U.S. OFFICE OF PERSONNEL MANAGEMENT OFFICE OF THE INSPECTOR GENERAL OFFICE OF AUDITS Final Audit Report AUDIT OF THE U.S. OFFICE OF PERSONNEL MANAGEMENT’S FISCAL YEAR 2015 IMPROPER PAYMENTS REPORTING Report Number 4A-CF-00-16-026 May 11, 2016 CAUTION This audit report has been distributed to Federal officials who are responsible for the administration of the audited program. This audit report may contain proprietary data which is protected by Federal law (18 U.S.C. 1905). Therefore, while this audit report is available under the Freedom of Information Act and made available to the public on the OIG webpage (http://www.opm.gov/our-inspector-general), caution needs to be exercised before releasing the report to the general public as it may contain proprietary information that was redacted from the publicly distributed copy EXECUTIVE SUMMARY Audit of the U.S. Office of Personnel Management’s Fiscal Year 2015 Improper Payments Reporting Report No. 4A-CA-00-16-026 May 11, 2016 Why Did We Conduct the Audit? What Did We Find? The objective of our audit was to We determined that OPM is not in compliance with IPERIA determine if the U.S. Office of requirements for FY 2015. Specifically, we identified the following: Personnel Management (OPM) is Performance compliant with the Improper Payments and Accountability Information Act, as amended by the Report/ Agency Improper Corrective Improper Payments Elimination and Financial Risk Payment Action Reduction Recovery Total Non- Report Assessment Estimate Plan Targets Efforts Compliances Recovery Improvement Act (IPERIA), OPM for Fiscal Year (FY) 2015. Compliance Non compliance What Did We Audit? In addition, we identified an area where OPM can improve on its The Office of the Inspector General has oversight controls over improper payments reporting. Improper completed a performance audit on payments information in the Agency Financial Report was OPM’s FY 2015 improper payments inaccurately reported. Specifically, we identified several reporting for compliance with IPERIA. inaccuracies between what was reported in the FY 2015 Agency Our audit fieldwork was conducted from Financial Report Table 14 and the supporting documentation that we March 10 through April 14, 2016, at obtained from the program office. OPM headquarters, located in Washington D.C. ____________________________ Michael R. Esser Assistant Inspector General for Audits i ABBREVIATIONS AFR Agency Financial Report FY Fiscal Year GAO U.S. Government Accountability Office IPERA Improper Payments Elimination and Recovery Act of 2010 IPERIA Improper Payments Elimination and Recovery Improvement Act of 2012 OCFO Office of the Chief Financial Officer OMB U.S. Office of Management and Budget OPM U.S. Office of Personnel Management PAR Performance and Accountability Report ii TABLE OF CONTENTS Page EXECUTIVE SUMMARY ......................................................................................... i ABBREVIATIONS ..................................................................................................... ii I. BACKGROUND ..........................................................................................................1 II. OBJECTIVE, SCOPE, AND METHODOLOGY ....................................................5 III. AUDIT FINDINGS AND RECOMMENDATIONS.................................................7 1. Non-Compliance .....................................................................................................7 A. Improper Payment Estimates’ Root Causes.......................................................7 B. Risk Assessments...............................................................................................9 2. Oversight Controls ..................................................................................................11 Improper Payments Information in the Agency Financial Report Was Inaccurately Reported ..................................................................11 IV. MAJOR CONTRIBUTORS TO THIS REPORT ..................................................13 APPENDIX (OPM’s response to our draft report, dated April 29, 2016) REPORT FRAUD, WASTE, AND MISMANAGEMENT I. BACKGROUND This final audit report details the findings, conclusions, and recommendations resulting from our performance audit of the U.S. Office of Personnel Management’s (OPM) Fiscal Year (FY) 2015 Improper Payments Reporting. The audit was performed by OPM’s Office of the Inspector General, as authorized by the Inspector General Act of 1978, as amended. On July 22, 2010 and January 10, 2013, the President signed into law the Improper Payments Elimination and Recovery Act of 2010 (IPERA) and the Improper Payments Elimination and Recovery Improvement Act of 2012 (IPERIA), respectively, which amended the Improper Payments Information Act of 2002. IPERIA redefined the definition of “significant improper payments” and strengthened executive branch agency reporting requirements. The U.S. Office of Management and Budget (OMB) has issued improper payments guidance to assist agencies in implementing the laws, including OMB Circular A-123 Appendix C, Management's Responsibility for Internal Controls, and OMB Circular A-136, Financial Reporting Requirements. Routine updates are issued by OMB, including an update to OMB Circular A-123 through Memorandum M-15-02 on October 20, 2014, and a revision to OMB Circular A-136 on August 4, 2015. An agency’s program is deemed susceptible to significant improper payments1 if the total amount of overpayments plus underpayments in the program exceeds both 1.5 percent of program outlays and $10,000,000 of all program or activity payments made during the fiscal year reported or, $100,000,000 regardless of improper payments percentage of total program outlays. Under OMB guidance, agencies must have performed the following with respect to improper payments reporting: a. “[p]ublished an AFR [Agency Financial Report] or PAR [Performance and Accountability Report] for the most recent fiscal year and posted that report and any accompanying materials required by OMB on the agency website; b. [c]onducted a program specific risk assessment for each program or activity that conforms with Section 3321 note of Title 31 U.S.C. (if required); c. [p]ublished improper payment estimates for all programs and activities identified as susceptible to significant improper payments under its risk assessment (if required); d. [p]ublished programmatic corrective action plans in the AFR or PAR (if required); 1 An improper payment is any payment that should not have been made or that was made in an incorrect amount under statutory, contractual, administrative, or other legally applicable requirements. 1 Report No. 4A-CF-00-16-026 e. [p]ublished, and is meeting2, annual reduction targets for each program assessed to be at risk and estimated for improper payments (if required and applicable); and f. [r]eported a gross improper payment rate of less than 10 percent for each program and activity for which an improper payment estimate was obtained and published in the AFR or PAR.” Agencies are also required to: categorize their improper payment estimates based on OMB’s new improper payment categories; perform risk assessments on all low risk programs at least once every three years to assess their risk for improper payments; develop indicators of improper payments for programs with the most egregious cases, compliance for which is determined by OMB; identify the accountable official that oversees efforts to reduce improper payments for high-priority programs; describe alternative improper payments measurements; expand payment recapture audits to all types of payments and activities with more than $1 million in annual outlays if cost effective; improve corrective action plans to include incorporating lessons learned; recover improper payments by conducting recovery audits on programs that expend $1 million or more annually if conducting such audits is cost-effective; distribute funds recovered through payment recapture audits for authorized purposes; establish internal controls to reduce improper payment rates; and use the Do Not Pay List3 to verify eligibility for Federal payments in order to help reduce and eliminate payment errors before they occur. If an agency does not meet one or more of these requirements, it is not compliant with IPERA and IPERIA. Each agency’s Inspector General is required to review improper payments reporting in the AFR or PAR to determine compliance with IPERIA. OMB requires that the Inspector General review the agency’s annual AFR or PAR, which includes evaluating the accuracy and completeness of agency reporting, and evaluating agency performance in reducing and 2 A program will have met a reduction target if the improper payment rate for that program in the current year falls within plus or minus 0.1 percentage points of the reduction target set in the previous year's AFR or PAR. 3 The “Do Not Pay List” is an initiative to prevent Federal agencies from making certain improper payments by directing agencies to review current pre-payment and pre-award procedures to ensure the recipients are eligible. 2 Report No. 4A-CF-00-16-026 recapturing improper payments. In addition, the OIG is required to determine if the agency’s corrective action plans are robust and focused on the appropriate root causes of improper payments, effectively implemented, and prioritized within the agency, to allow it to meet reduction targets. The Inspector General is required to complete its review and determination within 180 days of OPM’s AFR publication. Two of OPM’s earned benefit programs, Retirement Services and the Federal Employees Health Benefits Program, are by definition susceptible to significant improper payments. OPM’s reported improper payments and overpayments recaptured for FY 2015 are summarized in the following tables below. FY 2015 Improper Payments Summary4 Gross Total 2015 Improper Program Improper Overpayments Underpayments Outlays Payments Payments ($ millions) ($ millions) ($ millions) Percent ($ millions) Retirement 81,067.70 304.20 240.30 63.90 0.38% Services Federal Employees 48,099.11 68.43 68.43 - 0.14% Health Benefits FY 2015 Overpayments Recaptured Summary5 ($ in millions) FY 2015 Amount Identified for FY 2015 IP Amount Recovered Program Recovery 227.1 211.9 Retirement Services Federal Employees Health 68.4 35.0 Benefits 4 Data collected from Table 12 “Improper Payment Reduction Outlook” on page 128 of OPM’s FY 2015 AFR. 5 Data collected from Table 13 “Improper Payment Root Cause Category Matrix ($ in millions)” on page 129 of OPM’s FY 2015 AFR. 3 Report No. 4A-CF-00-16-026 Status of Previous Audit Recommendations This is the fifth audit of OPM’s improper payments reporting. During the audit on OPM’s FY 2014 Improper Payments Reporting for Compliance with the Improper Payments Elimination and Recovery Act of 2010, Report No. 4A-CF-00-15-025, we determined that OPM’s reporting of improper payments was in compliance with IPERA. However, in that report we issued four recommendations where OPM could improve on its oversight controls over improper payments reporting. Based on the testing performed in this year’s audit, we determined that the following recommendations are closed: Recommendation 2: We recommended that in the FY 2015 AFR, OPM correct all the errors identified in the FY 2014 AFR tables 12, 13, 14, and the Death Match Statistics table. Recommendation 3: We recommended that Retirement Services develop policies and procedures that include a discussion of sufficient documentation retention to support the improper payments data reported in OPM’s AFR. The remaining two recommendations are still open, as outlined in the Findings and Recommendations section of this report. 4 Report No. 4A-CF-00-16-026 II. OBJECTIVE, SCOPE, AND METHODOLOGY Objective The objective of our audit was to determine if OPM is compliant with the Improper Payment Information Act, as amended by IPERIA, for FY 2015. The recommendations included in this final report address the objective. Scope and Methodology We conducted this performance audit in accordance with generally accepted government auditing standards as established by the Comptroller General of the United States. These standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. The scope of our audit covered OPM’s FY 2015 improper payments reporting in OPM’s AFR. We performed our audit fieldwork from March 10 through April 14, 2016, at the OPM headquarters, located in Washington, D.C. To accomplish our audit objective noted above, we: • Reviewed OPM’s website to ensure that the AFR was published; • Reviewed and analyzed FY 2015 risk assessments conducted by OPM’s Office of the Chief Financial Officer (OCFO) to determine if their methodology was logical and if the results were valid; • Analyzed OPM’s corrective actions to address the open audit recommendations identified in the FY 2013 and FY 2014 Improper Payments Reporting final audit reports; • Reviewed and analyzed supporting documentation to ensure the offices of Healthcare and Insurance and Retirement Services’ improper payments estimates methodologies were logical and recalculated the improper payments estimates to verify the estimates reported; • Reviewed Healthcare and Insurance and Retirement Services’ corrective actions in the AFR to ensure they discussed robust and effective corrective actions to reduce improper payments; • Compared OPM’s FY 2014 AFR’s projected improper payments estimate for FY 2015 to OPM’s FY 2015 AFR’s actual improper payment rate to ensure reduction targets for Healthcare and Insurance and Retirement Services were met; • Reviewed Healthcare and Insurance and Retirement Services’ improper payments estimates to determine if the gross improper payment rate was less than 10 percent in the AFR; 5 Report No. 4A-CF-00-16-026 • Obtained and reviewed source documentation for all numerical data on improper payments as documented in the AFR tables; • Assessed the reasonableness of OPM’s plan to recapture improper payments; and • Interviewed program representatives from the OCFO, Healthcare and Insurance and Retirement Services. In planning our work and gaining an understanding of the internal controls over OPM’s improper payments reporting process, we considered, but did not rely on, OPM’s internal control structure to the extent necessary to develop our audit procedures. These procedures were mainly substantive in nature. We gained an understanding of management procedures and controls to the extent necessary to achieve our audit objectives. The purpose of our audit was not to provide an opinion on internal controls but merely to evaluate controls over the improper payments reporting. Our audit included such tests and analysis of OPM’s improper payments reporting process; including documented policies and procedures; numerical data and narratives reported in the AFR; and other applicable information, as we considered necessary under the circumstances. The results of our review and testing indicate that with respect to the items reviewed, OPM is not in compliance with IPERIA’s improper payments reporting for two requirements. In addition, OPM could strengthen its controls over its improper payments reporting process for two areas. We did not sample improper payments for testing. In conducting the audit, we relied to varying degrees on computer generated data. Due to the nature of the audit, we did not verify the reliability of the data generated by the systems involved. However, while utilizing the computer- generated data during our audit, nothing came to our attention to cause us to doubt its reliability. We believe that the data was sufficient to achieve our audit objective. 6 Report No. 4A-CF-00-16-026 III. AUDIT FINDINGS AND RECOMMENDATIONS The sections below detail the results of our audit on OPM’s FY 2015 improper payments reporting for compliance with IPERIA. Recommendation 4 is rolled forward from the audit of OPM’s FY 2014 Improper Payments Reporting for compliance with IPERA. In addition, recommendation 5 is rolled forward from the audit of OPM’s FY 2013 and FY 2014 Improper Payments Reporting for compliance with IPERA. 1. Non-Compliance A. Improper Payment Estimates’ Root Causes We found that OPM did not properly categorize the root causes of the retirement benefits program’s improper payments in Table 13 of OPM’s FY 2015 AFR. On October 20, 2014, OMB established new categories6 for reporting improper payments to provide more granularity on improper payments estimates, which leads to agencies having more effective corrective actions at the program level. Reporting improper payments estimates based on the following categories of root causes is required for FY 2015 reporting and beyond: Program Design or Structural Issue; Inability to Authenticate Eligibility; OPM inaccurately Failure to Verify: Death Data; categorized improper Failure to Verify: Financial Data; payments estimates’ root Failure to Verify: Excluded Party Data; causes in the AFR. Failure to Verify: Prisoner Data; Failure to Verify: Other Eligibility Data (explain); Administrative or Process Error Made by: Federal Agency; Administrative or Process Error Made by: State or Local Agency; Administrative or Process Error Made by: Other Party (e.g., participating lender, health care provider, or any other organization administering Federal dollars); Medical Necessity; Insufficient Documentation to Determine; and Other Reason (explain). OMB defines “Administrative or Process Errors” as errors caused by incorrect data entry, classifying, or processing of applications or payments. For example, an eligible beneficiary 6 OMB Memorandum M-15-02, Appendix C to Circular No. A-123, pages 25 through 28, requires agencies to report improper payment estimates based on 13 categories and defines each category. 7 Report No. 4A-CF-00-16-026 receives a payment that is too high or too low due to a data entry mistake, or an agency enters an incorrect invoice amount into its financial system. These types of errors can be made by a Federal agency; State or local agency; and other parties, such as an organization administering Federal dollars that is not a Federal or State agency. OPM attributes all overpayments and underpayments made by its retirement benefits program to “Administrative or Process Errors Made By: Federal Agency.” Based on our review of Retirement Services’ corrective actions in the AFR, the improper payments root causes unquestionably encompass more than “administrative or process errors” and should be reported under other categories. We found that OPM should have used the following categories: “Inability to Authenticate Eligibility” for the improper payments related to the Disability Earnings Survey and Match because there is no database tracking for annuitants’ income prior to issuance of the annuity. “Failure to Verify: Death Data” for the improper payments related to Delayed Reporting. For example, when a family member fails to report the death timely to OPM, it should be categorized under Failure to Verify Death Data. “Other Reason” (explain) for the improper payments related to fraud. By OPM using the administrative or process errors as a catch-all category to identify the source of its improper payments, 1) OPM is defeating the purpose of using this new classification system, which should serve as a guidepost in developing and implementing effective internal controls to reduce improper payments to the lowest level possible; 2) OPM cannot have effective corrective actions without identifying the root cause of improper payments; and 3) users of the improper payments data in the AFR are not obtaining a complete and accurate picture of OPM’s improper payments. Recommendation 1: We recommend that OPM implement controls to identify and evaluate the improper payment estimates root causes, to ensure that the root causes for the retirement benefits program’s improper payments are properly categorized in OPM’s annual Agency Financial Report. OPM’s Response: OCFO concurs with the recommendation; however, “[OCFO] do[es] not believe that categorization of improper payments warrants non-compliance with IPERA. While we do not agree with the [Office of the Inspector General]’s interpretation of the criteria for non- compliance as it relates to the Improper Payment Estimate portion of the AFR, [Retirement Services] will continue to evaluate the criteria and ensure the placement of data in the 8 Report No. 4A-CF-00-16-026 categories is appropriate. As noted, the improper payments have been reported accurately but OPM categorization methodology needs to be improved.” OIG’s Reply: While we agree that Retirement Services did accurately report the improper payments estimate totals in Table 13 of the AFR, our analysis determined that Retirement Services failed to fully utilize OMB’s improper payments estimates categories. In addition, based on the use of only the “Administrative or Process Errors Made By: Federal Agency” category to report the root cause of its retirement benefits improper payments, OPM has not determined and reported the full extent to which improper payments occur and reasonably assure that appropriate actions are taken to reduce them. B. Risk Assessments For the FY 2015 AFR, the OCFO conducted risk assessments of OPM programs to include Background Investigations, Federal Employees’ Group Life Insurance, Payroll, Travel Card and the Vendor Payment Process programs; however, we identified the following issues with the risk assessments: 1. The risk assessments’ methodology was flawed. We found that: a. The OCFO did not include all of the nine required risk factors that should be assessed during a risk assessment. Specifically, “[w]hether payments or payment eligibility decisions are made outside of the agency, for example, by a State or local government, or a regional Federal office” was not included in any of the assessments. b. The scoring methodology for the risk assessments contained the following errors: Question 10, which discusses the risk of employee turnover in the program, had a duplicate rating scale. The definitions for both the three and five scoring options stated, “major turnover in key management or staff.” Each scoring option should have its own definition. The scoring options in Question 7, which discusses the level of experience for the programs, were not logical. For example, the score point value for the highest level of maturity had the highest score value; however, it should have the lowest score value. 9 Report No. 4A-CF-00-16-026 2. When reviewing the risk assessment results for the Background Investigations, Travel Card, Vendor Payment Process, Federal Employees’ Group Life Insurance, and Payroll programs, we found assessments with no or insufficient documentation to support the results reported in OPM’s FY 2015 AFR. Details regarding the missing and insufficient documentation were provided separately from this report. OMB Memorandum M-15-02, Circular A-123, Appendix C, states that “[t]he agency is responsible for maintaining the documentation to demonstrate that the following steps (if applicable) were satisfied. Step 1: Review all programs and activities and identify those that are susceptible to significant improper payments.” OMB Memorandum M-15-02, Circular A-123, Appendix C, also states that “[a]t a minimum, agencies shall take into account the … [nine] risk factors likely to contribute to improper payments, regardless of which method (quantitative or qualitative) is used… .” The U.S. Government Accountability Ofiice’s (GAO) Standards for Internal Control in the Federal Government states that “[m]anagement clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. … Documentation and records are properly managed and maintained.” Due to the lack of experienced staff, inadequate resources, and missing and incomplete supporting documentation to properly conduct risk assessments of OPM’s programs, the OCFO did not fulfill the minimum OMB systematic method requirements in compliance with IPERIA. In addition, without proper documentation to support the risk assessment results, it is difficult to confirm the accuracy of the results. Therefore, there is an increased likelihood that OPM reported inaccurate results in the FY 2015 AFR. Recommendation 2: We recommend that the OCFO revise the risk assessment methodology to ensure the score point values are clearly defined and logical, and ensure that all required risk factors are included in the risk assessment tool (i.e., the Improper Payment Information Act Scoring Guide) used to conduct the assessment over OPM’s programs. OPM’s Response: OCFO concurs with the recommendation. “[OCFO has] revised the risk assessment methodology to ensure that the score point values are clearly defined and that all required risk factors are included in the risk assessment tool.” 10 Report No. 4A-CF-00-16-026 Recommendation 3: We recommend that the OCFO re-evaluate the risk assessments performed over the Background Investigations, Federal Employees’ Group Life Insurance, Vendor Payments, Travel Card, and Payroll programs to ensure that programs are not susceptible to significant improper payments. OPM’s Response: OCFO concurs with the recommendation. “[OCFO] will re-evaluate the risk assessments performed over the Background Investigations, FEGLI, Vendor Payments, Travel Card, and Payroll programs.” Recommendation 4 (Rolled-Forward from FY14): We recommend that the OCFO strengthen their procedures to ensure that the improper payments information reported in OPM’s Agency Financial Report is supported, reviewed, and validated for accuracy prior to the information’s inclusion in the Agency Financial Report. OPM’s Response: OCFO concurs with the recommendation. “[OCFO] will revise the [OCFO’s Improper Payments] Work Instructions in response to this recommendation.” 2. Oversight Controls Improper Payments Information in the Agency Financial Report Was Inaccurately Reported During our audit we identified inaccuracies between what was reported in the FY 2015 AFR and the supporting documentation that we obtained from the OCFO. We noted that the results of the Retirement Services’ status of internal controls in Table 14, Status of Internal Controls, differed from the results shown on the OCFO’s Retirement Services Internal Control Review over Payments as follows: The Risk Assessment category should have been rated a 4 instead of 3; The Information and Communication category should have been rated a 3 instead of 4; and The Monitoring category should have been rated a 4 instead of 3. 11 Report No. 4A-CF-00-16-026 The OCFO’s assessment of internal controls over payments process includes a two level review of Retirement Services’ information prior to reporting in the AFR. GAO’s Standards for Internal Control in the Federal Government states that “Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives.” Due to staffing shortages, the OCFO did not complete a second level review of the information reported in the AFR. Without proper controls over its improper payments reporting process, OPM may continue to report inaccurate improper payments data in its AFR. Recommendation 5 (Rolled-Forward from FY 2013 and FY 2014): We recommend that the OCFO strengthen its oversight controls over the improper payments data reported in the Agency Financial Report to ensure that it accurately reflects supporting data. OPM’s Response: OCFO concurs with the recommendation. “[OCFO] will revise [OCFO’s Improper Payments Work Instructions] that will include a two-tier review of the improper payment data.” Recommendation 6: We recommend that in the FY 2016 Agency Financial Report, OCFO correct all of the errors identified in the FY 2015 Agency Financial Report Table 14, Status of Internal Controls. OPM’s Response: OCFO concurs with the recommendation. “[OCFO] will footnote the correction in FY 2016 AFR.” 12 Report No. 4A-CF-00-16-026 IV. MAJOR CONTRIBUTORS TO THIS REPORT INTERNAL AUDITS GROUP , Auditor , Auditor , Lead Auditor , Auditor , Auditor-In-Charge , Senior Team Leader , Group Chief 13 Report No. 4A-CF-00-16-026 MEMORANDUM FOR: MICHAEL ESSER Assistant Inspector General for Audits Chief, Internal Audits Group FROM: DENNIS D. COLEMAN Chief Financial Officer SUBJECT: OIG DRAFT AUDIT REPORT: Audit of the U.S. Office of Personnel Management’s Fiscal Year 2015 Improper Payments Reporting (Report Number – 4A-CF-00-16-026), dated April 22, 2016 Thank you for the opportunity to respond to your draft audit report on OPM’s reporting on improper payments under the Improper Payments Elimination and Recovery Improvement Act of 2012 (IPERIA). Reducing improper payments is an important priority for the Administration and OPM is firmly committed to this priority. We recognize the benefit from the external evaluation conducted by your office and the important part it plays in improving our program and reporting efforts. OPM has prioritized reducing improper payments as one of its key efforts to reduce waste, fraud, and abuse and inefficiencies in Federal programs. OPM continues to make progress in efforts to reduce the extent and rate of improper payments and to recover an increasing percentage of improper payments. Collectively, the Office of the Chief Financial Officer (CFO), the Retirement Services (RS) and Healthcare and Insurance (HI), organizations believe our cumulative efforts over the past few years have resulted in significant improvements in the OPM improper payments program. The Improper Payments Working Group (IPWG) continues to be the focal point for coordinating these improvements in our program. We concur with all six recommendations in the draft report as discussed below. We are providing technical comments on some of the factual information set forth in your draft report and ask that those changes be incorporated in your final report. Report No. 4A-CF-00-16-026 As noted in your draft report, you assessed OPM compliance under six specific criteria set forth in !PERIA and subsequent 0MB guidance. The conclusion in the draft report is that we are non compliant based on not meeting two of the six criteria. !PERIA requires the OIG to repo1t agencies as non-compliant if they do not meet, in their entirety, all six criteria. We disagree with the repmt's conclusion that we are non-compliant with !PERIA due to not meeting the improper payment estimate criteria. OPM published improper payment estimates for all programs and activities identified as susceptible to significant improper payments, specifically, the Retirement Program and the Federal Employees Health Benefit Program. However, the OIG has concluded that this ctiterion was not met due to the fact that it disagrees with how OPM categorized its improper payment estimates. While we agree that improvements are needed in how we categorize the root causes for improper payments, we do not agree that it constitutes non compliance with the criteria, and therefore IPERIA as a whole. Regarding the weaknesses identified in our risk assessment process, we are in agreement that these weaknesses make us non-compliant with the risk assessment criteria, and therefore non compliant with !PERIA. However, notwithstanding the fact that we do not believe the nature of the weaknesses significantly increases our risk for improper payments, we will make the necessary improvements in our risk assessment process in FY 2016. Thank you again for the opportunity to respond to the draft report. We will submit a corrective action plan accordingly. Responses to the individual recommendations and technical comments follow: Recommendation 1 W e recommend that OPM implement controls to include but not limited to identifying and evaluating the improper payment estimates root causes, to ensure that the root causes for the Retirement Benefits Program's improper payments are properly categorized in OPM's annual AFR. Management Response to Recommendation 1 We concur with Recommendation 1 as it relates to properly categorizing the root causes for the retirement benefits program's improper payments. However, we do not believe that categorization of improper p,a yments warrants non-compliance with IPERA. While we do not agree with the OIG's interpretation of the criteria for non-compliance as it relates to the Improper Payment Estimate portion of the AFR, RS will continue to evaluate the criteria and ensure the placement of data in the categories is appropriate. As noted, the improper payments have been reported accurately but OPM categorization methodology needs to be improved. Report No. 4A-CF-00-16-026 There is not a material misstatement of the improper payments. Specifically, RS reported out the Im.proper Payments in the Administrative Category in Table 13 because we found this to be the most appropriate matrix cell that aligned to our supporting documentation. The OIG found our improper payment estimate to be con-ect but asserts that users of the improper payment data in the AFR are not obtaining an accurate picture of OPM's improper payments and we do not agree. The body of the AFR in its entirety provides a detailed depiction of improper payments, their causes and our actions taken over the past year. Again, we agree that improvements can be made in the reporting of Table 13 which includes identifying and collecting data going forward. This analysis will include engaging OPM's CIO and CFO along with The United States Treasury. There will need to be discussion on avenues for extracting and splitting data numbers aligning to the root categories identified in Table 13. Recommendation 2 We recommend that OCFO revise the risk assessment methodology to 1) ensure the score point values are clearly defined and logical and 2} ensure that all required risk factors are included in the risk assessment tool (i.e., IPIA Scoring Guide) used to conduct the assessment over OPM's programs. Management Response to Recommendation 2 We concur with Recommendation 2 and have revised the risk assessment methodology to ensure that the score point values are clearly defined and that all required risk factors are included in the risk assessment tool. OIG Finding: OIG notes that the risk assessments' methodology was flawed ... OCFO did not include all the nine required risk factors that should be assessed. Management Response: We disagree that OCFO did not include all nine required risk factors. We considered all nine factors in the risk assessment but one factor was not documented because we deemed it not applicable to OPM, i.e., is risk score was zero. However, we have revised the risk assessment to ensure that all nine risk factors are properly documented. OIG Finding: OIG notes that without proper documentation to support the risk assessment results, there is an increased likelihood that Ol>M reported inaccurate result in the FY 2015 AFR. Management Response: We disagree that lack of proper documentation to support the risk assessment results "increased the likelihood" that OPM reported inaccurate results. We request that the effect of the related finding be changed to indicate that the lack of documentation makes it difficult to confirm the accuracy ofthe results. Report No. 4A-CF-00-16-026 Recommendation 3 We recommend that OCFO re-evaluate the risk assessments performed over the Background Investigations, FEOLI, Vendor Payments, Travel Card, Payroll programs to ensure programs are not susceptible to significant improper payments. Management Response to Recommendation 3 We concur with Recommendation 3. We will re-evaluate the risk assessments perfonned over the Background Investigations, FEGLI, Vendor Payments, Travel Card, and Payroll programs. Recommendation 4 (Rolled-Forward from FY 14) We recommend that CFO strengthen their procedures to ensure that the improper payments information reported in the OPM's AFR is supported, reviewed and validated for accuracy prior to the information inclusion in the AFR. Management Response to Recommendation 4 We concur with this recommendation and will revise the CFO Work Instruction in response to this recommendation. Recommendation 5 (Rolled-Forward from FY 2013 and FY 2014) We recommend that OCFO strengthen its oversight controls over the improper payments data reported in the Agency Financial Repo1t to ensurn that it accurately reflects suppo1iing data. Management Response to Recommendation 5 OPM concurs with Recommendation 5. We will revise our work instruction that will include a two-tier review of the improper payment data. Report No. 4A-CF-00-16-026 Recommendation 6 We recommend that in the FY 2016 AFR, OPM correct all of the errors identified in the FY 2015 AFR Table 14, Status ofInternal Controls. Management Response to Recommendation 6 OPM concurs with this recommendation and will footnote the correction in FY 2016 AFR. cc: Kenneth Zawodany Associate Director Retirement Services John O'Brien, Associate Director Healthcare and Insurance Report No. 4A-CF-00-16-026 Report Fraud, Waste, and Mismanagement Fraud, waste, and mismanagement in Government concerns everyone: Office of the Inspector General staff, agency employees, and the general public. We actively solicit allegations of any inefficient and wasteful practices, fraud, and mismanagement related to OPM programs and operations. You can report allegations to us in several ways: By Internet: http://www.opm.gov/our-inspector-general/hotline-to-report-fraud-waste- or-abuse By Phone: Toll Free Number: (877) 499-7295 Washington Metro Area: (202) 606-2423 By Mail: Office of the Inspector General U.S. Office of Personnel Management 1900 E Street, NW Room 6400 Washington, DC 20415-1100 -- CAUTION -- This audit report has been distributed to Federal officials who are responsible for the administration of the audited program. This audit report may contain proprietary data which is protected by Federal law (18 U.S.C. 1905). Therefore, while this audit report is available under the Freedom of Information Act and made available to the public on the OIG webpage (http://www.opm.gov/our-inspector-general), caution needs to be exercised before releasing the report to the general public as it may contain proprietary information that was redacted from the publicly distributed copy.
Audit of the U.S. Office of Personnel Management's Fiscal Year 2015 Improper Payments Reporting
Published by the Office of Personnel Management, Office of Inspector General on 2016-05-11.
Below is a raw (and likely hideous) rendition of the original report. (PDF)