oversight

FHFA Complied with Applicable Improper Payment Requirements During Fiscal Year 2017

Published by the Federal Housing Finance Agency, Office of Inspector General on 2018-04-26.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

        Federal Housing Finance Agency
            Office of Inspector General




FHFA Complied with Applicable
Improper Payment Requirements
    During Fiscal Year 2017




Audit Report • AUD-2018-009 • April 26, 2018
                 Executive Summary
                 The Improper Payments Information Act of 2002 (IPIA), as amended by the
                 Improper Payments Elimination and Recovery Act of 2010 (IPERA) and the
                 Improper Payments Elimination and Recovery Improvement Act of 2012
                 (IPERIA) (collectively, IPIA, as amended), requires federal agencies to
                 periodically review, estimate, and report programs and activities that may be
AUD-2018-009     susceptible to significant improper payments. IPIA was amended by IPERA
                 to, among other things, direct federal Inspectors General to determine
April 26, 2018   annually whether their respective agencies are in compliance with the statute
                 and to submit a report to the head of the agency, Congressional oversight
                 committees, the Comptroller General of the United States, and the controller
                 of the Office of Management and Budget (OMB).

                 The Federal Housing Finance Agency (FHFA or Agency), through its Office
                 of General Counsel (OGC), maintains that most requirements of the IPIA, as
                 amended, are not applicable to the Agency because those requirements apply
                 only to payments made with federal funds and FHFA does not finance its
                 operations with federal funds. That said, FHFA asserts that it has put controls
                 in place to achieve the intent of the IPIA, as amended. We conducted a
                 performance audit to assess the Agency’s compliance with the IPIA, as
                 amended, for fiscal year 2017. We found that FHFA complied with the
                 applicable provisions of the IPIA, as amended, as well as related criteria
                 established by OMB.

                 This report was prepared by Heath Wolfe, Director of Audit Operations, with
                 the assistance of Bob Taylor, Assistant Inspector General for Audits. We
                 appreciate the cooperation of FHFA staff, as well as the assistance of all those
                 who contributed to the preparation of this report.

                 This report has been distributed to FHFA, Congress, OMB, and others and
                 will be posted on our website, www.fhfaoig.gov.

                 Marla A. Freedman, Deputy Inspector General for Audits /s/
TABLE OF CONTENTS ................................................................
EXECUTIVE SUMMARY .............................................................................................................2

ABBREVIATIONS .........................................................................................................................4

BACKGROUND .............................................................................................................................5

FACTS AND ANALYSIS...............................................................................................................7
      Not All IPIA Requirements Are Applicable to FHFA .............................................................7

CONCLUSION ................................................................................................................................9

FHFA COMMENTS AND OIG RESPONSE ...............................................................................10

OBJECTIVE, SCOPE, AND METHODOLOGY .........................................................................11

APPENDIX: FHFA MANAGEMENT RESPONSE ....................................................................13

ADDITIONAL INFORMATION AND COPIES .........................................................................14




                                           OIG • AUD-2018-009 • April 26, 2018                                                            3
ABBREVIATIONS .......................................................................

AFR                   Agency Financial Report

FHFA or Agency        Federal Housing Finance Agency

OGC                   Federal Housing Finance Agency Office of General Counsel

OIG                   Federal Housing Finance Agency Office of Inspector General

GAO                   Government Accountability Office

IPERA                 Improper Payments Elimination and Recovery Act of 2010

IPERIA                Improper Payments Elimination and Recovery Improvement Act of
                      2012

IPIA                  Improper Payments Information Act of 2002

OMB                   Office of Management and Budget

OMB M-15-02           Office of Management and Budget Memorandum M-15-02,
                      Appendix C to Circular No. A-123, Requirements for Effective
                      Estimation and Remediation of Improper Payments

PAR                   Performance and Accountability Report

U.S.C.                United States Code




                          OIG • AUD-2018-009 • April 26, 2018                         4
BACKGROUND ..........................................................................

Because federal agencies regularly make payments to program beneficiaries, grantees,
vendors, and contractors, or on behalf of program beneficiaries, there is a possibility that
some of these payments may be “improper” in one or more respects. To provide estimates
and report improper payments by federal agencies, Congress enacted IPIA in 2002, 1 which
it amended in 2010 and 2013. IPIA, as amended, requires federal agencies to periodically
review, determine, estimate, and report programs and activities that may be susceptible to
significant improper payments. 2 According to IPIA, as amended, the term “payment” means:
“[A]ny transfer or commitment for future transfer of Federal funds such as cash, securities,
loans, loan guarantees, and insurance subsidies to any non-Federal person or entity or a
Federal employee, that is made by a Federal agency, a Federal contractor, a Federal grantee,
or a governmental or other organization administering a Federal program or activity.” 3

To provide further guidance to federal agencies on the improper payments covered by IPIA,
as amended, OMB issued a memorandum in October 2014 that defines “improper payment”
as:

          [A]ny payment that should not have been made or that was made in an incorrect
          amount under statutory, contractual, administrative, or other legally applicable
          requirements. Incorrect amounts are overpayments or underpayments that are
          made to eligible recipients (including inappropriate denials of payment or service,
          any payment that does not account for credit for applicable discounts, [footnote
          omitted] payments that are for an incorrect amount, and duplicate payments).
          An improper payment also includes any payment that was made to an ineligible
          recipient or for an ineligible good or service, or payments for goods or services
          not received (except for such payments authorized by law). In addition, when an
          agency’s review is unable to discern whether a payment was proper as a result of
          insufficient or lack of documentation, this payment must also be considered an
          improper payment. 4

IPIA, as amended, directs federal agencies to put into place internal controls designed to
eliminate payment errors, waste, fraud, and abuse, including reducing and recapturing


1
    Public Law No. 107-300, 31 U.S.C. § 3321 note.
2
    Public Law No. 111-204, 31 U.S.C. § 3321 note.
3
    Public Law No. 112-248, 31 U.S.C. § 3321 note.
4
 OMB Memorandum M-15-02, Appendix C to Circular No. A-123, Requirements for Effective Estimation and
Remediation of Improper Payments, at Part I ¶¶ 2 and 3 (Oct. 20, 2014) [hereinafter OMB M-15-02].



                                    OIG • AUD-2018-009 • April 26, 2018                                5
erroneous payments. OMB M-15-02 establishes a four-step process for agencies to follow
to identify those operations subject to the IPIA, as amended, and to design and implement
appropriate internal controls to reduce the risk of improper payments:

         1. Review all programs and activities and identify those that are susceptible to
            significant improper payments;

         2. Obtain a statistically valid estimate of the annual amount of improper payments in
            programs and activities identified in Step 1;

         3. Implement a plan sufficient to reduce improper payments; and

         4. Report annually on improper payments in the agency financial report (AFR) or the
            performance and accountability report (PAR). 5

To determine an agency’s compliance with IPIA, as amended, OMB M-15-02, requires each
agency Inspector General to review their agency’s AFR or PAR (and any accompanying
information) for the most recent fiscal year. Compliance under IPIA, as amended, means that
the agency has:

         1. Published an AFR or PAR for the most recent fiscal year and posted that report
            and any accompanying materials required by OMB on the agency website;

         2. Conducted a program-specific risk assessment for each program or activity that
            conforms with Section 3321 note of Title 31 U.S.C. [i.e., IPIA, as amended] (if
            required);

         3. Published improper payment estimates for all programs and activities identified
            as susceptible to significant improper payments under its risk assessment (if
            required);

         4. Published programmatic corrective action plans in the AFR or PAR (if required);

         5. Published, and is meeting, annual reduction targets for each program assessed to
            be at risk and estimated for improper payments (if required and applicable); and




5
  OMB M-15-02, App. C, supra note 1, at 9-16. A PAR provides both financial and performance information
that enables the President, the Congress, and the public to assess the performance of an agency relative to its
mission and to demonstrate accountability. An AFR provides similar information, but a performance section is
not included. See OMB, Circular A-136, Financial Reporting Requirements, at 11-13 (Sept. 18, 2014).



                                    OIG • AUD-2018-009 • April 26, 2018                                           6
           6. Reported a gross improper payment rate of less than 10 percent for each program
              and activity for which an improper payment estimate was obtained and published
              in the PAR or AFR. 6

Inspectors General are to complete their annual compliance reviews within 180 days after
their respective agencies issue their AFRs or PARs and report their findings. 7 If an Inspector
General finds that an agency has not met one or more of the six elements, that agency is
required by IPIA, as amended, to submit a plan to the Congress describing the actions it will
take to come into compliance. 8 Further, OMB will notify agencies of additional required
actions as needed based on the compliance level of each agency. OMB M-15-02 provides
detailed information on agency compliance planning and related efforts to become compliant.

FHFA issued its fiscal year 2017 PAR on November 15, 2017. Pursuant to IPIA, as amended,
we conducted this performance audit.


FACTS AND ANALYSIS ...............................................................

Not All IPIA Requirements Are Applicable to FHFA

In its 2017 PAR, FHFA makes no representations that it is covered by IPIA, as amended.
Since 2012, FHFA’s OGC has advised our office that it has concluded that various
subsections of IPIA, as amended, are only applicable to payments made with federal funds,
and that these subsections do not apply to FHFA because it is an independent regulatory
agency that does not seek appropriations for its operations. Consequently, OGC reasons that
payments made by the Agency, such as payments to vendors, are not transfers of federal
funds. 9

Figure 1 below summarizes the requirements of the IPIA, as amended, and the elements that
FHFA considers inapplicable to its operations.




6
    OMB M-15-02, App. C, supra note 1, at Part II § A(3).
7
    OMB M-15-02, App. C, supra note 1, at Part II § A(2).
8
    IPERA § 3(c)(1)(A), see 31 U.S.C. § 3321 note.
9
    See 12 U.S.C. § 4516(f).



                                     OIG • AUD-2018-009 • April 26, 2018                          7
               FIGURE 1. FHFA’S IPIA, AS AMENDED, COMPLIANCE FOR FISCAL YEAR 2017
                      Compliance Element                                  FHFA Action
      The agency has published an annual AFR or PAR         FHFA published its 2017 PAR and
      for the most recent fiscal year and posted that       included relevant information pertaining
      report and any accompanying materials required        to improper payments.
      under guidance of OMB on the agency website.
      The agency has conducted a program-specific risk      FHFA determined that this section of
      assessment for each program or activity that          IPIA, as amended, is not applicable to
      conforms with the IPIA, as amended (31 U.S.C.         the Agency.
      § 3321 note) (if required).
      The agency has published improper payments            FHFA determined that this section of
      estimates for programs and activities identified      IPIA, as amended, is not applicable to
      as susceptible to significant improper payments       the Agency.
      under its risk assessment (if required).
      The agency has published programmatic                 FHFA determined that this section of
      corrective action plans in its PAR or AFR (if         IPIA, as amended, is not applicable to
      required).                                            the Agency.
      The agency has published, and is meeting,             FHFA determined that this section of
      improper payments reduction targets for each          IPIA, as amended, is not applicable to
      program assessed to be at risk and estimated for      the Agency.
      improper payments (if required and applicable).
      The agency has reported a gross improper              FHFA determined that this section of
      payment rate of less than 10 percent for each         IPIA, as amended, is not applicable to
      program and activity for which an estimate was        the Agency.
      obtained and published in its AFR or PAR.



We reviewed the information provided by FHFA’s OGC, and the Office of Inspector
General’s (OIG) Office of Counsel made an independent assessment of the reasonableness of
the applicable legal authorities on which OGC relied. Based on its review, OIG’s Office of
Counsel determined that OGC’s analysis is reasonable.

Notwithstanding the inapplicability of these various IPIA, as amended, subsections, FHFA
advises in its PAR:

        FHFA, in the spirit of compliance and as part of its sound internal control
        structure, has established controls to detect and prevent improper vendor
        payments. … FHFA has not identified any programs or activities susceptible
        to significant improper payments that meet IPIA’s thresholds. 10




10
 See FHFA, Fiscal Year 2017 Performance and Accountability Report (Nov. 15, 2017) (online at
www.fhfa.gov/AboutUs/Reports/Pages/Performance-and-Accountability-Report-2017.aspx).



                                 OIG • AUD-2018-009 • April 26, 2018                                   8
To assess this representation by FHFA, we reviewed the following FHFA procedures and
guidance implemented for fiscal year 2017 to mitigate the risks of fraud, misuse, and payment
delinquency:

      •    Invoice and payment procedures;

      •    Purchase charge card procedures;

      •    Accrual and deobligation procedures; and

      •    Micro-purchase procedures and supplemental purchase cardholder guidance.

We noted no weaknesses in the design of these procedures and guidance. Furthermore, the
Government Accountability Office (GAO) is charged with performing the audit of FHFA’s
annual financial statements. 11 As part of its audit, GAO audits FHFA’s internal control over
financial reporting. In its report Financial Audit: Federal Housing Finance Agency’s Fiscal
Years 2017 and 2016 Financial Statements, GAO opined that FHFA maintained, in all
material respects, effective internal control over financial reporting as of September 30, 2017,
based on relevant criteria. GAO also reported that during the audit, it identified deficiencies
in FHFA’s internal controls over financial reporting that were communicated to FHFA
management. However, GAO did not consider these deficiencies to be material weaknesses
or significant deficiencies. 12 According to our inquiries with FHFA staff, the deficiencies
communicated by GAO did not relate to the design and effectiveness of FHFA’s invoice and
payment process controls.


CONCLUSION ............................................................................

We conclude that FHFA complied with the applicable statutory improper payment
requirements, as well as related criteria established in the related OMB M-15-02 for fiscal
year 2017. As to the specific requirements of the IPIA, as amended, that FHFA’s OGC has
opined are non-applicable, we determined that OGC’s analysis is reasonable.




11
     12 U.S.C. § 4516(h).
12
   According to the American Institute of Certified Professional Accountants’ Codification of Statements on
Auditing Standards, AU-C § 265.07, a material weakness is a deficiency, or a combination of deficiencies, in
internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial
statements will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is a
deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness yet
important enough to merit attention by those charged with governance.



                                      OIG • AUD-2018-009 • April 26, 2018                                              9
FHFA COMMENTS AND OIG RESPONSE .....................................

OIG provided FHFA an opportunity to respond to a draft report for this audit. In its
management response, which is included as an appendix to this report, FHFA acknowledged
our conclusion that it complied with the applicable provisions of the IPIA, as amended.




                            OIG • AUD-2018-009 • April 26, 2018                           10
OBJECTIVE, SCOPE, AND METHODOLOGY .................................

Our audit objective was to assess FHFA’s compliance with IPIA, as amended. The scope of
the audit covered the period October 1, 2016, through September 30, 2017 (i.e., fiscal year
2017).

To accomplish the audit, we:

   •   Reviewed OIG’s prior IPIA, as amended, audit documentation and audit report
       (AUD-2017-004, dated May 10, 2017);

   •   Reviewed IPIA, as amended by IPERA and IPERIA, and OMB M-15-02 regarding
       requirements that apply to FHFA and OIG;

   •   Determined whether there has been any change in FHFA’s assessment of the
       applicability of IPIA, as amended, to the Agency, and obtained a review by OIG’s
       Office of Counsel of that assessment;

   •   Determined whether FHFA published its PAR, and accompanying materials for fiscal
       year 2017, and posted that report, as well as any accompanying materials required by
       OMB, on the Agency’s website;

   •   Determined whether FHFA was required to conduct program-specific risk assessments
       for each program or activity under 31 U.S.C. 3321 and OMB M-15-02;

   •   Interviewed applicable FHFA officials/staff to obtain any additional background
       information that may be required, such as improper payments assessments, related
       correspondence, and/or results of procedures performed, including any legal opinions
       received and decisions taken;

   •   Obtained and reviewed the Agency’s invoice and payments procedures, purchase
       charge card procedures, accrual and deobligation procedures, micro-purchase
       procedures and supplemental purchase cardholder guidance, and internal control self-
       assessments for fiscal year 2017; and

   •   Reviewed GAO’s report on its audit of FHFA’s financial statements for fiscal years
       2017 and 2016, and inquired of FHFA staff about deficiencies in internal control over
       financial reporting that GAO communicated to FHFA during the audit. The purpose of
       our inquiries was to determine whether any of the deficiencies communicated related
       to the design and effectiveness of FHFA’s invoice and payment process controls.




                               OIG • AUD-2018-009 • April 26, 2018                             11
We conducted this performance audit between January 2018 and April 2018 in accordance
with generally accepted government auditing standards. Those standards require that audits be
planned and performed to obtain sufficient, appropriate evidence to provide a reasonable basis
for our findings and conclusions based on our audit objective. We believe that the evidence
obtained provides a reasonable basis for our conclusions, based on our audit objective.




                              OIG • AUD-2018-009 • April 26, 2018                                12
APPENDIX: FHFA MANAGEMENT RESPONSE .............................




                    OIG • AUD-2018-009 • April 26, 2018       13
ADDITIONAL INFORMATION AND COPIES .................................


For additional copies of this report:

   •   Call: 202-730-0880

   •   Fax: 202-318-0239

   •   Visit: www.fhfaoig.gov



To report potential fraud, waste, abuse, mismanagement, or any other kind of criminal or
noncriminal misconduct relative to FHFA’s programs or operations:

   •   Call: 1-800-793-7724

   •   Fax: 202-318-0358

   •   Visit: www.fhfaoig.gov/ReportFraud

   •   Write:

                FHFA Office of Inspector General
                Attn: Office of Investigations – Hotline
                400 Seventh Street SW
                Washington, DC 20219




                               OIG • AUD-2018-009 • April 26, 2018                         14