oversight

FHFA's Controls to Detect and Prevent Improper Payments

Published by the Federal Housing Finance Agency, Office of Inspector General on 2013-02-28.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

          FEDERAL HOUSING FINANCE AGENCY
            OFFICE OF INSPECTOR GENERAL




             FHFA’s Controls to Detect and Prevent
                     Improper Payments




Audit Report: AUD-2013-005                       February 28, 2013
                                               February 28, 2013


TO:                Mark Kinsey, Chief Financial Officer



FROM:              Russell A. Rau, Deputy Inspector General for Audits



SUBJECT:           FHFA’s Controls to Detect and Prevent Improper Payments
                   (Audit Report No. AUD-2013-005)



Summary

The Improper Payments Information Act of 2002 (IPIA),1 as amended by the Improper Payments
Elimination and Recovery Act of 2010 (IPERA),2 requires Federal agencies3 periodically to
review, estimate, and report programs and activities that may be susceptible to significant
improper payments. Office of Management and Budget (OMB) Memorandum M-11-16,
Issuance of Revised Parts I and II to Appendix C of OMB Circular A-123, dated April 14, 2011,
defines an “improper payment” as follows:

           An improper payment is any payment that should not have been made or that
           was made in an incorrect amount under statutory, contractual, administrative,
           or other legally applicable requirements. Incorrect amounts are overpayments
           or underpayments that are made to eligible recipients (including inappropriate
           denials of payment or service, any payment that does not account for credit for
           applicable discounts, payments that are for the incorrect amount, and duplicate
           payments). An improper payment also includes any payment that was made to an
           ineligible recipient or for an ineligible good or service, or payments for goods or
           services not received (except for such payments authorized by law). In addition,
           when an agency’s review is unable to discern whether a payment was proper as a




1
    Public Law No. 107-300, 31 U.S.C. § 3321 note.
2
    Public Law No. 111-204, 31 U.S.C. § 3321 note.
3
 FHFA is an executive agency and therefore subject to the IPIA. However, not all IPIA provisions are applicable to
FHFA, for the reasons discussed herein.

           Federal Housing Finance Agency Office of Inspector General – AUD-2013-005 – February 28, 2013
                                                     1
          result of insufficient or lack of documentation, this payment must also be
          considered an improper payment.4

The IPIA, as amended by IPERA, also requires Inspectors General to determine whether the
agency is in compliance with the statute each fiscal year (FY) and to submit a report to the head
of the agency, Congressional oversight committees, the Comptroller General of the United
States, and OMB, regarding such compliance.5 The Federal Housing Finance Agency (FHFA),
Office of Inspector General (FHFA-OIG) conducted a performance audit to assess FHFA’s FY
2012 compliance with the IPIA. FHFA-OIG concludes that for FY 2012—although FHFA
determined that much of IPIA, IPERA, and OMB M-11-16 are inapplicable to it—FHFA
established internal controls to detect and prevent improper vendor payments.

Background

          In General

Federal agencies regularly make payments to program beneficiaries, grantees, vendors, and
contractors or on behalf of program beneficiaries. Some of these payments are “improper” in
one or more respects. For example, they may be made to the wrong recipients, in the wrong
amounts, at the wrong times, or for the wrong reasons. Therefore, per IPIA requirements,
Federal agencies should intensify efforts to eliminate payment errors, waste, fraud, and abuse,
including reducing and recapturing erroneous payments. In accordance with OMB
Memorandum M-11-16, the head of each agency shall periodically review all programs and
activities that the relevant agency head administers, and identify, estimate, report, and publish all
programs and activities that may be susceptible to significant improper payments.6 Additionally,
for improper payments estimated in excess of $10 million, the agency must report the potential
actions it is taking to reduce and recapture improper payments.7



4
 OMB Memorandum M-11-16, Issuance of Revised Parts I and II to Appendix C of OMB Circular A-123 (April 14,
2011) at Appendix C, Part I(A)(2).
5
  IPERA § 3(b). Prior to enactment of IPERA, Executive Order 13520, Reducing Improper Payments, included
requirements for agencies and Inspectors General. For purposes of this order, FHFA was not designated by OMB as
operating a high-priority program that required additional agency reporting and Inspector General review.
6
 OMB Memo M-11-16 at Appendix C, Part I(A)(7). M-11-16 provides the amended IPIA requires agencies also to
review vendor payments as part of their annual risk assessment process. Id. at Part I(A)(5) note 4. If these risk
assessments determine that contract or vendor payments are susceptible to significant improper payments (as
defined in Part I(A)(7) Step 1), then agencies are required to establish an annual improper payment measurement for
these vendor payments (as required by Part I(A)(7), Step 2). However, agencies also have the opportunity to pursue
alternative measurements of these contract or vendor payments and may follow the steps outlined in Part I(A)(11).
7
    IPERA § 2(c).

         Federal Housing Finance Agency Office of Inspector General ~ AUD-2012-004 ~ February 28, 2012


                                                         2
To comply with IPIA requirements, each fiscal year, FHFA-OIG is required to review FHFA’s
improper payment reporting in its annual Performance and Accountability Report (PAR) and
accompanying materials; to determine whether FHFA is in compliance with the IPIA; and to
report its findings.8 FHFA-OIG is expected to complete its review and determination within 120
days after FHFA’s publication of its PAR.9 In addition, as part of its review, FHFA-OIG should
confirm that the agency:

           Published a PAR for the most recent fiscal year and posted that report and any
            accompanying materials required by OMB on the agency website;
           Conducted a program specific risk assessment for each program or activity that conforms
            with section 2(a) of the IPIA (if required);
           Published improper payment estimates for all programs and activities identified under
            section 2(b) of the IPIA that have been found to be susceptible to significant improper
            payments by its risk assessment (if required);
           Published programmatic corrective action plans under section 2(c) of the IPIA in its PAR
            (if required);
           Published and met annual reduction targets established under section 2(c) of the IPIA for
            each program assessed to be at risk and measured for improper payments;
           Reported a gross improper payment rate of less than 10% for each program and activity
            for which an improper payment estimate was obtained and published under section 2(b)
            of the IPIA; and
           Reported information on its efforts to recapture improper payments as provided in OMB
            Memorandum M-11-16.
In the event it is determined that an agency does not meet one or more of the requirements, then
it is not compliant with the IPIA. Agencies determined to be noncompliant are required to
submit a plan to Congress describing the actions the agency will take to come into compliance.10
The plan shall include:

           Creation of measurable milestones to be accomplished in order to achieve compliance for
            each program or activity;
           Designation of a senior agency official who shall be accountable for the progress of the
            agency coming into compliance for each program or activity; and

8
    IPERA § 3(b).
9
    FHFA issued its PAR on November 15, 2012.
10
     IPERA § 3(c)(1)(A).

           Federal Housing Finance Agency Office of Inspector General ~ AUD-2012-004 ~ February 28, 2012


                                                        3
           Establishment of an accountability mechanism, such as a performance agreement, with
            appropriate incentives and consequences tied to the success of the senior agency official
            who leads agency efforts to achieve compliance for each program and activity. 11
Further, OMB will notify agencies of additional required actions as needed based on the
compliance level of each agency. OMB Memorandum M-11-16 provides detailed information
on agency compliance planning and related efforts to become compliant.

The IPIA and OMB Memorandum M-11-16 define the term “payment” as any payment or
transfer of Federal funds (including a commitment for future payment, such as cash, securities,
loans, loan guarantees, and insurance subsidies) to any non-Federal person or entity that is made
by a Federal agency, a Federal contractor, a Federal grantee, or a governmental or other
organization administering a Federal program or activity.

            FHFA

In its FY 2012 PAR, dated November 15, 2012, FHFA states that:

            The Improper Payments Elimination and Recovery Act requires that agencies:
            (1) review activities susceptible to significant erroneous payments; (2) estimate
            the amount of annual erroneous payments; (3) implement a plan to reduce
            erroneous payments; and (4) report the estimated amount of erroneous payments
            and the progress to reduce them. The Act defines significant erroneous payments
            as the greater of 2.5 percent of program activities or $10 million. FHFA, in
            the spirit of compliance and as part of a sound internal control structure, has
            established controls to detect and prevent improper payments. FHFA has
            identified no activities susceptible to significant erroneous payments that meet
            the Act’s thresholds.12

By a recent memorandum, FHFA clarified its statement of “in the spirit of compliance and as
part of a sound internal control structure,” explaining that the IPIA and implementing guidance
relating to the following statutory provisions are not applicable to FHFA:

           IPIA subsection 2(a), regarding periodically reviewing programs and activities that may
            be susceptible to significant improper payments;
           IPIA subsection 2(b), regarding estimating the amount of annual improper payments; and



11
     Id. § 3(c)(1)(B).
12
     FHFA FY 2012 PAR p. 115.

           Federal Housing Finance Agency Office of Inspector General ~ AUD-2012-004 ~ February 28, 2012


                                                        4
           IPIA subsection 2(c), regarding reporting the estimates to Congress, including planned
            actions to reduce and recapture erroneous payments.13
FHFA notes that these sections are applicable to payments made with Federal funds, but that
FHFA funds are not to be construed as government or public funds.14 Hence, FHFA reasons that
the payments FHFA makes, such as payments to vendors, are not transfers of Federal funds.15
Also, because FHFA does not make “payments” with Federal funds, FHFA concludes further
that it is not required to conduct program specific risk assessments even if the payments FHFA
makes were to fall within the specified dollar thresholds that trigger program assessments.16
FHFA contends that actions to achieve IPIA compliance involving requests to Congress for
reprogramming, transfer, and reauthorization of programs and activities are not actions that are
available to FHFA, in light of its status as an independent regulatory agency that does not seek
appropriations for its activities.17

Audit Objective

FHFA-OIG’s audit objective was to determine whether FHFA is in compliance with the IPIA, as
amended by IPERA, as well as criteria established in OMB Memorandum M-11-16.

Scope and Methodology

This audit covered FHFA’s efforts to comply both with the IPIA as amended by IPERA, and
with OMB Memorandum M-11-16 as that memorandum pertains to actions taken to detect,
prevent, and report improper payments during the period October 1, 2011, to September 30,
2012. To accomplish the audit objective, FHFA-OIG reviewed applicable statutes, executive
orders, and other related compliance requirements related to improper payments; reviewed
various Government Accountability Office (GAO) audit reports; interviewed key FHFA
officials; obtained sufficient and appropriate evidence regarding compliance actions taken; and
reviewed and assessed improper payment element requirements and related activities. FHFA-
OIG concluded its field work and issued this report in time to ensure compliance with the OMB
requirement for FHFA-OIG to review and make determinations on FHFA’s compliance with the
IPIA, i.e., within 120 days of publication of the FHFA PAR.


13
     See December 11, 2012, Isabella Sammons Memorandum to Debbie Olejnik.
14
     Sammons Memo at 2, citing 12 U.S.C. § 4516(f).
15
     Id.
16
  Id. at 2. OMB guidance at Part II.A of Appendix C of OMB Circular A-123 states the agency should conduct “a
program specific risk assessment for each program or activity that conforms with Section 3321 [note] of Title 31
U.S.C. (if required).”
17
     Sammons Memo at 2.

           Federal Housing Finance Agency Office of Inspector General ~ AUD-2012-004 ~ February 28, 2012


                                                        5
FHFA-OIG’s review of FHFA’s internal controls designed to comply with IPIA requirements
was limited. FHFA-OIG reviewed FHFA’s written documentation and legal opinions related to
its determination that IPIA provisions—and therefore most improper payment compliance
elements—are not applicable to FHFA. FHFA-OIG confirmed the posting of the 2012 PAR and
accompanying materials on FHFA’s external website in accordance with OMB guidance and the
inclusion of appropriate language that FHFA has established and maintains internal control
procedures for handling improper payments.

With respect to the three subsections of the IPIA that FHFA deemed inapplicable, FHFA has
stated that it follows the spirit of those subsections because it has established and maintains
internal controls to detect and prevent improper payments made to vendors.18 FHFA provided
FHFA-OIG with relevant vendor invoice and payment desktop procedures that FHFA
implemented to ensure that a system of internal controls is followed to mitigate the potential for
fraud, misuse, and delinquency in payment. This information is also available to GAO, which
provides an opinion on the effectiveness of FHFA’s internal controls over financial reporting as
of September 30th of each fiscal year. Thus, GAO determines whether such internal controls are
properly designed and operating effectively.

GAO, in its most current Management Report: Opportunities for Improvement in the Federal
Housing Finance Agency’s Internal Controls, GAO-12-499R, dated May 16, 2012, found that
“FHFA did not establish effective controls to assess the risk of errors by its payroll service
provider [, National Finance Center (NFC),] and determine if any compensating controls were
necessary to ensure the accuracy of payroll calculations.” GAO stated that this finding increased
the risk to FHFA that misstatements in its financial statements may not be promptly detected and
corrected. Also, errors in the calculation of its payroll amounts may not be identified.19 In order
to identify and address any NFC errors in processing FHFA payroll, GAO recommended that
the FHFA Acting Director direct the Chief Financial Officer (CFO) to develop and implement
a process to assess and address the risk to FHFA from any internal control issues at NFC
including, as appropriate, any compensating controls commensurate with any identified risk.20

In response to GAO’s recommendation, FHFA reported that it instituted a formal quality control
process on payments prior to release to NFC and performed additional review of payroll
transactions as part of annual internal control testing. FHFA-OIG followed up with agency
representatives to determine the status of the recommendation and confirmed that it remained

18
     Sammons Memo at 2.
19
  GAO-12-499R at 1 & 2. This report was issued by GAO to provide additional information on the internal control
and accounting procedure issues that were identified during its audit of FHFA’s FY 2011 financial statements and to
provide recommendations to address those issues.
20
     Id. at 6.

           Federal Housing Finance Agency Office of Inspector General ~ AUD-2012-004 ~ February 28, 2012


                                                         6
open because GAO intends to retest payroll in the current year. Based on the results of its
testing, GAO will assess the status of implementation of its recommendation.

Also, GAO, in its previous Management Report: Opportunities for Improvement in the Federal
Housing Finance Agency’s Internal Controls and Accounting Procedures, GAO-11-398R, dated
April 29, 2011, found that FHFA did not always properly verify vendor invoice amounts prior to
payment.21 GAO indicated that deficiencies in controls over FHFA’s invoice payment
processing procedures can increase the risk of it making improper payments and misstating
expenses in its financial statements.22 GAO recommended that FHFA include detailed
instructions in its Invoice and Payment Desktop Procedures governing how to verify the
accuracy of invoice amounts prior to payment.23

In response to GAO’s recommendation, FHFA stated that it agreed that additional guidance
needs to be given to invoice approvers/contracting officer technical representatives and cited
actions it has taken, or intends to take, to address this internal control issue.24 On April 4, 2011,
FHFA issued supplemental guidance on invoice approval procedures in anticipation of the GAO
recommendation. FHFA-OIG confirmed with agency officials that this recommendation
remained in an “In progress” status. FHFA-OIG also confirmed with GAO that it will include
invoice payment processing in its FY 2013 audit as a follow up on this prior recommendation.
FHFA-OIG will continue to monitor the status of this recommendation.

FHFA-OIG followed up on the implementation of GAO’s recommendation to FHFA through
review of GAO’s reports on its audits of FHFA’s financial statements. Specifically, GAO issued
FHFA’s FY 2012 and FY 2011 Financial Statements Audit Report(s), on November 15, 2012,
and November 15, 2011, respectively. For both audits, GAO concluded for the audited year that:
(1) FHFA’s financial statements were fairly presented in all material respects; (2) FHFA had
effective internal control over financial reporting as of the last day of the audit period; and
(3) GAO found no reportable instances of noncompliance with the laws and regulations it
tested.25 In its reports, GAO stated that it noted matters involving FHFA’s internal controls that
were less significant than a material weakness or significant deficiency, but which nonetheless

21
  GAO-11-398R at 1. This report was issued by GAO to provide additional information on the internal control and
accounting procedure issues that were identified during its audit of FHFA’s FY 2010 financial statements and to
provide recommendations to address those issues.
22
     Id. at 5.
23
     Id.
24
     GAO-11-398R at 5.
25
   GAO-12-161, Federal Housing Finance Agency’s Fiscal Years 2011 and 2010 Financial Statements (originally
issued November 15, 2011, revised on November 29, 2011, and January 26, 2012) at 4-6; and GAO-13-124R,
Federal Housing Finance Agency’s Fiscal Years 2012 and 2011 Financial Statements at 1 and 74.

           Federal Housing Finance Agency Office of Inspector General ~ AUD-2012-004 ~ February 28, 2012


                                                        7
merit management’s attention.26 GAO indicated it would report separately to FHFA
management on these matters as appropriate27 and has since issued GAO-12-499R as a follow up
to its FY 2011 Financial Statements Audit Report.28 With respect to the issues identified during
the FY 2012 FHFA audit, GAO decided not to issue a formal report.

Although FHFA-OIG was not required by the IPIA and OMB Memorandum M-11-16 to assess
compliance with FHFA’s internal controls over payments to detect and prevent improper
payments made to vendors, FHFA-OIG reviewed and relied on the above work of GAO
concerning the vendor invoice payment processing procedures as part of this audit. FHFA-OIG
coordinated with GAO to confirm its understanding of GAO’s results.

FHFA-OIG conducted this performance audit in accordance with Generally Accepted
Government Auditing Standards. Those standards require that audits be planned and performed
to obtain sufficient, appropriate evidence to provide a reasonable basis for FHFA-OIG’s findings
and conclusions based on the audit objective. FHFA-OIG believes that the evidence obtained
provides a reasonable basis for the conclusions included herein, based on the audit objectives.

FHFA-OIG Conclusions

A summary of FHFA-OIG’s conclusions on IPIA compliance by compliance element is given in
the table below.29 Generally, FHFA-OIG concludes that FHFA complied with the applicable
provision (Letter A in the table below) of the IPIA, as amended by IPERA, and the additional
reporting provision established in OMB Memorandum M-11-16 (Letter G in the table below).
FHFA opined the remaining requirements are not applicable.

Table 1. FHFA’s Status of Improper Payments Information Act Compliance for FY 2012


             Compliance Element                           FHFA-OIG Conclusion
(A) The agency has published an annual      FHFA published the 2012 PAR and has included
performance and accountability report (PAR) relevant information pertaining to improper
or financial statement for the most recent  payments.
fiscal year and posted that report and any
accompanying materials required under
guidance of the Office of Management and

26
     Id. at 6, and Id. at 75, respectively.
27
     Id.
28
     GAO-12-499R at 1.
29
     See OMB Memo M-11-16 at Appendix C, Part II(A)(4).

           Federal Housing Finance Agency Office of Inspector General ~ AUD-2012-004 ~ February 28, 2012


                                                        8
           Compliance Element                                     FHFA-OIG Conclusion
Budget on the agency website.

(B) If required, the agency has conducted a        FHFA determined that section 2(a) of IPIA is not
program specific risk assessment for each          applicable because FHFA funds are not Federal
program or activity that conforms with             funds for purposes of this provision.
section 2(a) of the Improper Payments
Information Act of 2002 (31 U.S.C. § 3321
note).

(C) The agency has published improper              FHFA determined that section 2(b) of IPIA is not
payments estimates for all programs and            applicable because FHFA funds are not Federal
activities identified as susceptible to            funds for purposes of this provision.
significant improper payments under its risk
assessment (if required).

(D) The agency has published programmatic          FHFA determined that section 2(c) of IPIA is not
corrective action plans in the PAR (if             applicable because FHFA funds are not Federal
required).                                         funds for purposes of this provision.

(E) The agency published, and has met,      FHFA determined that section 2(c) of IPIA is not
improper payments reduction targets         applicable because FHFA funds are not Federal
established under section 2(c) of the       funds for purposes of this provision.
Improper Payments Information Act of 2002
(31 U.S.C. § 3321 note) in the accompanying
materials to the annual financial statement
for each program assessed to be at risk and
measured for improper payments.

(F) The agency has reported a gross                FHFA determined that section 2(b) of IPIA is not
improper payment rate of less than 10% for         applicable because FHFA funds are not Federal
each program and activity for which an             funds for purposes of this provision.
estimate was obtained and published in the
PAR.

(G) The agency has reported information on         FHFA reported in its PAR that it has established
its efforts to recapture improper payments.        and maintains internal control procedures for
                                                   handling improper payments. Furthermore, FHFA
                                                   stated it pursues the recovery of any improper
                                                   payments with its vendors. Also, it should be

      Federal Housing Finance Agency Office of Inspector General ~ AUD-2012-004 ~ February 28, 2012


                                                   9
            Compliance Element                                   FHFA-OIG Conclusion
                                                    noted that FHFA-OIG can perform contract audits
                                                    to determine if payments made to contractors are
                                                    proper.30



FHFA-OIG recognizes that FHFA is acting to achieve the intent of the IPIA, IPERA, and the
related OMB Memorandum M-11-16, in spite of its determination that it is not required to do so.
Specifically, in the spirit of compliance and as part of a sound internal control structure, FHFA
has established controls to detect and prevent improper vendor payments. For example, FHFA’s
invoice payment processing procedures include detailed instructions on properly verifying the
accuracy of vendor invoice amounts prior to payment.

FHFA-OIG appreciates the courtesies and cooperation extended to us by FHFA staff during this
audit. On February 15, 2013, FHFA responded to a draft of this report offering no objection to
its conclusions. FHFA’s response is included in Appendix A of this report.

cc:     Edward J. DeMarco, Acting Director, FHFA
        Alfred Pollard, Chief Counsel, FHFA
        Richard Hornsby, Chief Operating Officer, FHFA
        Bruce Crandlemire, Senior Advisor for IG Operations, FHFA
        John Major, Internal Controls and Audit Follow-up Manager, FHFA




30
  See, e.g., FHFA-OIG, FHFA’s Oversight of Contract No. FHF-10-F-0007 with Advanced Technology Systems,
Inc.

       Federal Housing Finance Agency Office of Inspector General ~ AUD-2012-004 ~ February 28, 2012


                                                    10
Appendix A: FHFA’s Comments on the Audit




   Federal Housing Finance Agency Office of Inspector General ~ AUD-2012-004 ~ February 28, 2012


                                                11
Additional Information and Copies

For additional copies of this report:

       Call FHFA-OIG at: 202-730-0880

       Fax your request to: 202-318-0239

       Visit the FHFA-OIG website at: www.fhfaoig.gov



To report alleged fraud, waste, abuse, mismanagement, or any other kind of criminal or
noncriminal misconduct relative to FHFA’s programs or operations:

       Call our Hotline at: 1-800-793-7724

       Fax your written complaint to: 202-318-0358

       E-mail us at: oighotline@fhfaoig.gov

       Write to us at: FHFA Office of Inspector General
                       Attn: Office of Investigation – Hotline
                       400 Seventh Street, S.W.
                       Washington, DC 20024




      Federal Housing Finance Agency Office of Inspector General ~ AUD-2012-004 ~ February 28, 2012


                                                   12