Improper Payments: Improvements Needed to Ensure Reliability and Accuracy in DOE's Risk Assessments and Reporting

Improper payments—payments that should not have been made or were made in an incorrect amount—are a significant problem in the federal government. Agencies are required to perform risk assessments to identify programs that are susceptible to significant improper payments.

House Report 115-697 included a provision for GAO to review DOE's system for tracking improper payments. This report examines the extent to which (1) the amounts reported in DOE's AFRs for fiscal years 2015 through 2019 were accurate and complete, and (2) its fiscal year 2018 risk assessment provided a reasonable basis for its risk determination. GAO reviewed DOE's improper payment reporting for fiscal years 2015 through 2019 and its fiscal year 2018 risk assessment, and reviewed documents and interviewed officials from 10 of 48 reporting sites selected to provide a range of sites and about half of fiscal year 2018 reported improper payments.

The improper payments amounts that the Department of Energy (DOE) reported in its annual agency financial reports (AFR) for fiscal years 2015 through 2019 may not be accurate or complete. Agencies with programs that are susceptible to significant improper payments—including those with more than $100 million of improper payments in a year—are required to report statistically valid estimates of their improper payments. DOE determined these requirements did not apply, but optionally reported information on actual improper payments it made and identified in the prior year. For example, in its fiscal year 2019 AFR, DOE reported fiscal year 2018 improper payments—such as those made to contractors for unallowable costs—totaling about $36 million, less than 0.1 percent of its outlays. However, DOE did not disclose that these amounts do not include improper payments identified through reviews, audits, and investigations completed several years after it issues its AFR (see figure). For example, as of September 2019, DOE had not audited $23.8 billion of its $38.5 billion in fiscal year 2018 outlays. Such audits may increase the improper payments in a year by millions of dollars. For example, based on a 2017 audit, DOE identified $34 million in fiscal year 2010 improper payments. DOE does not always track information on the year improper payments were made that would allow it to determine whether improper payments identified later would increase the total to more than $100 million. By tracking and disclosing such information, DOE could better inform Congress, the public, and others about whether it exceeded the $100 million threshold and should be subject to additional reporting requirements.

DOE determined that its risk of significant improper payments was low in its fiscal year 2018 risk assessment. However, GAO found that the risk assessment may not provide a reasonable basis for DOE's determination. DOE did not provide sufficient documentation to support that it considered the known lag in identifying improper payments as an inherent risk, nor did it provide sufficient documentation to support its rationale for the scale it used to score risk factors or for weighting risk ratings of payment reporting sites. For example, a payment site processing $3 million of outlays had the same weight in the overall assessment as a payment site processing $5.7 billion of outlays. As a result, DOE cannot demonstrate that its low-risk determination is reasonable and that its risk assessment process produces reliable results.

GAO is making nine recommendations to DOE, including to track and disclose information on improper payments identified later and determine whether these payments exceeded $100 million in any year, and to revise its risk assessment process to ensure the process has a reasonable basis and reliable results. DOE agreed with six of the recommendations, but did not agree with three recommendations, including to revise its risk assessment process. GAO maintains that the recommended actions are valid.

Improper payments—payments that under statutory, contractual,  administrative, or other legally applicable requirements should not have  been made or were made in an incorrect amount—are a long-standing,  widespread, and significant problem in the federal government. As we  found in our most recent audit of the U.S. government’s consolidated  financial statements, the federal government is unable to determine the  full extent to which improper payments occur and reasonably assure that  appropriate actions are taken to reduce them. Reducing improper  payments is critical to safeguarding federal funds.

Federal agencies, including the Department of Energy (DOE), are subject  to statutory improper payment requirements established, until recently, in the Improper Payments Information Act of 2002, as amended (IPIA). On  March 2, 2020, IPIA was repealed and replaced by the Payment Integrity  Information Act of 2019 (PIIA), which retains IPIAs core structure of  executive agency assessment, estimation, and reporting of improper  payments. IPIA required, among other things, that at least once every 3  years each federal agency review all of its programs and activities to  identify those that may be susceptible to significant improper payments— a process commonly referred to as an improper payment risk  assessment. Properly executed improper payment risk assessments are  the cornerstone of a government-wide effort to identify and reduce  improper payments. We previously reviewed DOE’s improper payment  risk assessments and found in December 2014 that DOE’s assessments  did not fully evaluate its risk. We recommended, among other things, that  DOE take steps to improve its risk assessments, including revising  guidance on how payment sites were to address risk factors, providing  examples of other risk factors likely to contribute to improper payments,  and directing payment sites to consider those factors. DOE updated its  guidance in May 2017 to address this recommendation.

Under IPIA, improper payments were considered significant if in the  preceding fiscal year they might have exceeded either (1) 1.5 percent of  program outlays and $10 million, or (2) $100 million (regardless of the  improper payment rate). IPIA required agencies with programs  susceptible to significant improper payments to develop statistically valid  improper payment estimates and annually report on actions to reduce  improper payments, including a description of the causes of the improper  payments, actions planned or taken to correct those causes, and planned  or actual completion dates of the actions taken to address those causes.  In addition, the Office of Management and Budget (OMB) may determine  on a case-by-case basis—such as if an audit report or investigative result  raises questions about an agency’s risk assessment or improper  payments results—that certain programs that do not meet the threshold  for significant improper payments may still be subject to the more  stringent annual improper payment reporting requirements. Other federal  requirements that apply to DOE include OMB Circular A-123, Appendix C,  Requirements for Payment Integrity Improvement (OMB M-18-20); OMB  Circular A-136; and internal DOE orders and directives that address  financial management oversight.

DOE is the largest civilian contracting agency in the federal government.  According to information provided by DOE’s Office of the Chief Financial  Officer (OCFO), in fiscal year 2019 DOE’s obligations totaled nearly $52  billion. Approximately 80 percent—about $41 billion—went to contracts to  manage and operate its scientific laboratories, engineering and  production facilities, and environmental restoration sites, and to construct  new facilities. DOE relies extensively on management and operating  (M&O) contracts to manage and operate many of its government-owned,  contractor-operated sites. Identifying and preventing improper payments  on contracts is a key component of contract management. In 1990, GAO  designated DOE’s contract management—including both contract  administration and project and program management—as a high-risk  area because DOE’s record of inadequate management and oversight of  contractors left the department vulnerable to waste, fraud, abuse, and  mismanagement. Although DOE has made progress in a number of  areas in the 30 years since its original high-risk designation, DOE’s  contract management remains on GAO’s High Risk List.

DOE performed its latest department-wide risk assessment for improper  payments in fiscal year 2018 (as required under IPIA and described in  OMB guidance) and found that it was not susceptible to significant  improper payments. Therefore, DOE was not required to develop or  publish any statistically valid improper payment estimates in its agency  financial report (AFR). In its fiscal year 2019 AFR, DOE reported it  identified improper payments of $36.26 million made in fiscal year 2018,  about 0.09 percent of its $38.47 billion in outlays for fiscal year 2018.  However, DOE’s reported improper payments were not included in the  nearly $175 billion government-wide total of reported estimated improper  payments for fiscal year 2019 because the government wide estimate is  calculated from agencies’ statistical estimates and DOE did not—and was  not required to—report a statistically valid estimate.

House Report 115-697 accompanying the Energy and Water  Development Appropriations Bill, 2019, included a provision for GAO to  investigate DOE’s system for tracking improper payments and provide  recommendations to improve the department’s methodology for reporting  accurate, representative, and meaningful data on improper payments.  This report examines (1) the extent to which the improper payment  amounts reported in DOE’s AFRs for fiscal years 2015 through 2019 were  accurate and complete, and (2) the extent to which DOE’s fiscal year  2018 improper payment risk assessment provides a reasonable basis for  its risk determination.

To determine the extent to which the improper payment amounts reported  in DOE’s AFRs for fiscal years 2015 through 2019 were accurate and  complete, we reviewed federal legislation, policies, and guidance  pertaining to improper payment reporting and compared DOE’s reporting  to these federal requirements. We also reviewed documents from  DOE’s OCFO for fiscal years 2015 through 2019, including the improper  payment reporting sent to the OCFO by DOE’s 48 payment reporting  sites. To assess the reliability of the payment reporting sites’ data, we  took several steps, including reviewing information from each of the sites  about the systems used to capture the data, reconciling the data reported  on the 48 payment site submissions to the summarized data reported for  each fiscal year, and comparing the summarized data with the data in the  AFR for each fiscal year. We determined that the data were sufficiently  reliable to use in our analyses of DOE’s reported improper payments. We  also reviewed OCFO policies and guidance and interviewed officials  about reporting on improper payments and questioned costs. Further,  we reviewed OMB guidance pertaining to improper payments reporting  and interviewed OMB officials to obtain their perspective on how that  guidance applies to DOE’s reporting.

In addition, we selected a non-generalizable sample of 10 DOE improper  payment reporting sites for detailed review of these sites’ procedures for  tracking and reporting on improper payments. We selected these sites  because they account for about half of DOE’s outlays and improper  payments, and they represent different types of payment reporting sites  and DOE program and staff offices. We obtained data from the 10  selected sites and conducted semi-structured interviews with officials  from each site who are responsible for identifying and reporting improper  payments. We also reviewed information on improper payments and  questioned costs identified through investigations and published in the  DOE Office of the Inspector General’s (OIG) Semiannual Reports to  Congress for fiscal years 2015 through 2018. We compared the  information in those reports with the improper payment amounts reported  in DOE’s AFRs for the same period. Additionally, we reviewed external  audits that identified questioned costs to determine whether the costs  were tracked to resolution and were included in DOE’s improper payment  reporting, if appropriate. Finally, we updated our prior analysis of audits  and assessments of DOE’s incurred costs for its 24 largest contracts,  which we reported on in March 2019, to provide a sense of the extent of  incurred costs that have been audited or assessed since that report.

To determine the extent to which DOE’s fiscal year 2018 improper  payment risk assessment provides a reasonable basis for its risk  determination, we reviewed improper payment risk assessment  requirements in IPIA and the related guidance in OMB M-18-20. We also  reviewed relevant internal control standards to identify control activities  related to conducting effective improper payment risk assessments. We  obtained and reviewed DOE’s fiscal year 2018 improper payment risk  assessment, the most recent department-wide improper payment risk  assessment that was based on the risk assessments performed by DOE’s  48 payment reporting sites. We reviewed the site-specific improper  payment risk assessments for the 10 payment reporting sites we  selected, as discussed above. We then compared these risk  assessments to relevant IPIA requirements, OMB guidance, and internal  control standards to determine the extent to which DOE evaluated the  appropriate risk factors for improper payments, appropriately considered  those factors in its risk assessment, and provided a reasonable basis for  its risk determination. Additionally, we interviewed officials from the  OCFO, as well as officials from the 10 selected payment reporting sites,  about the process they used to conduct the fiscal year 2018 improper  payment risk assessments. We also reviewed our past work and DOE  OIG reports to identify (1) any reported issues related to DOE’s improper  payment risk assessments and related processes, and (2) open  recommendations related to DOE’s risk assessments. Finally, we  interviewed OMB officials to discuss their views on DOE’s process for  improper payment risk assessment.

We conducted this performance audit from March 2019 to June 2020, in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Background Federal Improper Payment Requirements

Key requirements related to improper payments during the period of our  audit were included in IPIA, OMB M-18-20, and OMB Circular A-136.  Federal agencies were required to take various steps regarding improper  payments under IPIA and as directed by OMB M-18-20. The steps  include the following:  1.  Review all programs and activities and identify those that may be  susceptible to significant improper payments (commonly referred to as  a risk assessment),  2.  For those programs and activities that agency risk assessments,  OMB, or statute identifies as being susceptible to significant improper  payments, agencies should develop statistically valid improper  payment estimates, as well as analyze the root causes of improper  payments and develop corrective actions to reduce them,  3.  Report on the results of addressing the foregoing requirements.

According to OMB officials, agencies are responsible for maintaining the  documentation to demonstrate that these steps, if applicable, were  satisfied. Figure 1 illustrates these steps, as well as the major  components of conducting an improper payment risk assessment.

IPIA required that agencies conduct improper payment risk assessments  for all federal programs and activities at least once every 3 years and  identify any program or activity that may be susceptible to significant  improper payments. OMB M-18-20 provides guidance for implementing  the IPIA requirements and covers agencies’ responsibilities for improper  payment risk assessments, estimation, and reporting. According to the  OMB guidance, agencies must institute a systematic method of reviewing  all programs and activities to identify those that may be susceptible to  significant improper payments. This systematic method can be a  quantitative evaluation based on a statistical sample or a qualitative  method, such as a risk-assessment questionnaire. Regardless of which  method of review is used, IPIA required agencies to consider seven risk  factors during the risk assessment. (See table 1.)

OMB is also required to designate a list of high-priority programs for  greater levels of oversight and review. The threshold for high-priority  program determinations for fiscal year 2018 reporting and subsequent  years is $2 billion in estimated improper payments, regardless of the  improper payments rate estimate. In addition, OMB may determine that a  program is high-priority for reasons other than exceeding the $2 billion  threshold. High-priority programs are subject to additional requirements,  such as submitting information about semi-annual or quarterly actions  taken to reduce improper payments that can be used as a tool for tracking  progress.

According to OMB M-18-20, another fundamental requirement that  agencies must meet is to recover any federal dollars that are a monetary  loss to the government, unless legislation specifically prevents such  recovery. Specifically, the Improper Payments Elimination and Recovery  Improvement Act of 2012 (IPERIA) requires any program that expends at  least $1 million during the year to implement payment recapture audits, if  cost-effective to the agency, in order to recover improper payments. The  requirement to conduct payment recapture audits applies to all agencies  regardless of whether they have a program susceptible to significant  improper payments. A payment recapture audit is a review and analysis  of an agency’s or program’s accounting and financial records, supporting  documentation, and other pertinent information supporting its payments,  that is specifically designed to identify overpayments. It is not an audit  that is performed in accordance with government auditing standards.  OMB M-18-20 also states that for high-priority programs the agency shall  report any action it has taken or plans to take to recover improper  payments and intends to take to prevent future improper payments. If an  agency has determined that performing payment recapture audits for any  applicable program or activity is not cost-effective, a justification for that  determination must be reported. Further, OMB M-18-20 states that  agencies should report a justification for that determination through AFRs,  Performance Accountability Reports, or in the format required through  data requests from OMB.

DOE Structure and Processes to Collect Information and Report on Improper Payments

DOE’s 15 field Chief Financial Officers, in cooperation with DOE  contracting officers, are responsible for overseeing contractor and other  activities in the field, and they assist the OCFO in implementing improper  payment reporting requirements. The OCFO issues Annual Payment  Integrity Requirements and Guidance that transmits DOE’s instructions  for meeting improper payments reporting and recapture requirements  prescribed by OMB M-18-20. This guidance includes instructions for  completing an attached template for reporting risk assessments and  improper payments and payment recapture information. Using this  template, 48 payment reporting sites provide information that is the basis  for DOE’s department-wide improper payment risk assessment and  reporting. These payment reporting sites consist of four types of federal  entities and two types of contractors. (See appendix I for more  information about DOE’s payment reporting sites.)

In addition to the completed template, sites are directed to submit a  signed certification that attests to the accuracy of the improper payment  information and risk assessment and, if applicable, a justification for why  payment recapture audits were not conducted. The OCFO completes a  quality assurance checklist for each site and consolidates and reports the  data as one program in DOE’s annual AFR. DOE reports on its  improper payments 1 year in arrears; meaning, for example, that DOE’s  fiscal year 2019 AFR included information on its improper payments  identified in fiscal year 2018.

In addition to reporting payment recovery information, as required by  OMB Circular A-136, DOE has optionally reported some information it  collected about improper payments that it identified at the time of the AFR  issuance each year for fiscal years 2015 through 2019. (See table 2.)  Specifically, DOE reported the amount of improper payments that had  been made and identified in the preceding year—not based on a  statistically valid estimate of improper payments but, rather, on reported  amounts of known improper payments from individual payment reporting  sites. DOE also reported improper payment rates that it calculated  based on these reported amounts. DOE was not required to report a  statistically valid estimate of improper payments in its AFRs because it  determined it was at low risk of susceptibility to significant improper  payments. See appendix II for additional details about improper payments  in the data that DOE collected from the sites.

In previous years, DOE reported statistical estimates of its improper  payments. Specifically, DOE’s Performance and Accountability Reports  and AFRs from fiscal years 2004 and 2007 through 2011 indicated that  DOE used statistical sampling to produce projected improper payment  estimates for certain payment categories. During these years, DOE  reported estimated improper payment rates of less than 1 percent in  these categories. However, in 2012 the DOE OIG determined that the  estimated improper payment rate presented in DOE’s fiscal year 2011  AFR was not based on a statistical method. According to OCFO  officials, DOE discontinued the use of statistical sampling to produce  estimates in fiscal year 2012 because it was not required to do so, due to  DOE’s determination that it was at low risk for significant improper  payments.

Since 2012, the DOE OIG has found DOE to be compliant with  requirements for improper payment reporting and risk assessments as  part of its required review. Specifically, the DOE OIG reported each year  that DOE met the requirements for publishing improper payment  information in its AFRs and performed the required risk assessments.  According to an OIG official, the OIG is not required to perform evaluative  procedures to determine the adequacy and completeness of DOE’s risk  assessment and reporting in its AFR, and they have not optionally  performed these procedures.

The Role of Audits and Investigations in Identifying and Recovering DOE’s Improper Payments

The DOE OIG and other federal agencies or external audit organizations  conduct periodic incurred cost audits and assessments of DOE’s cost- reimbursement contracts. The purpose of incurred cost audits is to  determine whether such incurred costs are reasonable; applicable to the  contract; allowable under generally accepted accounting principles and  cost accounting standards applicable in the circumstances; and not  prohibited by the contract, statute, or regulation. If, as a result of these  audits or assessments, improper payments are identified—such as  reimbursements for costs determined to be unallowable under the  contract—DOE will question these costs, indicating that there is a  possibility the costs are improper. DOE may then negotiate or otherwise  work with the contractor to resolve the questioned costs. Sometimes, this  can result in DOE recovering funds. According to DOE’s fiscal year 2019  annual payment integrity requirements and guidance, for the purpose of  improper payment reporting, a questioned cost is not deemed an  improper payment until it has been determined by the contracting officer  to be unallowable.

In addition, investigations conducted by DOE OIG, the Department of  Justice, and other federal agencies may identify potentially unallowable  DOE payments. Upon their resolution, these investigations may find such  DOE payments to have been improper. According to OIG officials,  improper payments identified through OIG investigations may be  recovered through civil or administrative processes, and some of the  improper payments identified through OIG investigations may lead to  government-run criminal investigations. OCFO officials told us that  recovered amounts may differ from the monetary loss associated with the  original payments because of fees or fines, among other reasons. IPERIA  requires agencies to include all identified improper payments in their  reported estimate, regardless of whether the improper payment has been  or is being recovered. According to DOE’s fiscal year 2019 annual  payment integrity requirements and guidance, if the terms of a settlement  require repayment to DOE, then the settlement amount would be  considered an unallowable cost. Furthermore, the 2019 guidance states  that due to the timing of when a settlement is reached, it is not possible to  report these costs as an improper payment in the current year of  reporting.

Beginning in fiscal year 2018, DOE reported information in its AFR on  improper payments made in prior years that were identified for recapture  in the current reporting year. For example, in its fiscal year 2018 AFR,  DOE reported that $92.69 million in prior years’ improper payments had  been identified for recapture in fiscal year 2017. Similarly, in its fiscal year  2019 AFR, DOE reported $14.18 million in prior-year payments identified  for recapture in fiscal year 2018. DOE’s reporting sites generally identify  prior years’ improper payments identified for recapture through audits and  investigations, among other strategies. DOE did not provide information  on the years in which the prior-year improper payments were made, and  the prior year improper payments identified for recapture were reported  separately but not included in DOE’s reported improper payment amount  and rate in any of its AFRs.

Improper Payment Amounts DOE Reported in Its AFRs for Fiscal Years 2015 through 2019 May Not Be Accurate or Complete

The improper payment amounts that DOE reported in its AFRs for fiscal  years 2015 through 2019 may not be accurate or complete and are likely  understated, for two key reasons. First, we found that some DOE  payment reporting sites did not correctly identify, track, and report their  improper payments. Second, DOE reported improper payment amounts  and rates for the current year, but did not report that the amounts and  associated rates do not include a substantial amount of improper  payments that may be identified in the years following the year in which  the payment took place.

Some DOE Payment Reporting Sites Did Not Correctly Identify, Track, and Report Their Improper Payments

The information in DOE’s AFRs for fiscal years 2015 through 2019 may  not be accurate or complete, in part because DOE does not ensure that  payment reporting sites correctly identify, track, and report their improper  payments to the OCFO. Our review of documentation and interviews with  officials at the selected payment reporting sites found some instances in  which payment reporting sites’ processes for identifying and tracking  improper payments did not always result in accurate and complete  financial reporting as required. Specifically, we identified the following  errors in reporting improper payments to the OCFO at three of the 10  sites we selected for review:

Officials at one site told us that they resolve a portion of their improper  payments by adjusting future invoices to account for the error. Site  officials told us that in such cases, they do not track or report the  amounts to the OCFO as improper payments. While adjusting future  invoices is an efficient way to recapture improper payments, not  tracking such adjustments as improper payments results in  understated improper payments reported to the OCFO. The total  amount of the understatement of these improper payments is not  known. In addition, the site may have overstated other improper  payments. In particular, site officials told us that they were unsure  whether some of the annual adjustments from its indirect cost  reconciliation process were reported as improper payments, even  though OCFO officials told us that such adjustments are routine and  are not considered improper payments. This could have resulted in  an overstatement of improper payments, but the amount overstated is  unknown.

Officials at another site told us that they mistakenly included almost  $1 million in questioned costs in their fiscal year 2017 improper  payment reporting to the OCFO. Because questioned costs are not  considered improper until they are determined to be unallowable, this  means that the site overstated its improper payments by almost $1  million for that year. Additionally, this site subtracted its  underpayments from its overpayments for its fiscal year 2015  reporting, resulting in an understatement of improper payments.  Improper payments, regardless of whether they are over- or  underpayments, should be added together and not netted, as both  amounts are considered improper. Officials at the site told us that  these issues had been corrected as of fiscal year 2018.

Officials at a third site told us that they do not closely track  underpayments and cannot state with certainty that all underpayments  are included in the site’s annual improper payments report. The site  therefore may be understating its improper payments each year.

DOE’s Financial Management Oversight order states that financial  management processes must include procedures and methods for  ensuring that financial managers provide accurate, relevant financial  reporting to customers, such as Congress and OMB. Additionally,  federal internal control standards state that management should  implement control activities through policies, including documenting  policies in the appropriate level of detail to allow management to  effectively monitor the control activity. However, not all of the payment  reporting sites have fully documented their procedures for correctly  identifying, tracking, and reporting their improper payments or ensuring  the quality of their data, in part because there was no requirement to do  so. Specifically, officials from all 10 selected payment reporting sites we  interviewed told us they have procedures for tracking their identified  improper payments. However, three of the 10 selected sites had not  documented their procedures and two sites had documented some of  their procedures but not others, including two of the sites mentioned in  the examples above. By requiring payment reporting sites to document  their procedures for identifying, tracking, and reporting their improper  payments to ensure the quality of their data, the OCFO could better  ensure that each payment reporting site maintains consistent procedures  and provides comparable information about that site’s improper payments  over time.

Furthermore, the OCFO cannot ensure that sites are correctly identifying,  tracking, and reporting improper payments and ensuring the quality of  their data because the OCFO does not have a process to monitor that  sites have documented—and are implementing—procedures to do so.  The OCFO has taken some steps to help ensure the quality of the  improper payments data that the sites report to the OCFO. For example,  OCFO officials said they confirm that sites provide accurate information  by requiring sites to self-certify the accuracy and completeness of the  data, but does not take steps to verify the certification. Further, four of the  five contractor payment reporting sites we interviewed told us the DOE  field sites that oversee the contractors review the contractors’  submissions before sending the information to the OCFO; OCFO officials  told us that the field sites do not formally approve these submissions.  Additionally, OCFO staff complete a quality assurance checklist for each  site’s submission. The checklist contains a series of questions to  determine whether a site has submitted the required documentation and  whether certain elements of that documentation are complete. OCFO  quality assurance reviews also include simple mathematical checks for  internal consistency, such as ensuring that the amount for total identified  improper payments is the same across multiple tables.

These steps, however, are not sufficient to ensure that sites are correctly  identifying, tracking, and reporting improper payments and ensuring the  quality of their data. For example, the quality assurance checklist does  not include any tests to verify the accuracy of the procedures sites used  to generate that data to ensure the sites’ data are reliable. By developing  a monitoring process to ensure that payment reporting sites have  developed and implemented procedures for identifying, tracking, and  reporting their improper payments to the OCFO and ensuring the quality  of their data, the OCFO could better ensure that the information it reports  about improper payments in its AFR is accurate and complete.

DOE Identifies a Substantial Amount of Improper Payments in Subsequent Years That Are Not Included in Any Years’ Improper Payment Amount or Rate

The amount of current year improper payments DOE reports in each  fiscal year, as well as the improper payment rate DOE calculates based  on this amount and reports in its AFRs, is not accurate or complete  because it does not disclose that there are additional improper payments  that are (1) not identified or that DOE’s OCFO is not aware of until a later  date, or (2) potential improper payments that may be identified at a later  date. Additionally, DOE does not conduct payment recapture audits,  which may identify additional improper payments that could be recovered.

DOE identifies many of its improper payments after the end of the fiscal  year in which the payments occur and does not identify some improper  payments until several years after they occur. These improper payments  are identified through processes such as post-payment reviews, audits  and assessments, and investigations that do not conclude until after the  end of the fiscal year in which DOE made the payments. As a result,  there is a known lag in identifying certain improper payments.

The current year improper payment amount and associated rate DOE  reported in its AFR excludes any improper payments that are identified  after the end of the fiscal year in which the payments occurred. For  example, in its fiscal year 2018 AFR, DOE reported $32.86 million of  current reporting year (fiscal year 2017) improper payments, with an  associated improper payment rate of 0.09 percent. In its fiscal year 2018  AFR DOE also reported $92.69 million of improper payments made  earlier than fiscal year 2017; however DOE did not disclose that the  amount of improper payments originally reported for any prior fiscal year  had subsequently increased as a result of improper payments identified  after the end of the fiscal year. While it is not possible for DOE to report  on the specific amount of improper payments it has not yet identified,  DOE also did not disclose in its fiscal year 2018 AFR that it expected to  complete audits and investigations in subsequent years that could  increase the amount of improper payments reported for fiscal year 2017.  See figure 2 for categories of improper payments and the extent to which  they are included in DOE’s improper payment amount and rate.

Specifically, the OCFO excludes some known improper payments from  the annual amount and associated rate it reports in its AFRs for the  following reasons:

Post-payment reviews may not conclude in the same fiscal year  the reviewed payments were made. We have previously found that  DOE identifies some improper payments through post-payment  reviews. For example, DOE has not required its contractor payment  reporting sites—most of which are M&O contractors—to submit  invoices before DOE makes payments; instead DOE uses a  “payments cleared funding arrangement,” which authorizes the  contractors to withdraw funds directly from federal accounts. OCFO  officials told us that improper payments made by DOE to contractors  without such an agreement would be reported by the responsible  federal site, and improper payments made by M&O contractors would  be reported by the M&O contractor. DOE policies and procedures  do not require that DOE site officials monitor M&O contractor  withdrawals to determine the appropriateness of their incurred costs.  DOE officials do not review M&O contractor withdrawal of funds to  determine the appropriateness of M&O contract costs, and thus can  only identify improper payments associated with these contracts  through post-payment reviews of contractor costs that may occur after  the end of the fiscal year.

However, such post-payment reviews, such as monthly or quarterly  reviews of invoices, may not identify certain improper payments— including improper payments that occurred late in a given fiscal  year—leading DOE to exclude them from their annual reported  improper payment amount and associated rate. For example,  according to a document describing improper payments that one  selected payment site reported to the OCFO, the site identified about  $103,000 in fiscal year 2016 improper payments associated with  travel during that same fiscal year. Additional reviews of fiscal year  2016 travel payments conducted in fiscal year 2017 identified further  improper payments for travel of more than $35,000. Because the  contractor identified these additional travel payments as improper  through quarterly reviews that did not conclude until after the end of  fiscal year 2016, this increase of about 35 percent in the site’s known  improper travel payments was not included in the OCFO’s reported  improper payment amount or rate for that year.

In our March 2017 report, we recommended that DOE help ensure  that necessary data are available to employ data analytics—which  can identify improper payments more quickly than post-payment  reviews can, increasing the likelihood that DOE will include them in its  reported amount and rate for each fiscal year—as a tool to perform  contractor cost-surveillance activities. Specifically, we recommended  that DOE require contractors to maintain sufficiently detailed  transaction-level cost data that are reconcilable with amounts charged  to the government, including (1) cost data that, at a minimum,  represent a full data population; and (2) the details necessary to  determine the nature of each cost transaction. DOE disagreed with  the recommendation. According to DOE officials, DOE is now  developing plans to begin to use data analytics in fiscal year 2021.  We continue to believe it is important for DOE to employ data  analytics as a cost surveillance tool so DOE can better identify  improper payments to its contractors in a timely manner and look  forward to reviewing DOE’s plans and actions to address our prior  recommendation.

Audit coverage of DOE payments is limited, and some audits are  not completed until several years after the audited payments  were made. As we also found in March 2017, DOE uses incurred cost  audits and assessments to identify contractors’ improper payments.  However, our review of DOE OIG and other external entities’ audits  and assessments of incurred costs for DOE’s 24 largest contractors  for this report shows that, historically, these audits are infrequent and  may occur several years after the costs have been incurred. For  example, our updated analysis shows that as of September 2019,  only about $25 billion—or 23 percent—of the nearly $108 billion in  costs incurred during fiscal years 2014 through 2018 by DOE’s 24  largest contractors had been audited or assessed (see table 3).  Although there is no requirement for how often contractors should be  audited, the Contract Disputes Act of 1978 imposes a 6-year statute  of limitations for the government to seek recovery of unallowable  costs that could be identified through audits.

According to our review of DOE reporting and documentation, known  DOE improper payments amounts for a given fiscal year can increase  in later years as more costs are audited. For example, one payment  reporting site reported to the OCFO nearly $164,000 in improper  payments made and identified in fiscal year 2017, and OCFO included  this amount in the improper payment rate it reported in its fiscal year  2018 AFR. According to site documentation, the same site also  identified, as the result of an audit in fiscal year 2017, an improper  payment of nearly $920,000 that had occurred in a prior year. This  improper payment was substantially more than the total amount of  improper payments that the site reported in the fiscal year 2018 AFR.  However, because the improper payment occurred prior to fiscal year  2017, the OCFO did not include it in its current year improper  payment amount or rate for any fiscal year.

For fiscal year 2020, DOE’s OIG has planned several assessments of  costs the contractors incurred in prior fiscal years. However,  contractor costs the OIG plans to review in the fiscal year 2020  planned assessments were incurred as early as fiscal year 2015.  Therefore, any improper payments identified through the planned  assessments will not be included in DOE’s reported improper  payment rate using the current reporting methods and will instead be  included in an overall lump sum amount of prior year improper  payments, which has no effect on DOE’s reported improper payment  rate.

DOE does not track questioned costs centrally, and such costs  can take several years to resolve. Audits and assessments can  identify questioned costs that require additional review before they are  either allowed or deemed improper. In its Semiannual Report to  Congress, DOE’s OIG reported nearly $700 million of unresolved,  questioned costs identified through its own audits and investigations  as of September 30, 2019. Our analysis of the DOE OIG’s reporting  found that a substantial portion of questioned costs the OIG identified  were ultimately determined to be allowable once they were resolved;  however, our analysis also found that DOE has not consistently  resolved questioned costs in a timely manner. For example, some of  the questioned costs that the DOE’s OIG identified—such as potential  state gross receipts tax overpayments of $15.1 million that a DOE  payment site made in fiscal years 2010 and 2011—have remained  unresolved for nearly a decade. Large amounts of unresolved costs  reported by DOE’s OIG add uncertainty about the completeness of  the OCFO’s improper payment reporting.

Moreover, the nearly $700 million of unresolved questioned costs that  the DOE OIG reported does not include questioned costs identified  through external audits of non-M&O contractors, such as those  conducted by the Defense Contract Audit Agency or nongovernmental  entities. Questioned costs identified through these external audits can  be substantial, like those the DOE OIG has reported. For example, a  2017 incurred cost audit of a DOE contractor’s fiscal year 2010 costs  conducted by an external firm identified nearly $280 million in  questioned and unresolved DOE payments to the contractor. In  November 2019, DOE officials told us that these questioned  payments were resolved when DOE reached a settlement agreement  with the contractor. DOE disallowed $34 million of the questioned  costs as part of the settlement agreement, according to DOE  officials. DOE’s Financial Management Oversight order states that  financial management processes must include procedures and  methods for ensuring that financial managers provide accurate,  relevant financial reporting to customers. DOE customers include  Congress and OMB. Additionally, federal internal control standards  state that management should implement control activities through  policies, including documenting policies in the appropriate level of  detail to allow management to effectively monitor the control activity.

According to OCFO officials, DOE does not have a mechanism for  tracking questioned costs identified through external audits. Instead,  OCFO officials said they rely on payment reporting sites to track these  costs to resolution. However, the office does not require payment  reporting sites to document policies for such tracking. DOE officials  from two selected sites told us that their sites do not have policies for  tracking questioned costs identified through external audits, including  questioned costs that may later be deemed improper. As a result, the  OCFO may not be aware of all potentially improper payments  identified through external audits or know the status of their resolution.  Without a requirement for sites to have policies to track questioned  costs to their resolution, the OCFO cannot ensure that payment  reporting sites are tracking—and ultimately reporting—all improper  payments, and thus cannot ensure that it is including all improper  payments in the amount it reports as actual in its AFRs.

Investigations that identify DOE improper payments may not  conclude until years after the payments were made. Investigations  by DOE’s OIG, the Department of Justice, and other federal agencies  can also identify DOE improper payments. However, similar to  improper payments identified through audits, these improper  payments—which can be substantial—may not be identified until  years after they occur due to the length of time it takes to investigate  and resolve criminal, civil, or administrative cases. For example, in  fiscal year 2018, DOE reported $60.6 million of improper payments  identified through a fiscal year 2017 settlement with a contractor. DOE  made some of these improper payments as early as 2001. Also, in  fiscal year 2018, a DOE payment site reported that no improper  payments were made or identified in fiscal year 2017, but the site  reported a $4.6 million prior-year improper payment associated with a  subcontractor’s false claims that were settled with the subcontractor in  fiscal year 2017. The OCFO reported these two cases, along with  other DOE improper payments identified through investigations, as  lump sum prior-year improper payments identified for recapture in its  fiscal year 2018 AFR. However, the OCFO did not include these  known improper payments in the improper payment amounts used to  calculate its improper payment rates for the years in which DOE  incurred the disallowed costs.

Furthermore, some DOE improper payments are not reported as  current or prior-year improper payments because the investigations of  the payments were resolved in a manner that prevented DOE from  formally considering the payments improper. For example, in 2015,  DOE’s OIG reported that a company received a loan guarantee of  more than $500 million from DOE after it “provided the Department  with statements, assertions, and certifications that were inaccurate  and misleading, misrepresented known facts, and, in some instances,  omitted information that was highly relevant to key decisions in the  process to award and execute” the loan guarantee. The company  later declared bankruptcy and did not repay the loan. However,  because DOE did not determine this payment to be improper through  a legal case or any other process, the $500 million of known monetary  loss was not included in DOE’s improper payments reporting in its  AFR for any fiscal year. Also, in fiscal year 2017, DOE excluded a six- figure settlement with an outside party from its improper payment  reporting. OCFO officials told us that they excluded payments  associated with this case from their office’s reporting due to certain  aspects of the settlement agreement.

DOE’s Information Quality Guidelines state that information disseminated  to the public, such as information on improper payments reported in  DOE’s AFRs, should be presented in an accurate, complete, unbiased,  and clear manner and should be useful to the intended users of the  information. As previously noted, agencies with programs that are  susceptible to significant improper payments—defined to include  improper payments exceeding $100 million in a year—are required to  develop improper payment estimates and corrective action plans.  However, the OCFO cannot determine whether improper payments in a  given year exceeded the $100 million threshold because the OCFO does  not track information on the year that payments were made for all known  improper payments for a given fiscal year—including improper payments  identified in later years through resolution of questioned costs or  conclusions of audits or investigations. By tracking information on the  year the payment occurred for all improper payments identified, to include  those identified in later years, and determining and disclosing in its AFR  whether improper payments in a given year exceeded the $100 million  threshold, DOE could better inform Congress, OMB, and the public about  whether it has made significant improper payments.

Additionally, DOE sites perform some payment recapture activities, but  does not conduct payment recapture audits, which could identify  additional improper payments that could be reported, and potentially  recovered. As previously discussed, IPIA required any program that  expended at least $1 million annually to conduct payment recapture  audits, if cost-effective to the agency, or to provide justification if such  audits are determined not to be cost-effective. A payment recapture audit  is a review and analysis of an agency’s or program’s accounting and  financial records, supporting documentation, and other pertinent  information supporting its payments, that is specifically designed to  identify overpayments. As such, payment recapture audits are tools to  identify improper payments, in addition to an avenue for recovering those  overpayments.

DOE included a justification for its decision not to conduct payment  recapture audits in its AFRs for fiscal years 2015 through 2019. For  example, in its fiscal year 2019 AFR, DOE cited its improper payment rate  of 0.09 percent and recapture rate of 97 percent to support the  department’s determination that it was not cost-effective to perform  payment recapture audits. DOE also cited other activities it employed to  identify and recapture improper payments, such as prepayment review  and approval of invoices, post-payment reviews, contractor internal  audits, results of cost allowability audits of integrated contractors, and  results from travel audits, among others.

The OCFO fiscal year 2018 payment integrity guidance included a list of  seven criteria that sites were to use to determine whether payment  recapture audits are cost-effective. For fiscal year 2018, 42 of DOE’s 48  payment reporting sites submitted a justification stating that it would not  be cost-effective to employ payment recapture auditors. Our review of the  42 justifications found that the quality of the justifications varied by site.  We found that 40 of the 42 justifications did not demonstrate  consideration of any of the seven criteria in support of their  determinations that payment recapture audits would not be cost- effective. One DOE field site’s justification included three bullet points,  as shown in figure 3, none of which aligned with the criteria.

The OCFO uses a quality assurance checklist to review payment sites’  improper payment reports that includes verifying that the site submitted a  justification and that the justification is “adequate.” The checklist does not  define “adequate,” and the OCFO approved all of the justifications  submitted, even those that did not demonstrate consideration of any of  the seven criteria from the payment integrity guidance. DOE’s Financial  Management Oversight order states that financial management  processes must include procedures and methods for ensuring that  financial managers provide accurate, relevant financial reporting to  customers. Furthermore, under OMB M-18-20, agencies are required to  recover any federal dollars that are a monetary loss to the government,  unless legislation specifically prevents such recovery. By clarifying  guidance to define the factors for assessing the adequacy of the  justifications, and reviewing sites’ justifications for not performing or  arranging for payment recapture audits, DOE could better ensure that the  justifications it reports have a sound basis and that DOE is not missing  opportunities to identify and recover improper payments.

Additionally, DOE may be missing opportunities to recover federal dollars  that are a monetary loss to the government, as required under OMB M- 18-20, because it has not evaluated whether sites could identify additional  improper payments through payment recapture audits. Our analysis of  information provided by DOE shows that in fiscal year 2003 the  department conducted payment recapture audits and that the improper  payments identified through these audits far exceeded the costs of  conducting the audits. According to OCFO officials, the information on  payment recapture efforts was from a payment recapture audit at one  site; it was not an OCFO recovery audit program. The OCFO officials  reiterated that the majority of the payment reporting sites have not  performed payment recapture audits because they believe existing efforts  are effective in recovering identified improper payments. However,  payment recapture audits are designed to identify additional improper  payments not previously identified. By evaluating whether it could identify  enough additional improper payments to make payment recapture audits  cost-effective, such as performing audits at a limited number of sites,  DOE would have an opportunity to identify and recover additional  improper payments or have better information to justify that payment  recapture audits are not cost-effective.

DOE’s Fiscal Year 2018 Risk Assessment May Not Provide a Reasonable Basis for Its Risk Determination

In its fiscal year 2018 improper payment risk assessment, DOE assessed  its risk of susceptibility to significant improper payments as low. However,  DOE did not provide sufficient documentation to support how it conducted  its risk assessment and made this low-risk determination. Consequently,  we could not determine if the process DOE used to perform its improper  payment risk assessment provided a reasonable and reliable basis for  making its risk determination.

DOE’s Risk Assessment Process May Not Adequately Support Its Low-Risk Determination

DOE’s process to conduct its fiscal year 2018 risk assessment may not  be adequate to support its low-risk determination of susceptibility to  significant improper payments. DOE has a decentralized process for  conducting its statutorily required improper payment risk assessment  every 3 years. For fiscal year 2018, DOE developed and provided each  payment reporting site with an improper payment risk assessment  template to complete. DOE directed all of its payment reporting sites to  consider the seven risk factors listed in IPIA, as well as four additional risk  factors that DOE developed. Table 4 lists the additional DOE-developed  risk factors that sites were to consider in their risk assessments.

DOE’s improper payment risk assessment template included a variable  scale for rating each of the risk factors. The OCFO provided guidance  instructing payment reporting sites to, when populating the template,  consider the site’s exposure to the risk factors and to rate them by  applying a numerical score to each risk factor. Each payment site  totaled its numerical scores to calculate the site’s overall level of  susceptibility to significant improper payments. DOE then consolidated all  of the payment site assessments into an overall department-wide risk  assessment. However, DOE could not explain, and did not provide us  documentation to support, its rationale for the variable scales used to  score such risk factors in its fiscal year 2018 assessments—both in the  10 payment-site risk assessments we reviewed and in DOE’s  department-wide risk assessment—and how the scores assigned for  each risk factor affected DOE’s susceptibility to significant improper  payments. As a result, we could not determine if DOE’s process for  conducting its fiscal year 2018 improper payment risk assessment  provided a reasonable basis for DOE’s overall risk determination.

Furthermore, the OCFO weighted all of the payment reporting sites  equally in terms of overall risk when it aggregated the risk ratings into an  overall assessment of susceptibility to significant improper payments.  However, DOE did not provide an explanation or documentation of why  the sites were weighted equally in the overall department-wide improper  payment risk assessment, even though the payment types and dollar  amounts of outlays processed by the sites varied widely. For example, a  payment site processing $3 million of outlays in fiscal year 2017 had the  same weight in the aggregated assessment as a payment site processing  $5.7 billion of outlays.

Finally, the OCFO did not provide evidence that it considered the known  lag in identifying certain improper payments as an inherent risk during its  fiscal year 2018 department-wide improper payment risk assessment  process. This inherent risk relates to certain limitations affecting DOE’s  ability to determine the extent of improper payments until several years  after they occur, such as those identified through incurred cost audits and  investigations, as previously discussed. For example, in its fiscal year  2018 AFR, DOE reported that a total of $124.35 million in payments were  identified for recapture during fiscal year 2017, including $31.66 million  made in fiscal year 2017 and $92.69 million made in years prior to fiscal  year 2017. However, DOE did not provide us documentation to support  how it considered the $92.69 million in improper payments made during  years prior to fiscal year 2017—which could represent an inherent risk to  the department—when assessing its risk of susceptibility to significant  improper payments. As discussed earlier, some of the $92.69 million of  improper payments identified for recapture occurred in fiscal year 2016.  Thus, the amount of fiscal year 2016 improper payments that DOE  reported in its fiscal year 2017 AFR is understated.

Federal internal control standards state that management should design  control activities to achieve objectives and respond to risks, and should  implement control activities through policies. To contribute to the  effective design and implementation of such control activities,  management should clearly document internal control and all transactions  and other significant events in a manner that allows the documentation to  be readily available for examination. Additionally, management should  periodically review policies, procedures, and related control activities for  continued relevance and effectiveness. Further, although OMB does not  direct agencies to demonstrate how each risk factor contributes to the  agency’s overall susceptibility of risk for significant improper payments,  OMB M-18-20 states that if a qualitative method is used during an  improper payment risk assessment, it must be designed to accurately  determine whether the program is susceptible to significant improper  payments.

DOE may not have an adequate process to support its risk determination  because it did not properly document how it developed and considered  risk factors during its fiscal year 2018 risk assessment. Until DOE revises  its department-level process for conducting improper payment risk  assessments, it cannot ensure that the process produces a reliable  assessment of whether it is susceptible to significant improper payments.  Specifically, without documenting its rationale for the variable scale used  to score risk factors and weighting of the payment reporting sites, and  consideration of the known lag in identifying the extent of total improper  payments each fiscal year to support the development of its department- level risk assessment, DOE cannot demonstrate that its process for  determining its low risk of susceptibility to significant improper payments  is reasonable. Addressing these issues may result in DOE determining  that it is susceptible to significant improper payments, and therefore  subject to additional requirements—such as developing a statistically  valid estimate of improper payments and reporting on actions to reduce  improper payments, including a description of the root causes, and  developing corrective actions to reduce them, including program-specific  improper payment reduction targets.

DOE Did Not Sufficiently Review the Reasonableness of Selected Payment Reporting Sites’ Improper Payment Risk Assessments

We also found that DOE’s OCFO did not sufficiently review the  reasonableness of the selected payment reporting sites’ improper  payment risk assessments. When we reviewed the risk assessments of  the 10 selected sites, we found a lack of consistency in how the sites  applied DOE guidance, as well as inadequate documentation supporting  how the sites considered improper payment risk factors. Specifically, we  found that the OCFO review process did not identify instances in which  these sites did not adequately support certain ratings or did not adhere to  DOE instructions for completing the improper payment risk assessment  template.

Staff from the OCFO used a quality assurance checklist to review the  sites’ fiscal year 2018 improper payment risk assessments. However, the  extent to which the OCFO reviewed documentation supporting payment  sites’ risk assessments is unclear. Although the reviewer guidance  provided in the quality assurance checklist directs reviewers to ensure  that the documentation supporting the payment site’s risk rating  adequately supports the risk factor being evaluated, a payment site  official told us that OCFO reviewers did not consistently request to view  their supporting documentation.

Eight out of 10 payment reporting sites we reviewed had documentation  to support that they followed DOE’s guidance to consider the results of  prior GAO and DOE OIG audit reports and OMB Circular A-123-related  assessment results. However, we found that two sites did not have such  documentation. One site rated itself as having no significant deficiencies  despite audit reports that indicated some deficiencies and findings for that  site. Another payment site did not discuss the OMB Circular A-123  assessment results in its improper payment risk assessments, despite  OCFO guidance to include such results when conducting improper  payment risk assessments. However, quality assurance checklists  completed by OCFO staff for these two sites did not indicate that  documentation supporting the sites’ consideration of these prior reports  and assessments in their risk assessments was missing.

Further, five of the 10 payment reporting sites we reviewed did not  provide sufficient explanation or documentation supporting their ratings  for several of the risk factors they considered in their improper payment  risk assessment, despite instructions in DOE’s guidance to do so. For  example, one site cited “discussions with team lead” as the primary  source of support for its ratings assigned for several risk factors.  However, the site did not have documentation to support the results of  these discussions and how such discussions supported the ratings for  each risk factor. Federal internal control standards state that  management should design control activities to achieve objectives and  respond to risks, and should implement control activities through  policies. To contribute to the effective design and implementation of  these control activities, management should clearly document internal  controls and other significant events in a manner that allows the  documentation to be readily available for examination.

We also found that OCFO staff did not document any potential changes  to the payment sites’ risk ratings in the 10 quality assurance checklists we  reviewed. However, the process to be followed in the event OCFO  reviewers find that payment site risk ratings are not reasonable is unclear  because DOE has not defined and documented in its policies and  procedures the process for OCFO reviewers to override these risk  ratings. DOE’s Financial Management Oversight order directs business  units to evaluate and assess the effectiveness of their financial  management oversight activities and other internal controls, such as the  OCFO’s oversight of the payment reporting sites’ risk assessments.  Further, the order charges the OCFO with reviewing and analyzing  activities throughout DOE to evaluate the adequacy of established  policies, procedures, and standards governing accounting and related  reporting functions; evaluating the performance of internal controls over  those functions; and recommending corrective actions as needed. In  addition, according to federal internal control standards, management  should also establish and operate monitoring activities to monitor the  internal control system and evaluate the results. Such monitoring includes  regular management and supervisory activities, comparisons, reconciliations, and other routine actions. Additionally, management  should periodically review policies, procedures, and related control  activities for continued relevance and effectiveness. Further, federal  internal control standards state that management should use quality  information to achieve the entity’s objectives.

By developing, documenting, and implementing policies and procedures  to require OCFO to review documentation supporting payment site risk  assessments and define the process for overriding their risk  determinations, DOE would enhance its ability to adequately monitor its  decentralized improper payment risk assessment process and help  ensure the accuracy and reliability of payment reporting sites’ risk  assessments and DOE’s assessment of overall risk of susceptibility to  improper payments.

DOE’s OCFO relies on its 48 payment reporting sites to provide  information about improper payments that DOE reports in its AFR;  however, we identified several reasons that the information in DOE’s  AFRs for fiscal years 2015 through 2019 may not be accurate or  complete. First, DOE’s improper payments information may not be  accurate or complete because the OCFO does not require the payment  reporting sites to document their procedures for correctly identifying,  tracking, and reporting their improper payments. By doing so, the OCFO  could better ensure that the payment reporting sites provide consistent  and comparable information about their improper payments over time.  Second, the OCFO cannot ensure that sites are correctly identifying,  tracking, and reporting improper payments to the OCFO and ensuring the  quality of their data because OCFO does not have a process to monitor  that sites have—and are implementing—procedures to do so. By  developing such a monitoring process, the OCFO could better ensure that  the information it reports about improper payments in DOE’s AFRs is  accurate and complete. Third, DOE may not be reporting additional  improper payments in the form of unallowable costs claimed by some  contractors because, as we have previously found, DOE policies and  procedures do not require that DOE sites monitor M&O contractor  withdrawals to determine the appropriateness of costs incurred by the  contractor. Under this arrangement, DOE does not use prepayment  reviews to determine the appropriateness of M&O contract costs and,  thus, can only identify improper payments associated with these contracts  through post-payment reviews that typically occur after the end of the  fiscal year. We previously recommended that DOE ensure data are  available to employ data analytics—which can identify improper payments  more quickly than post-payment reviews can—but DOE has not fully  implemented the recommendation. We continue to believe it is important  for DOE to employ data analytics as a cost surveillance tool so DOE can  better identify improper payments to its contractors in a timely manner.

DOE only includes improper payments that occur and are identified in the  same fiscal year in its reported improper payment amount and rate in the  AFR. However, DOE does not identify a substantial amount of improper  payments in the same fiscal year due to the known lag in identifying such  payments. Audits and assessments of DOE’s contractors can identify  questioned costs that require additional review before they are either  allowed or deemed improper, but DOE has not consistently resolved  questioned costs in a timely manner because the OCFO does not direct  payment reporting sites to document policies for tracking questioned  costs to resolution. Without a requirement for sites to have policies to  track questioned costs to their resolution, the OCFO cannot ensure that  payment reporting sites are tracking—and ultimately reporting—all  improper payments, and thus cannot ensure the accuracy and  completeness of improper payments reported in DOE’s AFRs.  Additionally, the OCFO cannot determine whether improper payments in  a given year exceeded the $100 million threshold because the OCFO  does not track information about the year that payments were made for all  known improper payments for a given fiscal year. By tracking and  disclosing information about all improper payments identified and the year  in which these payments were made in its AFR, DOE would have better  information to provide to Congress, OMB, and the public about whether it  has made significant improper payments.

Although DOE’s sites submitted individual justifications for not completing  payment recapture audits, the quality of the justifications varied and did  not meet DOE requirements. By clarifying guidance to define the factors  for assessing the adequacy of the justifications, and reviewing sites’  justifications for not performing or arranging for payment recapture audits  to ensure that the justifications meet requirements and are supported by  appropriate analysis that considers the costs and benefits of performing  the audits, DOE can better ensure that the justifications it reports have a  sound basis and that DOE is taking advantage of all opportunities to both  identify and recover improper payments, which in turn will help reduce the  monetary loss to the government. Further, DOE may be missing  opportunities to recover federal dollars that are a monetary loss to the  government because it has not evaluated whether sites could identify  additional improper payments through payment recapture audits. DOE  has concluded that based on its self-assessed low improper payment rate  and recapture rate, it is not cost effective to perform payment recapture  audits. By evaluating whether it could identify enough additional improper  payments to make payment recapture audits cost-effective, such as  performing audits at a limited number of sites, DOE would have an  opportunity to identify and recover additional improper payments or have  better information to justify that payment recapture audits are not cost- effective.

Finally, DOE may not have an adequate process to support its risk  determination because it did not properly document how it developed and  considered risk factors during its fiscal year 2018 risk assessment. Until  DOE revises its department-level process for conducting improper  payment risk assessments, it cannot ensure that the process produces a  reliable assessment of whether it is susceptible to significant improper  payments. Further, the process for the OCFO to oversee the accuracy of  payment site risk ratings is unclear because DOE has not defined and  documented, in its policies and procedures, the process for OCFO  reviewers to override a payment site’s risk ratings in the event the  reviewer finds that the rating was not reasonable. By developing,  documenting, and implementing department-wide policies and  procedures, DOE would enhance its ability to adequately monitor its  decentralized improper payment risk assessment process and help  ensure that individual payment reporting sites accurately score their risk  factors—leading DOE to obtain a more accurate and reliable assessment  of its overall risk of susceptibility to improper payments.

We are making the following nine recommendations to DOE:  The Office of the Chief Financial Officer should require payment   reporting sites to document their procedures for identifying, tracking, and  reporting improper payments to ensure they provide consistent and  comparable information about their improper payments over time.  (Recommendation 1)

The Office of the Chief Financial Officer should develop a monitoring  process to ensure that payment reporting sites document and implement  procedures that will enable them to correctly identify and report improper  payments to the OCFO. (Recommendation 2)

The Office of the Chief Financial Officer should require payment reporting  sites to document policies for tracking questioned costs to resolution.  (Recommendation 3)

The Office of the Chief Financial Officer should track information on the  year the payment occurred for all improper payments, regardless of when  they are identified, and determine and disclose in DOE’s AFR whether the  department’s total annual improper payments exceeded $100 million in  any given year. (Recommendation 4)

The Office of the Chief Financial Officer should clarify guidance to (1)  define the factors for assessing adequacy of payment reporting sites’  justifications that conducting recapture audits would not be cost-effective,  and (2) require that the Office of the Chief Financial Officer review the  sufficiency of these justifications against the criteria defined.  (Recommendation 5)

The Office of the Chief Financial Officer should evaluate whether  payment reporting sites could identify enough additional improper  payments through payment recapture audits to make those audits cost- effective, such as by performing audits at selected sites.  (Recommendation 6)

The Office of the Chief Financial Officer should revise DOE’s department- level process for conducting improper payment risk assessments to  include (1) developing and documenting the rationale for the variable  scale used to score risk factors and weighting of the payment reporting  sites; and (2) documenting DOE’s consideration of the inherent risk  associated with the lag in identifying certain improper payments  subsequent to the fiscal year they occurred to ensure that the process  results in a reliable assessment of whether the department is susceptible  to significant improper payments. (Recommendation 7)

The Office of the Chief Financial Officer should revise DOE’s department- level policies and procedures for reviewing risk assessments submitted  by payment reporting sites to require a review and approval of the  documentation supporting these assessments to help ensure the  accuracy of the sites’ assessments. (Recommendation 8)

The Office of the Chief Financial Officer should revise DOE’s department- level policies and procedures for conducting improper payment risk  assessments to define the process for overriding a payment reporting  site’s risk determination, when appropriate. (Recommendation 9)

We provided a draft of this report to DOE for review and comment. DOE  concurred with six of our recommendations and said that it plans to  complete actions from November 2020 through December 2021 to  address these recommendations. DOE did not concur with three of our  recommendations; however, we believe that these recommendations  remain valid. DOE’s written response is reproduced in appendix III and  summarized below. In addition, DOE provided technical comments, which  we incorporated as appropriate.

DOE did not concur with our sixth recommendation to evaluate whether  its payment reporting sites could identify enough additional improper  payments through payment recapture audits to make those audits cost- effective, such as by performing audits at selected sites. In response to  this recommendation, DOE stated in its comments that it has an ongoing  Fraud Risk Management Working Group and that officials have  developed a Fraud Risk Management and Data Analytics Implementation  Plan to strengthen DOE’s capability to prevent, identify, and recover  improper payments and fraud. However, DOE’s plan is still in draft form,  and according to DOE’s technical comments, they will not begin using  data analytics until fiscal year 2021.

In addition, DOE stated in its comments that existing payment recapture  activities such as pre- and post-payment reviews, contractor internal  audits, use of the results of cost allowability audits of integrated  contractors, and interim and close-out reviews of contracts and financial  assistance awards are sufficient. As we discuss in the report, DOE  determined that it does not need to conduct payment recapture audits  based on justifications submitted by the reporting sites. However, most of  the sites’ justifications did not include consideration of the OCFO criteria  for making determinations about the cost-effectiveness of conducting  payment recapture audits. We continue to believe that by evaluating  whether it could identify enough additional improper payments to make  payment recapture audits cost-effective, such as by performing audits at  a limited number of sites, DOE would have an opportunity to identify and  recover additional improper payments or have better information to justify  that payment recapture audits are not cost-effective.

DOE did not concur with our seventh recommendation to (1) develop and  document the rationale for weighting risk factors, including the weighting  of all payment reporting sites; and (2) document its consideration of the  inherent risk associated with the lag in identifying certain improper  payments subsequent to the fiscal year they occurred to ensure that the  process results in a reliable assessment of whether the agency is  susceptible to significant improper payments.

Regarding the weighting of risk factors, DOE said that its risk assessment  evaluates the volume and dollar amount of payments by payment  category, payments subject to manual controls, and fluctuations in  volume and dollar amounts. We recognize that DOE’s risk assessment  template asks each site to assess its risk with regard to payment amounts  and fluctuations. However, we are recommending that the OCFO  document the weighting of all its risk factors, including its decision to  consider as equal the risks identified by all sites—regardless of the dollar  amount of outlays. While assessing the risk of improper payments at an  individual site is important, it does not address the intent of our  recommendation. We continue to believe that, because DOE did not  properly document how it developed and considered risk factors during its  fiscal year 2018 risk assessment, it cannot ensure that the process  produces a reliable assessment of whether DOE is susceptible to  significant improper payments.

Regarding the consideration of inherent risk, DOE stated in its comments  that the Payment Integrity Risk Assessment directs payment reporting  sites to consider inherent risk as part of DOE’s Internal Control Program.  We recognize that sites are to assess the inherent risk that an improper  payment may occur. However, even if none of the sites identifies the  known lag in identifying improper payments as a risk, based on our  review of DOE’s AFRs, this lag is a risk to DOE as a whole. Therefore, we  continue to believe that DOE should document in its risk assessment  process its consideration of the known lag in identifying improper  payments.

Finally, DOE did not concur with our eighth recommendation to revise  DOE’s department-level policies and procedures for reviewing risk  assessments. Specifically, we recommended a policy revision to require  OCFO review and approval of documentation submitted by payment  reporting sites in support of their risk assessments to help ensure the  accuracy of these sites' assessments. DOE stated in its comments that  sufficient processes are in place for ensuring the accuracy of payment  reporting sites’ risk assessments. DOE also stated that OCFO’s Payment  Integrity Guidance instructs payment reporting sites to maintain detailed  information supporting risk assessments, which is available to the OCFO  and DOE’s auditors upon request, and that review and approval of the  documentation occurs during periodic payment reporting site visits by  OCFO staff. Further, DOE stated that as part of the OCFO’s quality  assurance reviews, the OCFO evaluates the documentation used to  support risk assessment ratings and directs updates to risk assessments  if documentation listed does not support the stated risk ratings.

As we discuss in the report, five of the 10 sites we reviewed did not  provide sufficient explanation or documentation supporting their ratings  for several of the risk factors. This includes one site that cited  “discussions with team lead” as the primary source of support for the  ratings it assigned for several risk factors. We continue to believe that by  developing, documenting, and implementing policies and procedures to  require the OCFO to review documentation supporting payment site risk  assessments, DOE would enhance its ability to adequately monitor its  decentralized improper payment risk assessment process and help  ensure that individual payment reporting sites accurately score their risk  factors, leading DOE to obtain a more accurate and reliable assessment  of its overall risk of susceptibility to improper payments.

We are sending copies of this report to the appropriate congressional  committees, the Secretary of Energy, the Administrator of the National  Nuclear Security Administration, and other interested parties. In addition,  the report is available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff members have any questions about this report, please  contact Allison Bawden at (202) 512-3841 or bawdena@gao.gov; or Beryl  Davis at (202) 512-2623 or davisbh@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix IV.

Appendix I: The Department of Energy’s Payment Reporting Sites

The Department of Energy (DOE) has 48 payment reporting sites that are  responsible for conducting improper payment risk assessments and  annually providing data on actual improper payments to DOE’s Office of  the Chief Financial Officer (OCFO). The 48 sites consist of six types, four  of which are types of federal entities and two of which are types of  contractors. The four types of federal entities are Headquarters, DOE  field sites, Power Marketing Administrations, and the Federal Energy  Regulatory Commission. The two types of contractors are management  and operating (M&O) contractor and non-M&O contractor.

Table 5 lists the 48 payment reporting sites and provides the fiscal year  2017 outlays and improper payments data they reported to the OCFO for  DOE’s fiscal year 2018 Agency Financial Report (AFR).

Appendix II: Additional Details of the Department of Energy’s Fiscal Year 2017 Improper Payments Reported by Payment Reporting Sites

The Department of Energy’s (DOE) Office of the Chief Financial Officer  (OCFO) requires the payment reporting sites to provide some details  about their improper payments that were not required to be included in  the department’s Agency Financial Report (AFR) during the period under  review. These details include information about how the improper  payments were identified and the reasons why the payments were  determined to be improper. As shown in figure 4, two methods accounted  for most of the current year improper payments identified by DOE in fiscal  year 2017: post-payment review (57.6 percent) and self-reporting (22.1  percent). As shown in figure 5, there was a broader range of reasons  payments were determined to be improper in fiscal year 2017, although  the majority (54.7 percent) were attributable to settlements as the result of  litigation.

Appendix III: Comments from the Department of Energy

Appendix IV: GAO Contacts and Staff Acknowledgments

In addition to the contacts named above, Hilary Benedict (Assistant  Director), Michelle Philpott (Assistant Director), Kathy Pedalino (Analyst in  Charge),Taya Tasse (Auditor in Charge), Perry Chen, Andy Furillo,  Isabella Guyott, Latesha Love, Laura Pacheco, and Farrah Stone made  key contributions to this report. Also contributing to this report were Kevin  Bray, John Delicath, James Kernen, Jason Kirwan, Dan C. Royer, and  Anne Thomas.

The Department of Energy (DOE) reported that it made about $36 million in improper payments—payments that shouldn’t have been made or were made in the incorrect amount—in FY 2018. But millions more dollars in FY 2018 improper payments could still be found, for example, through audits of contractors that won’t be finished until years later.

DOE doesn’t always track information to determine whether improper payments identified at a later date would increase its annual total to over $100 million—the threshold for additional reporting requirements.

We recommended that DOE track and disclose such information.