oversight

Audit of the U.S. Office of Personnel Management's Fiscal Year 2015 Improper Payments Reporting

Published by the Office of Personnel Management, Office of Inspector General on 2016-05-11.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

       U.S. OFFICE OF PERSONNEL
             MANAGEMENT
   OFFICE OF THE INSPECTOR GENERAL
            OFFICE OF AUDITS




        Final Audit Report
 AUDIT OF THE U.S. OFFICE OF PERSONNEL
MANAGEMENT’S FISCAL YEAR 2015 IMPROPER
         PAYMENTS REPORTING

                                    Report Number 4A-CF-00-16-026

                                                       May 11, 2016


                                                            CAUTION
This audit report has been distributed to Federal officials who are responsible for the administration of the audited program. This audit
report may contain proprietary data which is protected by Federal law (18 U.S.C. 1905). Therefore, while this audit report is available
under the Freedom of Information Act and made available to the public on the OIG webpage (http://www.opm.gov/our-inspector-general),
caution needs to be exercised before releasing the report to the general public as it may contain proprietary information that was
redacted from the publicly distributed copy
           EXECUTIVE SUMMARY
    Audit of the U.S. Office of Personnel Management’s Fiscal Year 2015 Improper Payments Reporting

Report No. 4A-CA-00-16-026                                                                                                      May 11, 2016

Why Did We Conduct the Audit?             What Did We Find?

The objective of our audit was to         We determined that OPM is not in compliance with IPERIA
determine if the U.S. Office of           requirements for FY 2015. Specifically, we identified the following:
Personnel Management (OPM) is
                                                    Performance
compliant with the Improper Payments                    and
                                                   Accountability
Information Act, as amended by the                    Report/
                                                      Agency                     Improper   Corrective
Improper Payments Elimination and                    Financial         Risk       Payment    Action      Reduction   Recovery    Total Non-
                                                      Report        Assessment   Estimate     Plan        Targets     Efforts   Compliances
Recovery Improvement Act (IPERIA),           OPM
for Fiscal Year (FY) 2015.
                                                   Compliance              Non compliance


What Did We Audit?
                                          In addition, we identified an area where OPM can improve on its
The Office of the Inspector General has
                                          oversight controls over improper payments reporting. Improper
completed a performance audit on          payments information in the Agency Financial Report was
OPM’s FY 2015 improper payments           inaccurately reported. Specifically, we identified several
reporting for compliance with IPERIA.     inaccuracies between what was reported in the FY 2015 Agency
Our audit fieldwork was conducted from    Financial Report Table 14 and the supporting documentation that we
March 10 through April 14, 2016, at       obtained from the program office.
OPM headquarters, located in
Washington D.C.




  ____________________________
  Michael R. Esser
  Assistant Inspector General
  for Audits

                                                        i
               ABBREVIATIONS



AFR      Agency Financial Report
FY       Fiscal Year
GAO      U.S. Government Accountability Office
IPERA    Improper Payments Elimination and Recovery Act of 2010
IPERIA   Improper Payments Elimination and Recovery Improvement Act of 2012
OCFO     Office of the Chief Financial Officer
OMB      U.S. Office of Management and Budget
OPM      U.S. Office of Personnel Management
PAR      Performance and Accountability Report




                            ii
                          TABLE OF CONTENTS


                                                                                                                          Page

        EXECUTIVE SUMMARY ......................................................................................... i

        ABBREVIATIONS ..................................................................................................... ii 


I.	     BACKGROUND ..........................................................................................................1 


II.	    OBJECTIVE, SCOPE, AND METHODOLOGY ....................................................5

III.	   AUDIT FINDINGS AND RECOMMENDATIONS.................................................7
        1. Non-Compliance .....................................................................................................7
           A. Improper Payment Estimates’ Root Causes.......................................................7
           B. Risk Assessments...............................................................................................9

        2. Oversight Controls ..................................................................................................11
               Improper Payments Information in the Agency Financial
               Report Was Inaccurately Reported ..................................................................11

IV.	    MAJOR CONTRIBUTORS TO THIS REPORT ..................................................13

        APPENDIX (OPM’s response to our draft report, dated April 29, 2016)

        REPORT FRAUD, WASTE, AND MISMANAGEMENT

                                 I. BACKGROUND

This final audit report details the findings, conclusions, and recommendations resulting from our
performance audit of the U.S. Office of Personnel Management’s (OPM) Fiscal Year (FY) 2015
Improper Payments Reporting. The audit was performed by OPM’s Office of the Inspector
General, as authorized by the Inspector General Act of 1978, as amended.

On July 22, 2010 and January 10, 2013, the President signed into law the Improper Payments
Elimination and Recovery Act of 2010 (IPERA) and the Improper Payments Elimination and
Recovery Improvement Act of 2012 (IPERIA), respectively, which amended the Improper
Payments Information Act of 2002. IPERIA redefined the definition of “significant improper
payments” and strengthened executive branch agency reporting requirements.

The U.S. Office of Management and Budget (OMB) has issued improper payments guidance to
assist agencies in implementing the laws, including OMB Circular A-123 Appendix C,
Management's Responsibility for Internal Controls, and OMB Circular A-136, Financial
Reporting Requirements. Routine updates are issued by OMB, including an update to OMB
Circular A-123 through Memorandum M-15-02 on October 20, 2014, and a revision to OMB
Circular A-136 on August 4, 2015.

An agency’s program is deemed susceptible to significant improper payments1 if the total
amount of overpayments plus underpayments in the program exceeds both 1.5 percent of
program outlays and $10,000,000 of all program or activity payments made during the fiscal year
reported or, $100,000,000 regardless of improper payments percentage of total program outlays.

Under OMB guidance, agencies must have performed the following with respect to improper
payments reporting:

    a.	 “[p]ublished an AFR [Agency Financial Report] or PAR [Performance and
        Accountability Report] for the most recent fiscal year and posted that report and any
        accompanying materials required by OMB on the agency website;
    b.	 [c]onducted a program specific risk assessment for each program or activity that 

        conforms with Section 3321 note of Title 31 U.S.C. (if required); 

    c.	 [p]ublished improper payment estimates for all programs and activities identified as
        susceptible to significant improper payments under its risk assessment (if required);
    d.	 [p]ublished programmatic corrective action plans in the AFR or PAR (if required);


1
 An improper payment is any payment that should not have been made or that was made in an incorrect amount
under statutory, contractual, administrative, or other legally applicable requirements.


                                                  1	                                Report No. 4A-CF-00-16-026
    e.	 [p]ublished, and is meeting2, annual reduction targets for each program assessed to be at
        risk and estimated for improper payments (if required and applicable); and
    f.	 [r]eported a gross improper payment rate of less than 10 percent for each program and
        activity for which an improper payment estimate was obtained and published in the AFR
        or PAR.”

Agencies are also required to:

     	 categorize their improper payment estimates based on OMB’s new improper
        payment categories;
      perform risk assessments on all low risk programs at least once every three years to
        assess their risk for improper payments;
     	 develop indicators of improper payments for programs with the most egregious
        cases, compliance for which is determined by OMB;
      identify the accountable official that oversees efforts to reduce improper payments
        for high-priority programs;
     	 describe alternative improper payments measurements;
     	 expand payment recapture audits to all types of payments and activities with more
        than $1 million in annual outlays if cost effective;
     	 improve corrective action plans to include incorporating lessons learned;
     	 recover improper payments by conducting recovery audits on programs that expend
        $1 million or more annually if conducting such audits is cost-effective;
     	 distribute funds recovered through payment recapture audits for authorized
        purposes;
     	 establish internal controls to reduce improper payment rates; and
     	 use the Do Not Pay List3 to verify eligibility for Federal payments in order to help
        reduce and eliminate payment errors before they occur.

If an agency does not meet one or more of these requirements, it is not compliant with IPERA
and IPERIA.

Each agency’s Inspector General is required to review improper payments reporting in the AFR
or PAR to determine compliance with IPERIA. OMB requires that the Inspector General
review the agency’s annual AFR or PAR, which includes evaluating the accuracy and
completeness of agency reporting, and evaluating agency performance in reducing and

2
  A program will have met a reduction target if the improper payment rate for that program in the current year falls
within plus or minus 0.1 percentage points of the reduction target set in the previous year's AFR or PAR.
3
  The “Do Not Pay List” is an initiative to prevent Federal agencies from making certain improper payments by
directing agencies to review current pre-payment and pre-award procedures to ensure the recipients are eligible.


                                                      2	                                   Report No. 4A-CF-00-16-026
recapturing improper payments. In addition, the OIG is required to determine if the agency’s
corrective action plans are robust and focused on the appropriate root causes of improper
payments, effectively implemented, and prioritized within the agency, to allow it to meet
reduction targets. The Inspector General is required to complete its review and determination
within 180 days of OPM’s AFR publication.

Two of OPM’s earned benefit programs, Retirement Services and the Federal Employees Health
Benefits Program, are by definition susceptible to significant improper payments.

OPM’s reported improper payments and overpayments recaptured for FY 2015 are summarized
in the following tables below.


                                    FY 2015 Improper Payments Summary4
                                       Gross
                      Total                                                                       2015 Improper
    Program                          Improper        Overpayments          Underpayments
                     Outlays                                                                        Payments
                                     Payments         ($ millions)           ($ millions)
                   ($ millions)                                                                      Percent
                                    ($ millions)
Retirement           81,067.70         304.20              240.30                63.90                  0.38%
 Services
 Federal
Employees            48,099.11          68.43               68.43                   -                   0.14%
  Health
 Benefits

                               FY 2015 Overpayments Recaptured Summary5
                                             ($ in millions)
                                    FY 2015 Amount Identified for FY 2015 IP Amount Recovered
              Program                        Recovery

                                                      227.1                                     211.9
       Retirement Services

Federal Employees Health                                 68.4                                   35.0
         Benefits




4
    Data collected from Table 12 “Improper Payment Reduction Outlook” on page 128 of OPM’s FY 2015 AFR.
5
    Data collected from Table 13 “Improper Payment Root Cause Category Matrix ($ in millions)” on page 129 of
    OPM’s FY 2015 AFR.

                                                     3                                   Report No. 4A-CF-00-16-026
Status of Previous Audit Recommendations

This is the fifth audit of OPM’s improper payments reporting. During the audit on OPM’s FY
2014 Improper Payments Reporting for Compliance with the Improper Payments Elimination
and Recovery Act of 2010, Report No. 4A-CF-00-15-025, we determined that OPM’s reporting
of improper payments was in compliance with IPERA. However, in that report we issued four
recommendations where OPM could improve on its oversight controls over improper payments
reporting. Based on the testing performed in this year’s audit, we determined that the following
recommendations are closed:

       Recommendation 2: We recommended that in the FY 2015 AFR, OPM correct all the
       errors identified in the FY 2014 AFR tables 12, 13, 14, and the Death Match Statistics
       table.

       Recommendation 3: We recommended that Retirement Services develop policies and
       procedures that include a discussion of sufficient documentation retention to support the
       improper payments data reported in OPM’s AFR.

The remaining two recommendations are still open, as outlined in the Findings and
Recommendations section of this report.




                                             4                             Report No. 4A-CF-00-16-026
II. OBJECTIVE, SCOPE, AND METHODOLOGY

Objective
The objective of our audit was to determine if OPM is compliant with the Improper Payment
Information Act, as amended by IPERIA, for FY 2015.

The recommendations included in this final report address the objective.

Scope and Methodology
We conducted this performance audit in accordance with generally accepted government
auditing standards as established by the Comptroller General of the United States. These
standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to
provide a reasonable basis for our findings and conclusions based on our audit objective.

The scope of our audit covered OPM’s FY 2015 improper payments reporting in OPM’s AFR.
We performed our audit fieldwork from March 10 through April 14, 2016, at the OPM
headquarters, located in Washington, D.C.

To accomplish our audit objective noted above, we:

        •	 Reviewed OPM’s website to ensure that the AFR was published;
        •	 Reviewed and analyzed FY 2015 risk assessments conducted by OPM’s Office of the
           Chief Financial Officer (OCFO) to determine if their methodology was logical and if
           the results were valid;
        •	 Analyzed OPM’s corrective actions to address the open audit recommendations
           identified in the FY 2013 and FY 2014 Improper Payments Reporting final audit
           reports;
        •	 Reviewed and analyzed supporting documentation to ensure the offices of Healthcare
           and Insurance and Retirement Services’ improper payments estimates methodologies
           were logical and recalculated the improper payments estimates to verify the estimates
           reported;
        •	 Reviewed Healthcare and Insurance and Retirement Services’ corrective actions in
           the AFR to ensure they discussed robust and effective corrective actions to reduce
           improper payments;
        •	 Compared OPM’s FY 2014 AFR’s projected improper payments estimate for
           FY 2015 to OPM’s FY 2015 AFR’s actual improper payment rate to ensure reduction
           targets for Healthcare and Insurance and Retirement Services were met;
        •	 Reviewed Healthcare and Insurance and Retirement Services’ improper payments
           estimates to determine if the gross improper payment rate was less than 10 percent in
           the AFR;

                                             5	                             Report No. 4A-CF-00-16-026
        •	 Obtained and reviewed source documentation for all numerical data on improper
           payments as documented in the AFR tables;
        •	 Assessed the reasonableness of OPM’s plan to recapture improper payments; and
        •	 Interviewed program representatives from the OCFO, Healthcare and Insurance and
           Retirement Services.

In planning our work and gaining an understanding of the internal controls over OPM’s improper
payments reporting process, we considered, but did not rely on, OPM’s internal control structure
to the extent necessary to develop our audit procedures. These procedures were mainly
substantive in nature. We gained an understanding of management procedures and controls to
the extent necessary to achieve our audit objectives. The purpose of our audit was not to provide
an opinion on internal controls but merely to evaluate controls over the improper payments
reporting.

Our audit included such tests and analysis of OPM’s improper payments reporting process;
including documented policies and procedures; numerical data and narratives reported in the
AFR; and other applicable information, as we considered necessary under the circumstances.
The results of our review and testing indicate that with respect to the items reviewed, OPM is not
in compliance with IPERIA’s improper payments reporting for two requirements. In addition,
OPM could strengthen its controls over its improper payments reporting process for two areas.

We did not sample improper payments for testing. In conducting the audit, we relied to varying
degrees on computer generated data. Due to the nature of the audit, we did not verify the
reliability of the data generated by the systems involved. However, while utilizing the computer-
generated data during our audit, nothing came to our attention to cause us to doubt its reliability.
We believe that the data was sufficient to achieve our audit objective.




                                              6	                             Report No. 4A-CF-00-16-026
III. AUDIT FINDINGS AND RECOMMENDATIONS

 The sections below detail the results of our audit on OPM’s FY 2015 improper payments
 reporting for compliance with IPERIA. Recommendation 4 is rolled forward from the audit of
 OPM’s FY 2014 Improper Payments Reporting for compliance with IPERA. In addition,
 recommendation 5 is rolled forward from the audit of OPM’s FY 2013 and FY 2014 Improper
 Payments Reporting for compliance with IPERA.

 1. Non-Compliance

     A. Improper Payment Estimates’ Root Causes

     We found that OPM did not properly categorize the root causes of the retirement benefits
     program’s improper payments in Table 13 of OPM’s FY 2015 AFR.

     On October 20, 2014, OMB established new categories6 for reporting improper payments to
     provide more granularity on improper payments estimates, which leads to agencies having
     more effective corrective actions at the program level. Reporting improper payments
     estimates based on the following categories of root causes is required for FY 2015 reporting
     and beyond:

                    Program Design or Structural Issue;
                    Inability to Authenticate Eligibility;                  OPM inaccurately
                    Failure to Verify: Death Data;                         categorized improper
                    Failure to Verify: Financial Data;                   payments estimates’ root
                    Failure to Verify: Excluded Party Data;                 causes in the AFR.
                    Failure to Verify: Prisoner Data;
                    Failure to Verify: Other Eligibility Data (explain);
                    Administrative or Process Error Made by: Federal Agency;
                    Administrative or Process Error Made by: State or Local Agency;
                    Administrative or Process Error Made by: Other Party (e.g., participating
                     lender, health care provider, or any other organization administering Federal
                     dollars);

                    Medical Necessity;
                    Insufficient Documentation to Determine; and
                    Other Reason (explain).

     OMB defines “Administrative or Process Errors” as errors caused by incorrect data entry,
     classifying, or processing of applications or payments. For example, an eligible beneficiary

 6
  OMB Memorandum M-15-02, Appendix C to Circular No. A-123, pages 25 through 28, requires agencies to report
 improper payment estimates based on 13 categories and defines each category.

                                                  7                                Report No. 4A-CF-00-16-026
receives a payment that is too high or too low due to a data entry mistake, or an agency enters
an incorrect invoice amount into its financial system. These types of errors can be made by a
Federal agency; State or local agency; and other parties, such as an organization
administering Federal dollars that is not a Federal or State agency.

OPM attributes all overpayments and underpayments made by its retirement benefits
program to “Administrative or Process Errors Made By: Federal Agency.” Based on our
review of Retirement Services’ corrective actions in the AFR, the improper payments root
causes unquestionably encompass more than “administrative or process errors” and should be
reported under other categories. We found that OPM should have used the following
categories:

              “Inability to Authenticate Eligibility” for the improper payments related to the
               Disability Earnings Survey and Match because there is no database tracking
               for annuitants’ income prior to issuance of the annuity.
              “Failure to Verify: Death Data” for the improper payments related to Delayed
               Reporting. For example, when a family member fails to report the death
               timely to OPM, it should be categorized under Failure to Verify Death Data.
              “Other Reason” (explain) for the improper payments related to fraud.

By OPM using the administrative or process errors as a catch-all category to identify the
source of its improper payments, 1) OPM is defeating the purpose of using this new
classification system, which should serve as a guidepost in developing and implementing
effective internal controls to reduce improper payments to the lowest level possible; 2) OPM
cannot have effective corrective actions without identifying the root cause of improper
payments; and 3) users of the improper payments data in the AFR are not obtaining a
complete and accurate picture of OPM’s improper payments.

Recommendation 1:

We recommend that OPM implement controls to identify and evaluate the improper payment
estimates root causes, to ensure that the root causes for the retirement benefits program’s
improper payments are properly categorized in OPM’s annual Agency Financial Report.

OPM’s Response:

OCFO concurs with the recommendation; however, “[OCFO] do[es] not believe that
categorization of improper payments warrants non-compliance with IPERA. While we do not
agree with the [Office of the Inspector General]’s interpretation of the criteria for non-
compliance as it relates to the Improper Payment Estimate portion of the AFR, [Retirement
Services] will continue to evaluate the criteria and ensure the placement of data in the

                                         8                              Report No. 4A-CF-00-16-026
   categories is appropriate. As noted, the improper payments have been reported accurately
   but OPM categorization methodology needs to be improved.”

   OIG’s Reply:

   While we agree that Retirement Services did accurately report the improper payments
   estimate totals in Table 13 of the AFR, our analysis determined that Retirement Services
   failed to fully utilize OMB’s improper payments estimates categories. In addition, based on
   the use of only the “Administrative or Process Errors Made By: Federal Agency” category to
   report the root cause of its retirement benefits improper payments, OPM has not determined
   and reported the full extent to which improper payments occur and reasonably assure that
   appropriate actions are taken to reduce them.

B. Risk Assessments

   For the FY 2015 AFR, the OCFO conducted risk assessments of OPM programs to include
   Background Investigations, Federal Employees’ Group Life Insurance, Payroll, Travel Card
   and the Vendor Payment Process programs; however, we identified the following issues with
   the risk assessments:

       1.	 The risk assessments’ methodology was flawed. We found that:

           a.	 The OCFO did not include all of the nine required risk factors that should be
               assessed during a risk assessment. Specifically, “[w]hether payments or
               payment eligibility decisions are made outside of the agency, for example, by a
               State or local government, or a regional Federal office” was not included in any
               of the assessments.

           b.	 The scoring methodology for the risk assessments contained the following errors:

               	 Question 10, which discusses the risk of employee turnover in the program,
                  had a duplicate rating scale. The definitions for both the three and five
                  scoring options stated, “major turnover in key management or staff.” Each
                  scoring option should have its own definition.
               	 The scoring options in Question 7, which discusses the level of experience
                  for the programs, were not logical. For example, the score point value for
                  the highest level of maturity had the highest score value; however, it should
                  have the lowest score value.




                                            9	                            Report No. 4A-CF-00-16-026
       2.	 When reviewing the risk assessment results for the Background Investigations, Travel
           Card, Vendor Payment Process, Federal Employees’ Group Life Insurance, and
           Payroll programs, we found assessments with no or insufficient documentation to
           support the results reported in OPM’s FY 2015 AFR. Details regarding the missing
           and insufficient documentation were provided separately from this report.

    OMB Memorandum M-15-02, Circular A-123, Appendix C, states that “[t]he agency is
    responsible for maintaining the documentation to demonstrate that the following steps (if
    applicable) were satisfied. Step 1: Review all programs and activities and identify those that
    are susceptible to significant improper payments.”

    OMB Memorandum M-15-02, Circular A-123, Appendix C, also states that “[a]t a minimum,
    agencies shall take into account the … [nine] risk factors likely to contribute to improper
    payments, regardless of which method (quantitative or qualitative) is used… .”

    The U.S. Government Accountability Ofiice’s (GAO) Standards for Internal Control in the
    Federal Government states that “[m]anagement clearly documents internal control and all
    transactions and other significant events in a manner that allows the documentation to be
    readily available for examination. … Documentation and records are properly managed and
    maintained.”

    Due to the lack of experienced staff, inadequate resources, and missing and incomplete
    supporting documentation to properly conduct risk assessments of OPM’s programs, the
    OCFO did not fulfill the minimum OMB systematic method requirements in compliance with
    IPERIA. In addition, without proper documentation to support the risk assessment results, it
    is difficult to confirm the accuracy of the results. Therefore, there is an increased likelihood
    that OPM reported inaccurate results in the FY 2015 AFR.
 
    Recommendation 2:

    We recommend that the OCFO revise the risk assessment methodology to ensure the score
    point values are clearly defined and logical, and ensure that all required risk factors are
    included in the risk assessment tool (i.e., the Improper Payment Information Act Scoring
    Guide) used to conduct the assessment over OPM’s programs.

    OPM’s Response:

    OCFO concurs with the recommendation. “[OCFO has] revised the risk assessment
    methodology to ensure that the score point values are clearly defined and that all required
    risk factors are included in the risk assessment tool.”



                                              10 	                           Report No. 4A-CF-00-16-026
   Recommendation 3:

   We recommend that the OCFO re-evaluate the risk assessments performed over the
   Background Investigations, Federal Employees’ Group Life Insurance, Vendor Payments,
   Travel Card, and Payroll programs to ensure that programs are not susceptible to significant
   improper payments.

   OPM’s Response:

   OCFO concurs with the recommendation. “[OCFO] will re-evaluate the risk assessments
   performed over the Background Investigations, FEGLI, Vendor Payments, Travel Card, and
   Payroll programs.”

   Recommendation 4 (Rolled-Forward from FY14):

   We recommend that the OCFO strengthen their procedures to ensure that the improper
   payments information reported in OPM’s Agency Financial Report is supported, reviewed,
   and validated for accuracy prior to the information’s inclusion in the Agency Financial
   Report.

   OPM’s Response:

   OCFO concurs with the recommendation. “[OCFO] will revise the [OCFO’s Improper
   Payments] Work Instructions in response to this recommendation.”

2. Oversight Controls

  Improper Payments Information in the Agency Financial Report Was Inaccurately
  Reported

  During our audit we identified inaccuracies between what was reported in the FY 2015 AFR
  and the supporting documentation that we obtained from the OCFO.

  We noted that the results of the Retirement Services’ status of internal controls in Table 14,
  Status of Internal Controls, differed from the results shown on the OCFO’s Retirement
  Services Internal Control Review over Payments as follows:

          The Risk Assessment category should have been rated a 4 instead of 3;
          The Information and Communication category should have been rated a 3 instead of
           4; and
          The Monitoring category should have been rated a 4 instead of 3.


                                             11                             Report No. 4A-CF-00-16-026
The OCFO’s assessment of internal controls over payments process includes a two level
review of Retirement Services’ information prior to reporting in the AFR.

GAO’s Standards for Internal Control in the Federal Government states that “Control
activities are the policies, procedures, techniques, and mechanisms that enforce
management’s directives.”

Due to staffing shortages, the OCFO did not complete a second level review of the
information reported in the AFR. Without proper controls over its improper payments
reporting process, OPM may continue to report inaccurate improper payments data in its
AFR.

Recommendation 5 (Rolled-Forward from FY 2013 and FY 2014):

We recommend that the OCFO strengthen its oversight controls over the improper payments
data reported in the Agency Financial Report to ensure that it accurately reflects supporting
data.

OPM’s Response:

OCFO concurs with the recommendation. “[OCFO] will revise [OCFO’s Improper
Payments Work Instructions] that will include a two-tier review of the improper payment
data.”

Recommendation 6:

We recommend that in the FY 2016 Agency Financial Report, OCFO correct all of the errors
identified in the FY 2015 Agency Financial Report Table 14, Status of Internal Controls.

OPM’s Response:

OCFO concurs with the recommendation. “[OCFO] will footnote the correction in FY 2016
AFR.”




                                         12                            Report No. 4A-CF-00-16-026
IV. MAJOR CONTRIBUTORS TO THIS REPORT

INTERNAL AUDITS GROUP

         , Auditor

          , Auditor

         , Lead Auditor

          , Auditor

           , Auditor-In-Charge




          , Senior Team Leader


                , Group Chief 





                                  13   Report No. 4A-CF-00-16-026
 

 

 

 

 

 

 

    MEMORANDUM FOR: MICHAEL ESSER

                    Assistant Inspector General for Audits


                              Chief, Internal Audits Group

    FROM:                     DENNIS D. COLEMAN
                              Chief Financial Officer

    SUBJECT:                  OIG DRAFT AUDIT REPORT: Audit of the U.S. Office of Personnel
                              Management’s Fiscal Year 2015 Improper Payments Reporting
                              (Report Number – 4A-CF-00-16-026), dated April 22, 2016


    Thank you for the opportunity to respond to your draft audit report on OPM’s reporting on
    improper payments under the Improper Payments Elimination and Recovery Improvement Act
    of 2012 (IPERIA). Reducing improper payments is an important priority for the Administration
    and OPM is firmly committed to this priority. We recognize the benefit from the external
    evaluation conducted by your office and the important part it plays in improving our program
    and reporting efforts.

    OPM has prioritized reducing improper payments as one of its key efforts to reduce waste, fraud,
    and abuse and inefficiencies in Federal programs. OPM continues to make progress in efforts to
    reduce the extent and rate of improper payments and to recover an increasing percentage of
    improper payments. Collectively, the Office of the Chief Financial Officer (CFO), the
    Retirement Services (RS) and Healthcare and Insurance (HI), organizations believe our
    cumulative efforts over the past few years have resulted in significant improvements in the OPM
    improper payments program. The Improper Payments Working Group (IPWG) continues to be
    the focal point for coordinating these improvements in our program.

    We concur with all six recommendations in the draft report as discussed below. We are
    providing technical comments on some of the factual information set forth in your draft report
    and ask that those changes be incorporated in your final report.




                                                                    Report No. 4A-CF-00-16-026
As noted in your draft report, you assessed OPM compliance under six specific criteria set forth
in !PERIA and subsequent 0MB guidance. The conclusion in the draft report is that we are non­
compliant based on not meeting two of the six criteria. !PERIA requires the OIG to repo1t
agencies as non-compliant if they do not meet, in their entirety, all six criteria. We disagree with
the repmt's conclusion that we are non-compliant with !PERIA due to not meeting the improper
payment estimate criteria. OPM published improper payment estimates for all programs and
activities identified as susceptible to significant improper payments, specifically, the Retirement

Program and the Federal Employees Health Benefit Program. However, the OIG has concluded
that this ctiterion was not met due to the fact that it disagrees with how OPM categorized its
improper payment estimates. While we agree that improvements are needed in how we
categorize the root causes for improper payments, we do not agree that it constitutes non­
compliance with the criteria, and therefore IPERIA as a whole.

Regarding the weaknesses identified in our risk assessment process, we are in agreement that
these weaknesses make us non-compliant with the risk assessment criteria, and therefore non­
compliant with !PERIA. However, notwithstanding the fact that we do not believe the nature of
the weaknesses significantly increases our risk for improper payments, we will make the
necessary improvements in our risk assessment process in FY 2016.

Thank you again for the opportunity to respond to the draft report. We will submit a corrective
action plan accordingly.

Responses to the individual recommendations and technical comments follow:

Recommendation 1

W e recommend that OPM implement controls to include but not limited to identifying and
evaluating the improper payment estimates root causes, to ensure that the root causes for the
Retirement Benefits Program's improper payments are properly categorized in OPM's annual
AFR.

Management Response to Recommendation 1

We concur with Recommendation 1 as it relates to properly categorizing the root causes for the
retirement benefits program's improper payments. However, we do not believe that
categorization of improper p,a yments warrants non-compliance with IPERA. While we do not
agree with the OIG's interpretation of the criteria for non-compliance as it relates to the
Improper Payment Estimate portion of the AFR, RS will continue to evaluate the criteria and
ensure the placement of data in the categories is appropriate. As noted, the improper payments
have been reported accurately but OPM categorization methodology needs to be improved.




                                                                           Report No. 4A-CF-00-16-026
There is not a material misstatement of the improper payments. Specifically, RS reported out the
Im.proper Payments in the Administrative Category in Table 13 because we found this to be the
most appropriate matrix cell that aligned to our supporting documentation. The OIG found our
improper payment estimate to be con-ect but asserts that users of the improper payment data in
the AFR are not obtaining an accurate picture of OPM's improper payments and we do not
agree. The body of the AFR in its entirety provides a detailed depiction of improper payments,
their causes and our actions taken over the past year. Again, we agree that improvements can be
made in the reporting of Table 13 which includes identifying and collecting data going forward.
This analysis will include engaging OPM's CIO and CFO along with The United States
Treasury. There will need to be discussion on avenues for extracting and splitting data numbers
aligning to the root categories identified in Table 13.

Recommendation 2

We recommend that OCFO revise the risk assessment methodology to 1) ensure the score point
values are clearly defined and logical and 2} ensure that all required risk factors are included in
the risk assessment tool (i.e., IPIA Scoring Guide) used to conduct the assessment over OPM's
programs.

Management Response to Recommendation 2

We concur with Recommendation 2 and have revised the risk assessment methodology to ensure
that the score point values are clearly defined and that all required risk factors are included in the
risk assessment tool.

OIG Finding: OIG notes that the risk assessments' methodology was flawed ... OCFO did not
include all the nine required risk factors that should be assessed.

Management Response: We disagree that OCFO did not include all nine required risk factors.
We considered all nine factors in the risk assessment but one factor was not documented because
we deemed it not applicable to OPM, i.e., is risk score was zero. However, we have revised the
risk assessment to ensure that all nine risk factors are properly documented.

OIG Finding: OIG notes that without proper documentation to support the risk assessment
results, there is an increased likelihood that Ol>M reported inaccurate result in the FY 2015 AFR.

Management Response: We disagree that lack of proper documentation to support the risk
assessment results "increased the likelihood" that OPM reported inaccurate results. We request
that the effect of the related finding be changed to indicate that the lack of documentation makes
it difficult to confirm the accuracy ofthe results.




                                                                              Report No. 4A-CF-00-16-026
Recommendation 3

We recommend that OCFO re-evaluate the risk assessments performed over the Background
Investigations, FEOLI, Vendor Payments, Travel Card, Payroll programs to ensure programs are
not susceptible to significant improper payments.

Management Response to Recommendation 3

We concur with Recommendation 3. We will re-evaluate the risk assessments perfonned over
the Background Investigations, FEGLI, Vendor Payments, Travel Card, and Payroll programs.

Recommendation 4 (Rolled-Forward from FY 14)

We recommend that CFO strengthen their procedures to ensure that the improper payments
information reported in the OPM's AFR is supported, reviewed and validated for accuracy prior
to the information inclusion in the AFR.

Management Response to Recommendation 4

We concur with this recommendation and will revise the CFO Work Instruction in response to
this recommendation.

Recommendation 5 (Rolled-Forward from FY 2013 and FY 2014)

We recommend that OCFO strengthen its oversight controls over the improper payments data
reported in the Agency Financial Repo1t to ensurn that it accurately reflects suppo1iing data.

Management Response to Recommendation 5

OPM concurs with Recommendation 5. We will revise our work instruction that will include a
two-tier review of the improper payment data.




                                                                          Report No. 4A-CF-00-16-026
Recommendation 6

We recommend that in the FY 2016 AFR, OPM correct all of the errors identified in the FY
2015 AFR Table 14, Status ofInternal Controls.

Management Response to Recommendation 6

OPM concurs with this recommendation and will footnote the correction in FY 2016 AFR.


cc:   Kenneth Zawodany
      Associate Director
      Retirement Services

      John O'Brien,
      Associate Director
      Healthcare and Insurance




                                                                   Report No. 4A-CF-00-16-026
           Report Fraud, Waste, and Mismanagement

                              Fraud, waste, and mismanagement in Government
                             concerns everyone: Office of the Inspector General
                             staff, agency employees, and the general public. We
                                actively solicit allegations of any inefficient and
                                 wasteful practices, fraud, and mismanagement
                              related to OPM programs and operations. You can
                                     report allegations to us in several ways:



       By Internet:                http://www.opm.gov/our-inspector-general/hotline-to-report-fraud-waste-
                                   or-abuse


        By Phone:                  Toll Free Number:                              (877) 499-7295
                                   Washington Metro Area:                         (202) 606-2423


           By Mail:                Office of the Inspector General
                                   U.S. Office of Personnel Management
                                   1900 E Street, NW
                                   Room 6400
                                   Washington, DC 20415-1100



                                                                                                                    

                                                         -- CAUTION --

This audit report has been distributed to Federal officials who are responsible for the administration of the audited program. This audit
report may contain proprietary data which is protected by Federal law (18 U.S.C. 1905). Therefore, while this audit report is available
under the Freedom of Information Act and made available to the public on the OIG webpage (http://www.opm.gov/our-inspector-general),
caution needs to be exercised before releasing the report to the general public as it may contain proprietary information that was redacted
from the publicly distributed copy.