services and appropriate congressional committees. In  addition, the report will be available at no charge on the GAO website at  http://www.gao.gov.

If you or your staffs have any questions about this report, please contact  me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix II.

Appendix I: Comments from the Department of Health and Human Services

Appendix II: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Jonathon Oldmixon (Assistant  Director), Erica Varner (Analyst in Charge), Yue Pui Chin, and Daniel Dye  made key contributions to this report. Other contributors include James  Ashley, Maria McMullen, George Ogilvie, and Sabrina Streagle.

States receive federal money from the Child Care and Development Fund to help low-income families pay for child care while parents work or attend school.

HHS’s Office of Child Care oversees and approves state programs, including their plans for identifying fraud and payment errors. For example, how are states ensuring funds are appropriately allocated—such as not reimbursing for child care that was never provided?

While HHS has taken steps to monitor state programs for fraud and payment errors, it needs to fully assess fraud risks to the fund. We made 9 recommendations to better protect the integrity of the fund.