GAO-23-105876: A Framework for Managing Improper Payments in Emergency Assistance Programs
Summary
GAO report GAO-23-105876, "A Framework for Managing Improper Payments in Emergency Assistance Programs," a report to congressional committees dated July 2023. It cites $2.4 trillion in estimated improper payments since 2003 for certain federal programs and activities, and explains that while all payments resulting from fraudulent activity are improper, not all improper payments result from fraud. The framework sets out five principles: commit to managing improper payments; identify and assess improper payment risks, including fraud; design and implement effective control activities; monitor the effectiveness of controls; and provide and obtain information to manage improper payments. It recommends steps such as developing internal control plans in advance of future emergencies and avoiding overreliance on "pay and chase" controls.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“GAO-23-105876: A Framework for Managing Improper Payments in Emergency Assistance Programs.”
Original at www.gao.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/gao-23-105876-a-framework-for-managing-improper-payments-in-emergency-81fbd98618/
, SHA-256 df3c81a134f900954f5c6c19fed4470ea89649856e95f62acfd94c49f5ea1bad.Full text
A Framework for Managing
Improper Payments in Emergency
Assistance Programs
$
July 2023 GAO-23-105876
A Framework for Managing Improper Payments
in Emergency Assistance Programs
July 2023, Highlights of GAO-23-105876, a report to congressional committees
IMPROPER PAYMENTS 101 BY THE NUMBERS
Why GAO Did This Study
Natural disasters are projected to $ What are improper payments? $2.4 trillion
increase in frequency and intensity. Improper payments are any payments that
These events, as well as pandemics, Estimated improper
should not have been made or that were made
cyberattacks, and terrorism, have payments since 2003 for
in an incorrect amount—such as overpayments certain federal programs
highlighted challenges federal and underpayments. and activities
agencies face in responding to
emergencies. In emergencies, the Are they the same as fraud?
risk of improper payments may be While all payments resulting from fraudulent
higher because the need to provide activity are considered improper, not all improper
assistance quickly can hinder the payments are the result of fraud. For example,
implementation of effective controls. they can result from lack of agency oversight,
mismanagement, errors, and abuse.
What are the five principles that can help federal program managers mitigate
improper payments in emergency assistance programs?
This framework provides principles to help Congress and federal program managers. When properly
and promptly applied, these principles can successfully reduce improper payments.
1 2 3 4 5
Commit to Identify and Design and Monitor the Provide and obtain
managing improper assess improper implement effectiveness of information to
payments payment risks, effective control controls in managing manage improper
including fraud activities improper payments payments
• Develop internal control • Leverage prior risk • Establish control • Establish timely ongoing • Provide improper
plans in advance to assessments activities at the beginning monitoring and separate payment information
prepare for future • Quickly identify and of the program evaluations to nonfederal entities
emergencies assess new improper • Leverage existing • Estimate improper • Provide improper
• Identify data-sharing payment risks resources to create payments payment information
opportunities • Support nonfederal controls quickly • Analyze the root cause to oversight entities
• Assign clear roles and entities in assessing • Prioritize prepayment of improper payments • Obtain and use
responsibilities for managing and managing improper controls and avoid • Monitor nonfederal information from
improper payments payment risks overreliance on “pay entities’ implementation nonfederal entities and
• Implement open • Define risk tolerance and chase” controls of emergency assistance state and local auditors
recommendations related • Periodically assess whether • Ensure controls align programs
to improper payments programs are susceptible with statutory • Develop corrective actions
• Apply lessons learned to significant improper requirements
from past emergencies payments, including fraud
Source: GAO (analysis and icons). | GAO-23-105876
A Framework for Managing Improper Payments
in Emergency Assistance Programs
July 2023, Highlights of GAO-23-105876, a report to congressional committees
How can applying the principles of GAO’s framework
help address increased risk during emergencies?
Agencies are better able to manage improper payment risk during emergencies if they have taken steps to manage
this risk effectively under normal conditions. When emergencies occur, agencies may need to develop new programs or
significantly expand existing ones, which can involve increased risk. This increased risk may require additional emphasis
on specific elements of the framework, such as those described below. Delaying or omitting the implementation of these
elements may lead to increased risk of improper payments.
In emergencies, the risk of improper Examples of how the framework can
payments may be higher address this increased risk
Developing internal control plans that
Emergencies unfold rapidly, and can be immediately implemented or
assistance must be distributed quickly adapted for a future emergency can
help ensure that agencies are ready to
respond to emergencies (Principle 1)
Estimating improper payments
Estimating improper payments after the
expeditiously, including during the
first year of assistance may be too late,
initial year of implementation, can help
as most funds are already disbursed
programs to address issues sooner
(Principle 2)
Emergency programs may allow Prioritizing and implementing prepayment
applicants to certify their own eligibility controls, such as using existing data
for assistance, which can save time but sources to verify applicants’ identity and
increases the risk of improper eligibility, can help to stop improper
payments, particularly due to fraud payments before they are issued
(Principle 3)
The need for federal and nonfederal Monitoring the controls used by
entities to coordinate means federal nonfederal entities is a step to meeting
agencies may have additional oversight responsibilities and can help
oversight responsibilities ensure the effective use of federal
funds (Principle 4)
Providing timely, high-quality guidance
Emergency legislation can introduce to nonfederal entities, including
new requirements and risks for both guidance on program implementation,
new and existing programs eligibility requirements, and appropriate
use of funds, can help them interpret
statutory requirements (Principle 5)
Source: GAO (analysis and icons); Lunaraa/stock.adobe.com (icons). | GAO-23-105876
View GAO-23-105876. For more information on fraud risk, contact Johana Ayers at (202) 512-6722 or ayersj@gao.gov.
For more information on improper payment risk, contact Beryl Davis at (202) 512-2623 or davisbh@gao.gov.
Table of Contents
Foreword .............................................................................................................................................................1
Introduction .........................................................................................................................................................3
Framework for Managing Improper Payments in Emergency Assistance Programs ..................................8
1. Commit to Managing Improper Payments ..................................................................................................10
Develop Internal Control Plans ................................................................................................................................10
Identify Data-Sharing Opportunities .........................................................................................................................11
Assign Roles and Responsibilities ...........................................................................................................................13
Implement Open Recommendations .......................................................................................................................13
Apply Lessons Learned............................................................................................................................................14
2. Identify and Assess Improper Payment Risks, Including Fraud ..............................................................15
Leverage Prior Risk Assessments ...........................................................................................................................15
Identify and Assess New Risks ................................................................................................................................15
Support Nonfederal Entities .....................................................................................................................................17
Define Risk Tolerance ..............................................................................................................................................17
Assess Whether Programs Are Susceptible to Significant Improper Payments......................................................18
3. Design and Implement Effective Control Activities ...................................................................................20
Establish Control Activities .......................................................................................................................................20
Leverage Existing Resources ..................................................................................................................................21
Prioritize Prepayment Controls ................................................................................................................................22
Align Controls with Statute .......................................................................................................................................23
4. Monitor the Effectiveness of Controls in Managing Improper Payments ...............................................24
Establish Monitoring Activities..................................................................................................................................24
Estimate Improper Payments ...................................................................................................................................24
Analyze the Root Cause ..........................................................................................................................................25
Monitor Nonfederal Entities ......................................................................................................................................25
Develop Corrective Actions ......................................................................................................................................26
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page i
5. Provide and Obtain Information to Manage Improper Payments .............................................................28
Provide Information to Nonfederal Entities ..............................................................................................................28
Provide Information to Oversight Entities.................................................................................................................29
Obtain and Use Information from Nonfederal Entities .............................................................................................30
Appendix I: Congressional Addressees .........................................................................................................31
Appendix II: Additional Sources to Use in Managing Improper Payments .................................................32
Appendix III: Endnotes .....................................................................................................................................34
Appendix IV: GAO Contact and Staff Acknowledgments .............................................................................42
Figures
Figure 1: Framework for Managing Improper Payments in Emergency Assistance Programs……………………….8
Figure 2: Principles for Managing Improper Payments and Their Corresponding Internal Control Components…..9
Tables
Table 1: Examples of Risk Factors That Increase a Program’s Susceptibility to Improper Payments …………….19
Table 2: Example of Improper Payment Root Cause Analysis………………………………………………………....26
Table 3: Additional Sources to Use in Managing Improper Payments ………………………………………………..33
Abbreviations
CMS Centers for Medicare & Medicaid Services
DHS Department of Homeland Security
DOL Department of Labor
EIDL Economic Injury Disaster Loan
FEMA Federal Emergency Management Agency
HHS Department of Health and Human Services
HRSA Health Resources and Services Administration
IRS Internal Revenue Service
NIST National Institute of Standards and Technology
OMB Office of Management and Budget
PIIA Payment Integrity Information Act of 2019
PPP Paycheck Protection Program
SBA Small Business Administration
SSA Social Security Administration
This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and
distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material,
permission from the copyright holder may be necessary if you wish to reproduce this material separately.
Image source: GAO and Kingline/stock.adobe.com (cover art). Image source for header icons: GAO.
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page ii
Foreword
Foreword
I am pleased to present GAO’s Framework for Managing Improper
Payments in Emergency Assistance Programs.
Federal emergency assistance in response to public health crises, natural
disasters, and other catastrophic events can present significant challenges
to agencies that must make timely payments to eligible individuals,
businesses, and other entities. These emergency events and the
corresponding creation of new federal programs or rapid expansion of
existing programs— often with an emphasis on getting money out quickly
to those in need—can strain agencies’ capabilities in managing programs
and ensuring that funds are spent appropriately. Further, the COVID-19
pandemic saw an increase in the frequency and volume of identity-related
fraud, particularly in the areas of unemployment insurance and assistance
to small businesses, as well as sophisticated fraud schemes. These
developments will likely continue to challenge future federal emergency
assistance efforts.
GAO’s oversight of emergency assistance programs has identified
substantial shortcomings in agencies’ application of fundamental internal
controls and fraud risk management practices. These shortcomings can
result in significant improper payments—payments that should not have
been made or were made in the incorrect amount as a result of
mismanagement, errors, abuse, or fraud.
To address these issues, GAO developed this framework to provide
Congress and federal agencies with an overall approach to managing
improper payments in emergency assistance programs. This framework
can also be useful for managing improper payments in non–emergency
assistance programs or during normal program operations.
This framework should be used by federal agencies in conjunction with
existing requirements related to managing improper payments, including
those stemming from fraud. Federal agencies are required to follow the
internal control standards outlined in Standards for Internal Control in the
Federal Government, which provides the foundation of this framework.
This framework’s principles align with a number of internal control steps
that managers should take. Agencies should also apply the leading
practices in GAO’s Framework for Managing Fraud Risks in Federal
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 1
Foreword
Programs in their efforts to combat fraud in a strategic, risk-based
manner.
We developed this framework through a deliberative process and solicited
a wide range of views to help ensure its applicability to the federal
government. This process included interactions with the Council of the
Inspectors General on Integrity and Efficiency; the Chief Financial Officers
Council; the National Association of State Comptrollers, Auditors and
Treasurers; the American Institute for Certified Public Accountants; the
Association of Government Accountants; and the Association of Local
Government Auditors. The views of all parties were thoroughly considered
in finalizing this document. We extend special thanks to those who
provided input on and suggested improvements to this framework.
Gene L. Dodaro
Comptroller General of the United States
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 2
Introduction
Introduction
Emergencies require federal agencies to plan proactively
and manage improper payments strategically.
Natural disasters—such as those caused by hurricanes, tornadoes, and
wildfires—have been occurring more frequently and are projected to
increase in frequency and intensity due to climate change. 1 The federal
government faces fiscal exposure from these events as well as from
pandemics, cyberattacks, and terrorism. Such events have highlighted the
challenges federal agencies face in responding to emergencies. These
challenges include implementing new emergency assistance programs
quickly and significantly increasing the volume of funding disbursed
through existing programs. At the same time, new and expanded
programs share the challenge of ensuring that payments are made
properly to eligible recipients.
Improper payments are any payments that should not have been made or
that were made in an incorrect amount—that is, overpayments and
underpayments—under statutory, contractual, administrative, or other
legally applicable requirements. 2 They may include any payment for an
ineligible good or service, any duplicative payment, or any payment made
to an ineligible recipient. An ineligible recipient may receive an improper
payment due to several factors, including fraudulent activity. While all
payments resulting from fraudulent activity—those that involve an
individual or entity obtaining something of value through willful
misrepresentation—are considered improper, not all improper payments
are the result of fraud. For example, improper payments can also be
unintended and can result from lack of agency oversight,
mismanagement, errors, and abuse.
Improper payments are a long-standing, widespread, and significant
problem in the federal government. Since fiscal year 2003, improper
payment estimates across federal executive agencies (referred to in this
report as “federal agencies”) have cumulatively totaled about $2.4 trillion. 3
Federal agencies reported about $281 billion in estimated improper
payments for fiscal year 2021—an increase of $75 billion from the prior
fiscal year and about double the amount reported for fiscal year 2017—
and about $247 billion for fiscal year 2022. 4 About 20 percent of the
federal programs that reported improper payment rates in 2022 were
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 3
Introduction
found to have an estimated improper payment rate over 10 percent. 5 In
the prior fiscal year, about 30 percent of the federal programs that
reported improper payment rates were found to have an estimated
improper payment rate over 10 percent. 6 However, we have found that
the federal government is unable to determine the full extent to which
improper payments occur and reasonably ensure that appropriate actions
are taken to reduce them. 7
In recent years, however, some agencies have reduced improper
payments in their programs, including by applying existing requirements
and guidance for managing improper payments. For example, we found
that 19 of the 35 programs that reported estimated improper payment
rates between fiscal years 2017 and 2022 saw their rates decrease. 8 The
decrease in estimated improper payments across these programs in the
5-year period totaled about $15 billion. In addition, our analysis found
that at least 46 programs stopped reporting during this same period
because the agencies determined they were no longer considered
susceptible to significant improper payments. When agencies follow
relevant requirements and guidance, they can successfully reduce
improper payments.
When the federal government provides emergency assistance, the risk of
improper payments may be higher because the need to provide such
assistance quickly can detract from the planning and implementation of
effective controls. Our work has shown that federal agencies should better
plan for and take a more strategic approach to managing improper
payments in emergency assistance programs. For example:
• Unemployment insurance. Prior to the COVID-19 pandemic, the
Department of Labor (DOL) regularly reported billions of dollars in
annual estimated improper payments in the unemployment insurance
system, a federal-state partnership. 9 Under the CARES Act, enacted in
March 2020 to address the public health and economic threats posed
by COVID-19, states implemented three new federally funded programs
that expanded unemployment insurance eligibility and benefits. 10 By
January 31, 2021, DOL had obligated $723 billion to unemployment
insurance as part of COVID-19 relief funding. 11 The risk of improper
payments, including those due to fraud, increased because of the
unprecedented demand and the urgency with which states
implemented the new programs. During the pandemic, states received
more than 42 million unemployment insurance claims from March 21 to
May 30, 2020, compared with 5.1 million in all of fiscal year 2019. In
February 2023, the DOL Inspector General reported that of the $888
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 4
Introduction
billion in state and federal unemployment insurance expenditures
disbursed during the pandemic, at least $191 billion may have been
improper payments. 12
We found that states faced challenges processing a historically high
number of claims and ensuring the timely payment of benefits to
eligible individuals. We have made several recommendations to help
DOL strategically manage fraud risks in unemployment insurance
programs, including creating a dedicated fraud management entity and
examining the suitability of existing fraud controls. 13
• Assistance to small businesses. In response to the COVID-19
pandemic, the Small Business Administration (SBA) provided over $1.1
trillion in loans and advances to small business owners suffering from
the economic effects of the pandemic. 14 While this assistance helped
many small businesses, we found that SBA’s initial limited internal
controls and lack of finalized oversight plans created significant risk of
billions of dollars in improper payments.
Specifically, SBA reported $29 billion in estimated improper payments
for fiscal year 2022 for the Paycheck Protection Program (PPP), a new
nationwide program established to provide guaranteed loans to small
businesses adversely affected by COVID-19 that are fully forgivable if
certain conditions are met. It also reported $6.9 billion in improper
payments for fiscal year 2022 for the COVID-19 Economic Injury
Disaster Loan (EIDL) program, which was an expansion of an existing
program to assist small businesses and nonprofits experiencing
economic injury due to COVID-19. 15 In 2020 and 2021, we made several
recommendations aimed at helping SBA to better manage the risks of
improper payments in its programs, including developing and
implementing plans to respond to program integrity risks and address
potential fraud. 16
• Natural disaster response. In 2017, hurricanes and wildfires created
unprecedented demand for federal disaster response and recovery
resources. In response, Congress passed and the President signed three
supplemental appropriations acts, which included an oversight
framework related to internal controls to limit improper payment of
these funds. The third of the supplemental appropriation acts also
required the Office of Management and Budget (OMB) to issue criteria
for federal agencies to use in designing internal control plans for
spending disaster relief funding. In 2019 we reported on weaknesses
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 5
Introduction
related to managing improper payments in disaster assistance
programs. For example, certain agencies did not submit timely or
complete internal control plans because OMB did not employ an
effective outreach strategy. 17 We recommended that OMB develop a
strategy for ensuring that agencies communicate timely and sufficient
internal control plans for disaster relief funds. 18
Others in the inspector general community have also found significant
improper payments in emergency assistance programs. For example:
• Lost Wages Assistance program. On August 8, 2020, the President
issued a memorandum directing the Federal Emergency Management
Agency (FEMA) to provide up to $44 billion in lost wages assistance
from the Department of Homeland Security’s (DHS) Disaster Relief Fund
to individuals unemployed or partially unemployed because of the
COVID-19 pandemic. 19 FEMA did not make lost wages payments
directly to claimants. Instead, FEMA provided funding to the state
workforce agencies of participating states and territories, which
delivered the assistance in conjunction with the state workforce
agencies’ existing unemployment systems. 20 Each state workforce
agency was required to collect claimants’ self-certification that they
were unemployed due to the pandemic.
DHS’s Office of Inspector General found that FEMA did not implement
controls that might have prevented 21 state workforce agencies from
distributing more than $3.7 billion in improper payments through the
Lost Wages Assistance program. 21 This occurred because FEMA
launched the program in 11 days without developing and implementing
clear guidance or verifying and monitoring the state workforce
agencies’ controls to help ensure they prevented or mitigated improper
payments. The Inspector General made several recommendations to
FEMA, including that the agency develop and implement a standard risk
assessment process before initiating new federal grant programs, and
that it develop a process for assessing program controls and risks for
when FEMA is mandated to rely on non-FEMA eligibility determinations.
The CARES Act includes a provision for GAO to report on its ongoing
monitoring and oversight efforts related to the COVID-19 pandemic. 22 We
developed this framework as part of our work in response to this
provision. To develop this framework, we reviewed the Payment Integrity
Information Act of 2019 (PIIA), payment integrity guidance published by
OMB, GAO’s Standards for Internal Control in the Federal Government, and
GAO’s Framework for Managing Fraud Risks in Federal Programs. 23 We
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 6
Introduction
also reviewed relevant literature, including prior GAO reports related to
improper payments, emergency assistance programs, and fraud risk
management.
In addition, we consulted with GAO specialists on internal control, fraud
risk management, and improper payments. We interviewed officials from
OMB and the Department of the Treasury and officials from interagency
organizations, including the Council of the Inspectors General on Integrity
and Efficiency’s Pandemic Response Accountability Committee and the
Chief Financial Officers Council. We also solicited input from four
organizations that represent federal, state, and local audit associations,
which we identified through our background research and discussions
with GAO experts on improper payments. 24 We asked officials from OMB,
Treasury, and these organizations to review a draft of the framework and
provide input, which we incorporated as appropriate.
We conducted our work from February 2022 to July 2023 in accordance
with all sections of GAO’s Quality Assurance Framework that are relevant
to this framework. The Quality Assurance Framework requires that we plan
and perform our work to obtain sufficient and appropriate evidence to
meet our stated objective and to discuss any limitations in our work. We
believe that the information and data obtained, and the analysis
conducted, provide a reasonable basis for any conclusions in this product.
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 7
Framework for Managing Improper Payments in Emergency Assistance Programs
Framework for Managing Improper Payments
in Emergency Assistance Programs
This framework provides five principles and corresponding practices that can help federal program managers
mitigate improper payments, particularly in emergency assistance programs (see fig. 1). The framework is also
intended as a resource for Congress to use when designing new programs or appropriating additional funding
in response to emergencies. The framework incorporates payment integrity requirements from PIIA and
relevant OMB guidance on payment integrity improvement. It also includes information derived from leading
practices for managing fraud risks in GAO’s Framework for Managing Fraud Risks in Federal Programs. Appendix
II provides additional information on the different sources that informed the development of this framework
and that can be used in managing improper payments.
Figure 1: Framework for Managing Improper Payments in Emergency Assistance Programs
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 8
Framework for Managing Improper Payments in Emergency Assistance Programs
Standards for Internal Control in the Federal Government provides the foundation of this framework, and the
framework’s principles align with the components of internal control (see fig. 2). 25
Figure 2: Principles for Managing Improper Payments and Their Corresponding Internal Control Components
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 9
1. Commit to Managing Improper Payments
Because emergencies can unfold quickly or unexpectedly, agencies should
commit to managing improper payments before an emergency occurs.
Agencies can implement practices that demonstrate this commitment,
including developing emergency internal control plans in advance to
quickly adapt to an emergency situation, identifying data-sharing
opportunities, assigning clear roles and responsibilities, implementing
open recommendations related to improper payments, and applying
lessons learned from past emergencies.
Develop Internal Control Plans
Because emergencies are inevitable, federal program managers should
commit to managing improper payments early by developing internal
control plans that can be immediately implemented or quickly tailored to
fit the circumstances of a future emergency. 26 Managers should develop
plans in advance that have potential eligibility criteria and controls
designed for likely future emergencies, such as natural disasters. Some
audit and government management organizations we spoke with
emphasized this approach. These plans, developed in advance of an
emergency, could also contain components such as identifying
emergency-related risks and controls to address these risks.
Preexisting internal control plans should include prepayment controls,
such as use of the Do Not Pay working system. This system is operated by
Treasury and provides a variety of data-matching and data-analytics
services for all federal executive and many state agencies to support their
efforts to prevent improper payments. Using the system can help
agencies to determine payment eligibility quickly prior to payment
issuance. 27 Agencies should also plan for expedited postpayment controls,
such as postpayment reviews and recovery audits, which are more critical
when the quick disbursement of funds makes prepayment controls
difficult to apply fully.
Effective, robust internal control plans can help agencies adapt to
changing risks and new priorities. For example, to respond to an
emergency, Congress may direct agencies to create new programs that
are required to issue a large number of payments quickly, as it did with
PPP. Given the immediate need for small business loans during the
COVID-19 pandemic, SBA worked to set up PPP so that lenders could
begin distributing funds as soon as possible. Specifically, SBA
implemented PPP on April 3, 2020, 1 week after the enactment of the
CARES Act. By April 16, 2020, just 14 days after SBA implemented the
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 10
Commit to Managing Improper Payments
program, lenders had approved more than 1.6 million loans totaling
nearly $342.3 billion. 28
Because the need to provide funds quickly increased the risk of fraud, SBA
would have benefitted from having plans in place prior to the emergency.
Such plans could have helped ensure that program managers considered
improper payment risks associated with emergency funding (such as the
volume of transactions and speed at which they were processed) and
implemented basic internal controls to help mitigate those risks prior to
disbursing the emergency assistance. For example, antifraud controls
within the internal control plan could have included using prepayment
data analytics, such as the Do Not Pay working system mentioned above,
as well as processes to screen payments for potential ineligibility or fraud.
In addition, internal control plans increase transparency and may give
Congress some assurance that agencies will be able to establish or adapt
effective and efficient controls over new or expanded federal funding.
Preexisting internal control plans allow federal program managers to
adapt controls quickly when a program’s statutory requirements change
in an emergency. For example, Congress may significantly expand an
existing program, as it did with the federal unemployment insurance
system during the pandemic. In 2020, DOL’s Pandemic Unemployment
Assistance program expanded unemployment benefits to independent
contractors, self-employed individuals, and others not traditionally eligible
for these benefits. Applicants were required to self-certify that they were
eligible for pandemic-related assistance before payments were sent. Also
in 2020, the DOL Office of Inspector General reported self-certification as
a top fraud vulnerability for state workforce agencies administering
pandemic-related unemployment benefits. 29 Congress addressed this
issue in the 2021 Consolidated Appropriations Act by creating new
documentation requirements for Pandemic Unemployment Assistance
claimants; however, the program had already become an attractive target
for increasingly sophisticated fraud schemes. 30 Preexisting internal control
plans might have helped managers quickly implement appropriate
controls before payments were disbursed—such as leveraging existing
data-matching services to validate individuals’ employment status. In
emergencies, such plans may also help agencies to expedite more timely
postpayment checks.
Identify Data-Sharing Opportunities
Sharing data allows programs to compare information from different
sources to help ensure that payments are appropriate before they are
made. Using different data sources to confirm identity and eligibility
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 11
Commit to Managing Improper Payments
information can be a key step in reducing improper payments in
emergency assistance programs.
Agencies should proactively identify data they may need to verify
applicant identity and eligibility and resolve any barriers to accessing data
before an emergency occurs, including entering into data-sharing
agreements. Data-sharing agreements allow agencies access to necessary
external data, which can be used to improve a program’s existing controls
or develop new verification controls to help overcome incomplete or
missing applicant information. 31 For example, agencies can enter into
Computer Matching Agreements, which permit federal agencies to
conduct data matches with one another to establish or verify personal
information. 32
Identifying data-sharing opportunities in advance can help agencies
identify barriers to accessing data, such as statutory restrictions, and
proactively work to resolve them before an emergency occurs. While the
obligation to control and protect data can limit agencies’ ability and
willingness to share information across the federal government, program
managers may be able to identify authorities under which data sharing is
permissible for the purpose of enhancing identity-verification controls.
For example, the Privacy Act of 1974, as amended, defines a number of
conditions under which federal agencies may share information with other
government agencies without the affected individual’s consent. 33 To help
ensure the integrity of direct payments to individuals, we have
recommended that Congress consider amending the Social Security Act
to explicitly allow the Social Security Administration (SSA) to share its full
death data with Treasury for data matching to prevent payments to
ineligible individuals. 34
Having data-sharing agreements in place before an emergency occurs can
help ensure timely access to verification information, and these
agreements can be used in the prevention and detection of improper
payments. For example, in January 2023, the Pandemic Response
Accountability Committee identified $5.4 billion in potential identity fraud
associated with 69,323 questionable and unverified Social Security
numbers across disbursed COVID-19 EIDL and PPP loan program
applications. The committee found that if SBA had been able to verify the
accuracy of the Social Security numbers on borrower applications, it could
have reduced the possibility of identity theft and ensured that benefits
were paid only to eligible recipients. However, the process of
implementing a new Social Security number verification agreement and
addressing the legal questions regarding information sharing can be
lengthy, and the time required to establish these types of agreements can
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 12
Commit to Managing Improper Payments
create delays and challenges, particularly in an emergency. The Pandemic
Response Accountability Committee found that having such agreements
in place before an emergency occurs would ensure timely access to
verification information and protect taxpayer funds from improper
payments. 35
Assign Roles and Responsibilities
Federal program managers should ensure that sufficient resources are
applied to oversee improper payment and fraud risk management
activities, and that authority and responsibility for internal control are
clearly assigned and periodically reviewed.
For example, the Centers for Medicare & Medicaid Services (CMS) created
the Center for Program Integrity, a centralized entity responsible for
Medicare and Medicaid program integrity issues. 36 After receiving
additional funding, CMS allocated additional staff to the center and was
able to establish working groups and interagency collaboration aimed at
reducing improper payments. By assigning responsibility for payment
integrity to this center, CMS was able to centralize the development and
implementation of automated prepayment controls used to deny
Medicare claims that should not be paid. As CMS has undertaken these
efforts and others to address improper payments, it has seen a reduction
in improper payments. Between fiscal years 2018 and 2020, Medicare’s
fee-for- service and Medicare Advantage saw a reduction in their
improper payment rates of more than 1 percentage point, which is
significant given that Medicare’s improper payments accounted for over
one-quarter of the total amount of improper payments made
government-wide in fiscal year 2019. 37
Clearly assigning roles and responsibilities for managing improper
payments should also include establishing a dedicated antifraud entity to
strategically manage fraud risks. 38 Having such an entity can help ensure
that improper payment risks related to fraudulent activity are identified
and assessed as the emergency unfolds and that appropriate controls are
implemented when agencies distribute emergency funding. Such entities
should have clearly defined and documented responsibilities and
authority for managing fraud risks.
Implement Open Recommendations
Agencies can also prepare for future emergencies by promptly
implementing recommendations made during normal operations by their
inspectors general or GAO. For example, in 2018, GAO recommended that
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 13
Commit to Managing Improper Payments
the Internal Revenue Service (IRS) take steps to improve its efforts to
authenticate taxpayers. 39 IRS had not fully implemented these
recommendations at the onset of the COVID-19 pandemic, and
subsequently IRS officials raised concerns that fraudsters could be taking
economic impact payments intended for eligible recipients by improperly
accessing IRS’s online payment portal and routing payments to their own
bank accounts. By taking actions to address the open recommendations
prior to the COVID-19 pandemic, IRS might have had better controls and
safeguards in place during the emergency to manage improper payment
risks and help ensure that eligible individuals in need of economic impact
payments received them. 40
In addition to implementing open recommendations made during normal
operations, agencies can improve the integrity of their emergency
assistance programs by implementing recommendations made during
emergency operations. For example, we and inspectors general have
made hundreds of recommendations in the course of performing COVID-
19 oversight, many of which remained unimplemented at the end of the
national emergency in May 2023.
Apply Lessons Learned
Agencies can also apply lessons learned about improper payments during
emergencies to inform future practices. For example, during the COVID-
19 pandemic, we and several inspectors general made recommendations
to help agencies reduce improper payments, including those stemming
from fraudulent activity in unemployment insurance and the EIDL
program. These recommendations could benefit agencies in future
emergencies. 41
For example, in a future emergency, if agencies allow applicants to self-
certify that they are eligible for assistance, agencies should consider
establishing additional fraud controls, such as validating self-certifications
with tax returns, employer certifications, or other alternate documentation
before disbursing payments. The Pandemic Response Accountability
Committee found that this lesson applies broadly to federal agencies that
rely on self-certification to determine eligibility. 42 Agencies could apply
this lesson by having a plan in place for validating self-certified eligibility
information before the next emergency occurs. Applying lessons learned
from past emergencies will help agencies build a foundation to quickly
respond to and mitigate payment integrity risks in future emergencies.
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 14
2. Identify and Assess Improper Payment Risks,
Including Fraud
Agencies should identify and address improper payment risks both as
part of their normal operations before an emergency occurs and once
emergency conditions develop. This process includes leveraging prior risk
assessments, identifying and assessing new risks, supporting nonfederal
entities that administer federal programs in managing payment integrity
risks, defining programs’ risk tolerance, and periodically assessing whether
programs are susceptible to significant improper payments.
In emergency assistance programs, understanding the general magnitude,
likelihood, and nature of improper payment risks before spending begins
is critical. Conducting regular risk assessments can help program
managers identify and respond to risks facing the entity, including fraud.
While some programs may conduct statutorily required risk assessments,
such as the improper payment risk assessment discussed below, programs
that do not meet the statutory threshold for improper payment risk
assessments should still strategically assess and manage their risks of
improper payments. 43 This approach provides both safeguards for normal
operations and a starting point for assessing new emergency assistance
programs and expanded programs, which may have significantly altered
risks and may need modified or new controls.
Leverage Prior Risk Assessments
Federal program managers can take steps to understand risks in new
emergency assistance programs by leveraging risk assessments of prior
programs or similar emergency assistance programs. For example, DOL
implements temporary unemployment insurance programs following
natural disasters. These temporary programs have regulations similar to
those of the unemployment assistance program DOL implemented during
the COVID-19 pandemic, and these programs have previously been
audited for improper payments by DOL’s Office of Inspector General. In
emergency situations, using the risk assessments of previous or similar
emergency assistance programs could better position program managers
to quickly identify and assess improper payment risks and design
appropriate internal controls to mitigate them.
Identify and Assess New Risks
Federal program managers should also identify and assess any new
improper payment risks or changes in the likelihood of existing risks
stemming from the emergency. For example, one office we spoke to with
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 15
Identify and Assess Improper Payment Risks, Including Fraud
payment oversight responsibilities was required to shift to a remote
(telework) posture at the onset of the COVID-19 pandemic. However, not
all personnel had the appropriate technology to oversee and manage the
distribution of payments from a remote posture, which increased the risk
of improper payments. 44
Legislation to address emergencies can also introduce new risks. For
example, a state auditor noted that when CARES Act legislation expanded
unemployment insurance payments to independent contractors, staff did
not have the means to conduct traditional employment verification for
them. Some independent contractors who realized the state had no way
to verify their unemployment may have been able to fraudulently claim
they were unemployed, contributing to improper payments.
The likelihood or severity of existing risks can also change. For example,
an organization we spoke to noted that the risk of fraudulent activity may
be higher when programs contract with and provide payments to
unfamiliar businesses and do not have an established method to
determine contractors’ legitimacy. Specifically, a state auditor’s office told
us its staff routinely work with certain types of contractors after natural
disasters, such as debris removal contractors, and based on prior
experience are able to identify fraudulent companies more easily. During
the COVID-19 pandemic, however, they had to work with ventilator
contractors for the first time, and the lack of experience meant they had
no basis on which to evaluate whether certain contractors were
fraudulent. Fraudulent companies seeking contracts was a known existing
risk that this auditor considered, but the circumstances of the pandemic
increased the likelihood of this type of fraud.
In emergencies, when program administrators need to confirm recipient
identity and eligibility expeditiously, the extent to which agencies rely on
applicants self-certifying their eligibility can increase. However, as
discussed previously, we and others have repeatedly found that self-
certification can increase the risk of fraud, which may ultimately reduce
the total amount of funds available to eligible individuals and
businesses. 45 For example, to apply for an EIDL loan from SBA, businesses
certified that they were established on or before January 31, 2020, by
entering their establishment date on their application form. SBA did not
verify this information with another data source or ask for additional
supporting documentation before disbursing funds. When SBA’s Office of
Inspector General later used employer identification number data to audit
the program, it found that the agency had approved over 22,700
potentially ineligible applications. As a result of not identifying and
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 16
Identify and Assess Improper Payment Risks, Including Fraud
assessing this risk, SBA distributed $918 million in loan funds that were
potentially improper payments. 46
Support Nonfederal Entities
In emergency assistance programs, addressing improper payment risks is
often a responsibility shared between federal and nonfederal entities,
such as tribal, state, territorial, and local governments, and federal
program managers should assist their counterparts with assessing and
managing risk.
For example, nonfederal program administrators may assume
responsibility for determining program eligibility, ensuring accurate
benefit payments, and preventing fraudulent and other improper
payments. Federal program managers can assist them in mitigating
improper payment risk by providing fraud-related guidance, general
support, and technical assistance. Furthermore, an audit and an oversight
organization told us that federal program managers should ensure their
state and local counterparts have their own risk assessment strategies,
which can include activities such as assessing their vendors’ internal
controls. In circumstances where program eligibility decisions are
determined outside of the federal agency, taking steps to assist a
counterpart may help to mitigate risk.
Define Risk Tolerance
When managing an emergency assistance program, federal program
managers may choose to adjust their risk tolerance, or willingness to take
on risk, with respect to improper payments. Because the nature of
emergency assistance can increase vulnerability to improper payments,
program managers should weigh their objective to provide assistance
quickly against the increased risk of improper payments.
For example, when responding to natural disasters, an emergency
assistance program may contract with businesses for emergency services,
such as debris removal. The managers may generally define their risk
tolerance as “very low” because improper payments could undermine the
program and waste resources. Therefore, they may require a full
verification check as a control to ensure they identify businesses that may
be using falsified tax identification numbers or fraudulent business
websites. This control would have a high level of certainty of identifying
fraud before issuing a payment. However, depending on the
circumstances of the emergency, managers may accept a higher risk
tolerance, and they might decide to waive the full verification control and
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 17
Identify and Assess Improper Payment Risks, Including Fraud
opt for a control activity that is more limited (such as auditing a sample of
businesses to verify their identities). Such a limited control provides less
assurance that improper payments are being detected but is less time
consuming and may help get assistance out faster.
Program management should define a program’s risk tolerance according
to OMB guidance and federal internal control standards. Management
should then develop an internal control system that balances these risks
with controls so as to identify, achieve, and maintain a tolerable level of
improper payments. 47
Assess Whether Programs Are Susceptible to
Significant Improper Payments
Conducting improper payment risk assessments should be a routine part
of risk management for federal programs, but emergency assistance
programs may involve additional considerations because the risk of
improper payments is higher. Federal program managers are required by
law to periodically assess whether programs with annual outlays of over
$10 million may be susceptible to significant improper payments, which
would trigger requirements for improper payment estimates and
corrective action plans. 48 While these improper payment risk assessments
typically occur on a 3-year cycle, whenever a program experiences a
significant change in legislation or funding—such as during a natural
disaster or emergency—or any event that increases payment integrity risk,
program managers should conduct an off-cycle risk assessment. 49
For newly established programs, OMB guidance states that improper
payment risk assessments should be completed after the first 12 months
of the program. 50 However, for emergency assistance programs, especially
large programs where there are concerns about the possibility of
widespread improper payments, we have emphasized the importance of
program management estimating improper payments expeditiously. 51
This can include during the initial year of implementation. Given the rapid
timeline of emergency assistance, time lags in assessing risk may result in
improper payment issues, including those resulting from fraudulent
activities, not being identified or addressed until after most or even all
funds are disbursed.
When conducting an improper payment risk assessment, program
managers should consider risk factors that may contribute to a program’s
susceptibility to significant improper payments, including but not limited
to those listed in table 1.
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 18
Identify and Assess Improper Payment Risks, Including Fraud
Table 1: Examples of Risk Factors That Increase a Program’s Susceptibility to Improper Payments
• Whether the program or activity is new to the agency
• The complexity of the program or activity
• The volume of payments made through the program or activity
• Whether payments or payment eligibility decisions are made outside of the executive agency, such as by a state or local government
or another third party or intermediary
• Recent major changes in program funding, authorities, practices, or procedures
• The level and experience of and quality of training for personnel responsible for making program eligibility determinations or
certifying that payments are accurate
• Significant deficiencies in the audit report of the executive agency or other relevant management findings that might hinder accurate
payment certification
• Similarities to other programs or activities that have reported improper payment estimates or been deemed susceptible to
significant improper payments
• The accuracy and reliability of improper payment estimates previously reported for the program or activity, or other indicator of
potential susceptibility to improper payments identified by the inspector general of the executive agency or GAO; other audits
performed by or on behalf of the federal, state, or local government; in disclosures by the executive agency; or through any other
means
• Whether the program or activity lacks information or data systems to confirm eligibility or provide for other payment integrity needs
Source: GAO and 31 U.S.C. § 3352(a)(3)(B). | GAO-23-105876
If the improper payment risk assessment determines that the program
may be susceptible to significant improper payments, this determination
triggers additional statutory requirements, such as estimating and publicly
reporting on improper payments (see framework principles 4 and 5). 52 If a
program has not been determined to be susceptible to significant
improper payments, the agency should still regularly assess improper
payment risks and develop appropriate responses. These responses may
include assessing fraud risks and implementing new or modified control
activities that are consistent with federal internal control standards. 53
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 19
3. Design and Implement Effective Control Activities
Designing and implementing effective control activities from the
beginning of an emergency assistance program is critical to strong
oversight and helps ensure that agencies achieve program objectives and
respond to identified risks of improper payments in a timely manner.
Practices that support effective control activities include establishing
control activities at the beginning of the program, leveraging existing
resources to create controls, prioritizing prepayment controls, and
ensuring that controls align with statutory requirements. Having an
internal control plan in place before an emergency occurs, as discussed in
principle 1, can help expedite the establishment of control activities from
the beginning of the program.
Establish Control Activities
Incorporating effective control activities from the beginning of the
program is critical to mitigating the risks of improper payments,
particularly when distributing emergency assistance quickly. For example,
an audit organization told us that before the COVID-19 pandemic, most
states required employers to certify that unemployment insurance
applicants were no longer employed with them before the states
disbursed payments. However, the large volume of unemployed
individuals and urgent need for relief, and an initial requirement in the
Pandemic Unemployment Assistance program that allowed applicants to
self-certify their eligibility without providing any documentation, led
states to forgo employer certification. 54 Instead, states made advance
payments to individuals followed by postpayment verification audits,
which increased opportunities for improper payments, including those
resulting from fraudulent activity. This decision reflects a program’s risk
tolerance. One state official noted that relaxing this unemployment
verification control cost the state hundreds of millions of dollars in
improper payments.
Program managers could have implemented a different verification
control in place of employer certification. For example, sending
unemployment claims to the National Association of State Workforce
Agencies’ Integrity Data Hub for matching across datasets to determine if
the claims had suspicious attributes. 55 Tools such as data matching can
provide some assurance against improper payments, while potentially
allowing for more timely payments.
Similarly, SBA’s COVID-19 EIDL program initially had fewer safeguards
than its traditional EIDL program. Under normal operations, SBA would
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 20
Design and Implement Effective Control Activities
use applicants’ federal tax returns to verify parts of their EIDL applications,
but the CARES Act prohibited SBA from obtaining these returns from
applicants. We and the SBA Office of Inspector General found that such
internal control practices may have led to fraud and the provision of EIDL
funding to ineligible entities. In December 2020, Congress passed
legislation that removed the restriction on obtaining tax returns, but
having access to tax returns from the beginning of the program could
have helped mitigate improper payments to ineligible applicants. 56
Leverage Existing Resources
In emergency assistance programs, managers can leverage existing
resources to design and implement control activities that allow them to
disburse assistance rapidly while mitigating identified risks of improper
payments, including those resulting from fraudulent activity. For example,
CMS’s Accelerated and Advanced Payments Program, expanded under
the CARES Act to relieve the financial strain on health care providers
caused by the pandemic, was able to distribute more than $100 billion in
payments to 46,000 eligible providers by leveraging existing resources.
Specifically, the program used CMS databases, including bankruptcy
databases, and publicly available bankruptcy filing records to determine
whether providers were eligible. In an October 2022 report, the
Department of Health and Human Services (HHS) Office of Inspector
General found that CMS generally made these payments in compliance
with CARES Act and federal requirements. 57
Agencies can also leverage controls used in similar programs. For
example, the DOL Office of Inspector General suggested that the
Pandemic Unemployment Assistance program adopt the same controls as
those used in previous temporary disaster unemployment assistance
programs, which required applicants to substantiate self-certified data on
employment and wages with documentation such as pay stubs, business
records, and tax returns. 58
Some audit, oversight, and government management organizations
similarly told us that if an agency decides to relax certain controls
temporarily to provide assistance quickly, it should still leverage existing
resources to implement some basic controls that mitigate improper
payments. For example, the Pandemic Response Accountability
Committee said program managers can use internal data they already
have, such as mailing addresses from other programs they administer, to
implement prepayment controls that help verify identity without requiring
much additional time.
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 21
Design and Implement Effective Control Activities
Prioritize Prepayment Controls
Prepayment controls can help prevent improper payments by identifying
potential fraud and control deficiencies early, and they generally offer the
most cost-efficient use of resources. 59
For example, in August 2020, DOL’s Employment and Training
Administration, which oversees the unemployment insurance system,
issued guidance to state workforce agencies on implementing
prepayment controls for detecting fraudulent claims, including using the
National Association of State Workforce Agencies’ Integrity Data Hub to
screen claims. 60 While the association estimated that use of the Integrity
Data Hub during the COVID-19 pandemic helped to prevent more than
$178 million in improper payments, its use is optional, and only 32 of 54
state workforce agencies had used or partially used it by December 2020.
In February 2021, the DOL Office of Inspector General identified more
than $5.4 billion in potentially fraudulent unemployment insurance
payments made from March 2020 to October 2020, including benefits
paid to individuals using Social Security numbers of deceased persons
and federal inmates. 61 The DOL Inspector General recommended that the
Employment and Training Administration work with Congress to establish
legislation requiring state workforce agencies to cross-match data before
issuing payments in four high-risk areas, including Social Security
numbers of deceased individuals and federal prisoners.
While program managers should prioritize prepayment controls,
postpayment controls, such as recovery audits, are also important.
However, the “pay and chase model,” where efforts are made to identify
and recover improper payments after they are made, can be difficult and
expensive. 62
As managers implement emergency assistance programs, any reduction in
prepayment controls to provide services and issue payments faster should
be mitigated by strengthening postpayment controls, such as sampling
payments to determine whether they were disbursed properly. For
example, within 8 months of disbursing the first Provider Relief Fund
payments, HHS developed a postpayment quality control review process
to help verify that providers had received correct payments and to recover
any overpayments. HHS stated that because full provider eligibility data
that may not have been available at the time of payment had become
available, program managers would review applicant and payment data to
identify improper payments, reassess provider eligibility, and recover
payments that exceeded a threshold of $10,000. 63 Postpayment controls
can also be used to inform future preventive activities—for example, by
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 22
Design and Implement Effective Control Activities
using the results of audits to enhance applicant screenings and fraud
indicators. 64
Align Controls with Statute
Federal managers of emergency assistance programs should ensure that
controls align with statutory oversight requirements. Emergency
assistance funds will likely have different statutory requirements for
eligibility, allowable spending, and reporting, including in existing
programs that are expanded in an emergency. One agency official told us
that bringing together staff from a variety of offices, such as general
counsel, legislative affairs, operations, and information technology, can
aid in developing and implementing effective and realistic controls that
are consistent with statutory requirements.
Managers of emergency assistance programs in which payment eligibility
decisions are made outside the agency, such as programs that distribute
assistance through state and local governments or nonprofits, should also
ensure that nonfederal program administrators have received sufficient
guidance in creating control activities that align with statutory
requirements. One audit organization told us that federal program
managers should share information about improper payment control
activities with nonfederal entities that may not have the resources to
rapidly design effective controls in an emergency.
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 23
4. Monitor the Effectiveness of Controls in Managing
Improper Payments
As part of managing and overseeing federal emergency assistance, federal
program managers should regularly assess the effectiveness of controls in
managing improper payments. Managers can do this by establishing
monitoring activities, estimating improper payments, analyzing their root
causes, monitoring nonfederal entities’ implementation of emergency
assistance programs, and developing appropriate corrective actions. 65
Establish Monitoring Activities
Program management should assess the internal control system through
ongoing monitoring, which is built into the system and performed
continually, and through separate evaluations, which are used periodically
for a more in-depth analysis of the effectiveness of controls and ongoing
monitoring efforts. 66 A risk-based approach to monitoring can allow
managers to respond quickly to external factors that can influence the
control environment. For example, changes in statutory requirements,
new fraud schemes, or economic instability that accompany a natural
disaster or national emergency can affect the extent to which controls are
effective in addressing improper payment risks. Managers may need to
modify specific control activities accordingly, based on monitoring results.
Estimate Improper Payments
Federal program managers should estimate a program’s annual improper
payments. Estimating a program’s annual improper payments is an
example of a separate evaluation that helps program managers—and the
federal government—understand the scope of the problem and measure
the effectiveness of internal controls in addressing improper payment
risks. 67 Monitoring improper payments on a more frequent and recurring
basis, such as by reviewing a sample of payments monthly or quarterly,
can facilitate taking needed corrective actions on a more timely basis.
Estimating improper payments is especially important for emergency
assistance programs, where the risk of improper payments is higher.
Agencies should ensure that the estimate’s methodology incorporates
emergency-related risks, such as whether the program is new or received
increased funding, whether there are time constraints for spending, and
whether changes were made to existing program eligibility rules.
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 24
Monitor the Effectiveness of Controls in Managing Improper Payments
Analyze the Root Cause
After estimating the improper payments, federal program managers
should analyze the root cause of the improper payments to help prevent
them from recurring. Understanding the root cause will help agencies
develop effective corresponding corrective actions. Identifying the root
cause is an iterative process that can include assessing possible causes
and prioritizing among them. According to OMB guidance, this process
involves asking “why did this occur?” multiple times until the deeper cause
is identified. 68 Table 2 is an example of a root cause analysis from OMB
guidance.
Table 2: Example of Improper Payment Root Cause Analysis
Improper payment Why did this occur? Potential cause Analysis Root cause Possible corrective
category actions
A payment is improperly The agency has access Failure to access Why was the Lack of training Training on how to
issued to a deceased to the data it needs to data/information data/information or automation review information
individual. verify if an individual is not accessed? for checking Automate the eligibility
deceased but did not whether the process to enable data
check that information applicant is access
prior to payment. deceased
Source: GAO analysis of Office of Management and Budget Memorandum M-21-19 | GAO-23-105876.
Monitor Nonfederal Entities
Federal agencies have oversight responsibilities for the funds they award
to nonfederal entities. In emergency assistance programs, nonfederal
entities, such as tribal, state, territorial, and local governments, may be
responsible for implementing policies and procedures and making
payments, while federal program managers oversee and monitor these
nonfederal entities. Federal agencies may rely on nonfederal entities that
are providing the federal assistance to design and implement controls for
mitigating improper payments.
Where federal program managers oversee nonfederal entities, this
oversight can include evaluating the adequacy of the nonfederal entity’s
policies and procedures and other controls. For example, federal program
managers may conduct postpayment testing to validate payments and to
evaluate the nonfederal entity’s compliance with its control activities.
Without appropriate monitoring and evaluation of nonfederal entities,
federal agencies cannot have reasonable assurance that their nonfederal
counterparts are meeting program requirements or effectively managing
risks.
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 25
Monitor the Effectiveness of Controls in Managing Improper Payments
In programs where eligibility determinations are made by nonfederal
entities, nonfederal program administrators may temporarily adjust some
controls to ensure payments are not delayed. However, such adjustments
usually require federal program managers to perform additional
monitoring, as they can increase the risk of improper payments.
For example, the Emergency Rental Assistance program made funding
available to tribal, state, territorial, and local governments to provide
rental assistance during the COVID-19 pandemic. Treasury allowed state
and local program administrators to determine applicant eligibility
through written attestations provided by the applicant (self-certification) if
the applicant could not provide supporting documentation such as a pay
stub to demonstrate income eligibility or a signed lease to demonstrate a
rental obligation. Local auditors noted that the decision to rely on self-
certification expedited application processing but also increased fraud
risks. In February 2022, we recommended that Treasury develop and
implement procedures to monitor and evaluate grantees’ controls,
including providing information on the minimum internal controls
expected for nonfederal entities that rely on self-attestation and other
administrative flexibilities that could increase risks of improper
payments. 69
In addition, certain nonfederal entities are required to undergo a single
audit if their expenditures of federal awards in a fiscal year exceed a
certain threshold. 70 A single audit includes an audit of the recipient’s
expenditure of federal funding and of its financial statements. It can
identify deficiencies in the award recipient’s compliance with the
provisions of laws, regulations, contracts, or grant agreements and in its
financial management and internal controls. Correcting such deficiencies
can help reasonably assure the effective use of federal funds and reduce
improper payments.
Develop Corrective Actions
Effective monitoring can inform the development and implementation of
corrective actions that address identified weaknesses in controls. If
management performs monitoring activities, such as auditing a sample of
disbursed emergency assistance payments, and finds an unacceptable
level of improper payments and develops information on a root cause,
these findings could inform future prepayment controls. 71
For example, at the beginning of the pandemic, SBA relied on applicants
to self-certify that they were eligible for PPP loans, including that they
were not delinquent on any federal loans. When SBA’s Office of Inspector
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 26
Monitor the Effectiveness of Controls in Managing Improper Payments
General later reviewed these payments and corroborated the self-certified
information against other data sources, it found that 57,500 PPP loans
worth $3.6 billion had been issued to potentially ineligible recipients. As a
result, for the third round of PPP distributions, SBA implemented the
corrective action of using the Do Not Pay system to screen new PPP loan
applications. 72
Developing and implementing corrective action plans has been shown to
reduce improper payments. Such plans involve determining the root
causes of improper payments and developing solutions to address them,
and each estimate of an executive agency program’s improper payments
must be accompanied by a report on these plans. Between fiscal years
2018 and 2021, several programs, including Medicare, reported that
corrective action plans had contributed to a reduction in improper
payments. In a study of eight federal programs, we found that the only
one agency correctly adhered to statutory requirements and OMB
guidance for corrective action plans—the Department of Veterans
Affairs—and the estimated improper payment rate in its Prosthetic and
Sensory Aids Service declined by 37.6 percent. 73
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 27
5. Provide and Obtain Information to Manage
Improper Payments
Providing information to and obtaining it from appropriate entities is
necessary for emergency assistance programs to effectively manage
improper payments. Practices that support this principle include providing
clear, timely improper payment information to nonfederal entities and
entities that perform oversight over emergency assistance programs.
Federal managers of emergency assistance programs should also obtain
and use information from nonfederal entities and from state and local
auditors that oversee these entities.
Provide Information to Nonfederal Entities
To manage improper payments, federal managers of emergency
assistance programs should provide timely and quality information to
nonfederal entities, including guidance on program implementation,
eligibility requirements, and appropriate use of funds. 74 We have
previously reported that uncoordinated communication from federal
agencies to state and local jurisdictions, and to providers and the general
public, has caused confusion, frustration, and, in some cases, individuals’
failure to seek or receive emergency assistance. 75
For example, the CARES Act created the Coronavirus Relief Fund to
provide $150 billion in financial assistance to tribal, state, territorial, and
local governments to cover expenses incurred due to the COVID-19
pandemic. The act contained stipulations on the use of funds and
required Treasury to issue payments from the fund within 30 days of
enactment. When Treasury disbursed the funds, it did not provide
recipients with timely information on terms and conditions, including that
the funds could only be used to cover costs incurred between March 21,
2020, and December 30, 2020, among other requirements. 76 A state
auditor we spoke to noted that state agencies that lacked experience as
recipients of federal emergency assistance funds faced challenges with
interpreting what costs were covered by the Coronavirus Relief Fund
payments and required additional guidance on how to interpret the
CARES Act statutory requirements.
In response, Treasury issued three versions of guidance and eight versions
of frequently asked questions; however, these updates caused confusion
about the use of the payments. 77 Further, the Treasury Office of Inspector
General found that, in some cases, the lack of comprehensive, timely
guidance caused ineligible uses of Coronavirus Relief Fund payments.
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 28
Provide and Obtain Information to Manage Improper Payments
More timely information, such as guidance on eligible costs and
definitions of key terms, might have helped recipients properly use funds.
Provide Information to Oversight Entities
Emergency assistance programs should also provide relevant, reliable, and
timely information to external entities with oversight and monitoring
responsibilities. These entities include Congress, federal inspectors
general, and GAO. Programs should provide information to these entities
to ensure that proper oversight of federal dollars is conducted during
emergency circumstances.
Congress needs relevant, reliable, and timely improper payment
information to perform its oversight responsibilities, which can include
using improper payment information for future policy-making decisions.
In addition, Congress may use this information to request evaluation of
these programs by GAO or federal inspectors general. GAO and federal
inspectors general need and use this information to perform their
missions. Specifically, these entities use this information to examine the
use of public funds and evaluate emergency assistance programs and
policies in order to help Congress make informed oversight, policy, and
funding decisions.
To ensure transparency and accountability of public funds, PIIA requires
federal agencies to identify and review all programs and activities above a
certain size that may be susceptible to significant improper payments.
Federal agencies are also required to publish payment integrity
information—including information on improper payments—in the
materials accompanying their annual financial statements. In addition,
PIIA requires federal inspectors general to publicly report on their
determination of federal agencies’ compliance with six statutory criteria as
part of their PIIA compliance reporting. 78 If an agency’s inspector general
determines that the agency is not in compliance with the six criteria listed
in PIIA, that agency must submit a plan to Congress describing the actions
that it will take to come into compliance.
For fiscal year 2021, agencies reported estimated improper payment rates
of 10 percent or greater for 26 risk-susceptible programs and activities,
which accounted for about 87 percent of the government-wide total of
reported estimated improper payments. 79 For fiscal year 2022, agencies
reported estimated improper payment rates of 10 percent or greater for
17 risk-susceptible programs and activities, which accounted for about 59
percent of the government-wide total of reported estimated improper
payments. 80
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 29
Provide and Obtain Information to Manage Improper Payments
Obtain and Use Information from Nonfederal Entities
To manage improper payments, federal program managers of emergency
assistance programs that are administered by nonfederal entities should
obtain and use quality information from these entities. 81 Nonfederal
entities may include those that are public in nature, such as state and local
governments and public higher education institutions. They may also
include private for-profit financial organizations, such as banks and
depository institutions. Finally, nonfederal entities may include nonprofit
organizations, such as community centers and food banks. Congress may
design emergency assistance programs that require federal agencies to
facilitate relief funding through these organizations.
Emergency assistance programs that are administered by nonfederal
government entities may benefit from oversight by state and local
auditors. State and local auditors play a critical role in ensuring the
accountability of nonfederal entities that receive federal emergency
assistance. Federal program managers should ensure they obtain state
and local auditor findings and recommendations and incorporate them
into their risk assessment and monitoring activities. For example, local
auditors identified deficiencies related to improper payments and controls
for determining eligibility in a program administering Emergency Rental
Assistance funds. 82 Specifically, the auditors noted that while the decision
to rely on self-certification made it easier for those without formal
documentation to qualify for awards, it also increased fraud risks. 83
Federal program managers should incorporate such information from
state and local auditors into their programs to reduce fraud risks and
improper payments.
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 30
Appendix I: Congressional Addressees
The Honorable Patty Murray The Honorable Cathy McMorris Rodgers
Chair Chair
The Honorable Susan Collins The Honorable Frank Pallone, Jr.
Vice Chair Ranking Member
Committee on Appropriations Committee on Energy and Commerce
United States Senate House of Representatives
The Honorable Ron Wyden The Honorable Mark E. Green, M.D.
Chairman Chairman
The Honorable Mike Crapo The Honorable Bennie G. Thompson
Ranking Member Ranking Member
Committee on Finance Committee on Homeland Security
United States Senate House of Representatives
The Honorable Bernard Sanders The Honorable James Comer
Chair Chairman
The Honorable Bill Cassidy The Honorable Jamie Raskin
Ranking Member Ranking Member
Committee on Health, Education, Labor and Pensions Committee on Oversight and Accountability
United States Senate House of Representatives
The Honorable Gary C. Peters The Honorable Jason Smith
Chairman Chairman
The Honorable Rand Paul, M.D. The Honorable Richard Neal
Ranking Member Ranking Member
Committee on Homeland Security and Governmental Affairs Committee on Ways and Means
United States Senate House of Representative
The Honorable Kay Granger
Chairwoman
The Honorable Rosa L. DeLauro
Ranking Member
Committee on Appropriations
House of Representatives
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 31
Appendix II: Additional Sources to Use in
Managing Improper Payments
Table 3: Additional Sources to Use in Managing Improper Payments
Source Purpose When/how to use in managing improper payments
Standards for Internal The Federal Managers’ Financial The Green Book provides managers criteria for designing,
Control in the Federal Integrity Act of 1982, as amended, implementing, and operating an effective internal control
Government (known as requires the Comptroller General to system, which is key to preventing and reducing improper
the Green Book) issue standards for internal control in payments. The Green Book defines the standards through
the federal government. Standards for five components:
Internal Control in the Federal
• Control environment
Government provides the overall
framework for establishing and • Risk assessment
maintaining an effective internal control • Control activities
system. • Information and communication
• Monitoring
The Green Book may also be adopted by
The Green Book includes a discussion of how the five
state, local, and quasi-governmental
internal control components relate to an entity’s objectives;
entities, as well as nonprofit
how to evaluate the internal control system’s design,
organizations, as a framework for an
implementation, and operation; and the requirements for
internal control system.
each of the five components, including documentation
requirements.
Managers determine, based on applicable laws and
regulations, how to appropriately adapt the standards
presented in the Green Book as a framework for the entity.
A Framework for GAO’s Framework for Managing Fraud The framework identifies and conceptualizes leading
Managing Fraud Risks in Risks in Federal Programs identifies practices to aid program managers in managing fraud,
Federal Programs leading practices for managing fraud including fraud that results in improper payments. These
risks—an important subset of improper practices relate to the following concepts:
payment risks—and organizes them into
• Commit to combating fraud by creating an
a conceptual framework. The framework
organizational culture and structure conducive to fraud
encompasses control activities to
risk management
prevent, detect, and respond to fraud,
with an emphasis on prevention, as well • Plan regular fraud risk assessments
as structures and environmental factors • Design and implement a strategy with specific control
that influence or help managers achieve activities to mitigate assessed fraud risks
their objective to mitigate fraud risks. • Evaluate outcomes using a risk-based approach and
adapt activities to improve fraud risk management
Effective fraud risk management helps
to ensure that federal programs’ services
fulfill their intended purposes, funds are
spent effectively, and assets are
safeguarded. The purpose of proactively
managing fraud risks is to facilitate, not
hinder, a program’s mission and
strategic goals.
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 32
Payment Integrity PIIA was intended to improve efforts to This act establishes requirements for executive agencies to
Information Act of 2019 identify and reduce government-wide help them manage improper payments, including the
(PIIA) improper payments. following:
• Estimating improper payments and reporting on
actions to reduce improper payments, including
identifying susceptible programs
• Establishing compliance requirements for inspectors
general of executive agencies
• Establishing the Do Not Pay initiative
• Improving recovery of improper payments, including
through setting targets for recovery
• Establishing and maintaining procedures for using data
to prevent and reduce improper payments
• Establishing financial and administrative controls
related to fraud and improper payments
PIIA also continues the requirement that the Office of
Management and Budget (OMB) establish guidelines for
agencies that incorporate leading practices from A
Framework for Managing Fraud Risks in Federal Programs—
specifically, guidelines for agencies to establish financial and
administrative controls to identify and assess fraud risks and
design and implement control activities in order to prevent,
detect, and respond to fraud.
Office of Management OMB M-21-19 provides requirements This guidance explains requirements related to improper
and Budget for assessing and reporting on executive payments, including providing instruction on the following:
Memorandum M-21-19, agency internal controls. • Distinguishing among types of improper payments
Appendix C to OMB The goal of this revised version of OMB • Identifying susceptible programs using an improper
Circular A-123, Circular A-123's Appendix C is to payment risk assessment, including the structure and
Requirements for transform the payment integrity frequency of the risk assessment
Payment Integrity compliance framework and create a
Improvement • Reporting improper payment estimates for susceptible
more comprehensive and meaningful
programs, including suggested sampling and
set of requirements to allow agencies to
estimation methodologies, frequency of reporting, and
spend less time complying with low-
how to report
value activities and more time
researching the underlying causes of • Identifying root causes of improper payments
improper payments, balancing payment • Preventing improper payments, including identifying
integrity risks and controls, and building improper payment risks, making corrective action
the capacity to help prevent future plans, and using databases such as those available via
improper payments. the Do Not Pay working system
• Identifying and setting risk tolerance and improper
payment rate
• Identifying and recovering overpayments
• Inspector general requirements for determining agency
programs’ compliance with PIIA criteria, including
reporting requirements
Source: GAO-14-704G, GAO-15-593SP, 31 U.S.C. § 3351-3357, OMB M-21-19. | GAO-23-105876
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 33
Appendix III: Endnotes
1GAO, Disaster Recovery: Actions Needed to Improve the Federal Approach, GAO-23-104956 (Washington, D.C.: Nov. 15, 2022) and
Disaster Resilience Framework: Principles for Analyzing Federal Efforts to Facilitate and Promote Resilience to Natural Disasters,
GAO-20-100SP (Washington, D.C.: Oct. 23, 2019).
231 U.S.C. § 3351(4). When an executive agency’s review is unable to discern whether a payment was proper as a result of insufficient
or lack of documentation, this payment must also be included in the improper payment estimate. 31 U.S.C. § 3352(c)(2).
3In 2003, federal executive agencies were required by law to begin reporting estimated improper payments for certain programs and
activities. An executive agency is a department, an agency, or an instrumentality in the executive branch of the U.S. government. 31
U.S.C. § 102. Prior year improper payment estimates have not been adjusted for inflation.
4The improper payment estimate reported for fiscal year 2021 does not reflect all government-wide improper payments. Notably,
several agencies with large programs that have been identified as susceptible to significant improper payments have not reported
estimates, and some reported estimates are not comprehensive. Further, with the exception of two Department of Labor (DOL)
unemployment insurance programs, the estimate does not include estimates related to the expenditures to fund response and recovery
efforts for the COVID-19 pandemic. For example, for fiscal year 2021, the Small Business Administration did not report improper
payment estimates for its Paycheck Protection Program (PPP), although it estimated $29 billion in improper payments for fiscal year
2022. Most of the fiscal year 2021 estimate was concentrated in the following areas: the Department of Health and Human Services’
(HHS) Medicaid ($99 billion); DOL’s unemployment insurance ($78 billion); and HHS’s Medicare, which comprises three programs:
Fee-For-Service, Part C, and Part D ($50 billion).
5GAO, Financial Audit: FY 2021 and FY 2022 Consolidated Financial Statements of the U.S. Government, GAO-23-105837
(Washington, D.C.: Feb. 16, 2023). Of 82 programs with reported estimates, 17 reported a rate over 10 percent. However, programs
that were identified by their agency as not susceptible to significant improper payments would not be included in this 82-program
population.
6GAO, Financial Audit: FY 2021 and FY 2020 Consolidated Financial Statements of the U.S. Government, GAO-22-105122
(Washington, D.C.: Feb. 17, 2022). Of 86 programs with reported estimates, 26 reported a rate over 10 percent. However, programs
that were identified by their agency as not susceptible to significant improper payments would not be included in this 86-program
population.
7
GAO has an extensive body of work on improper payments that spans a number of years. Significantly, in March 2022 we
recommended 10 matters for congressional consideration to strengthen internal controls and financial and fraud risk management
practices across the government. We consider these actions to be important steps to more effectively manage improper payments. See
GAO, Emergency Relief Funds: Significant Improvements Are Needed to Ensure Transparency and Accountability for COVID-19 and
Beyond, GAO-22-105715 (Washington, D.C.: Mar. 17, 2022).
8Over this period, agencies’ estimated improper payment rates decreased in 19 of these programs, according to fiscal year 2022
reporting. These changes may be attributable to a number of factors, including agency corrective actions, changes in policies, and
variability (e.g., margin of error) in the process for estimating the payment rates. To identify the number of programs reporting improper
payment estimates, we analyzed paymentaccuracy.gov data from fiscal years 2017 through 2022. Programs had to have a comparable
improper payment estimation methodology from year to year. To determine if a program reported a change in estimation methodology,
we assessed any programs that had a change in either (1) the estimated improper payment amount greater than $100 million and the
estimated improper payment rate greater than 5 percent or (2) the estimated improper payment amount greater than $1 billion.
Paymentaccuracy.gov is a U.S. government website managed by the Office of Management and Budget (OMB) that includes
information about current and historical rates and amounts of estimated improper payments.
9Unemployment insurance programs provide temporary financial assistance to eligible workers who become unemployed through no
fault of their own.
10GAO, COVID-19: Opportunities to Improve Federal Response and Recovery Efforts, GAO-20-625 (Washington, D.C.: June 25, 2020).
A fourth unemployment insurance program was created by the Consolidated Appropriations Act, 2021 and extended by the American
Rescue Plan Act of 2021. See GAO, Unemployment Insurance: Transformation Needed to Address Program Design, Infrastructure,
and Integrity Risks, GAO-22-105162 (Washington, D.C.: June 7, 2022).
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 34
11GAO-22-105715.
12Department of Labor, Office of Inspector General, Testimony Before the U.S. House of Representatives Committee on Ways and
Means, No. 1919-23-003-03-315 (Washington D.C. Feb. 8, 2023). With the exception of the Pandemic Unemployment Assistance
Program, for which claims could be backdated to January 27, 2020, the DOL Inspector General defined the unemployment period as
March 27, 2020, through September 6, 2021. The DOL Inspector General also noted that according to the Employment Training
Administration, it could not provide final total costs of the programs because states were still processing claims that were for weeks of
unemployment prior to expiration of the programs.
13GAO, COVID-19: Additional Actions Needed to Improve Accountability and Program Effectiveness of Federal Response, GAO-22-
105051 (Washington, D.C.: Oct. 27, 2021). DOL and the DOL Inspector General have also reported on the need for improving
management of the unemployment insurance system and program integrity, among other things.
14GAO, COVID-19: Current and Future Federal Preparedness Requires Fixes to Improve Health Data and Address Improper Payments,
GAO-22-105397 (Washington, D.C.: Apr. 27, 2022). SBA made or guaranteed these emergency loans and grants through its PPP and
Economic Injury Disaster Loans. As of March 27, 2022, lenders had made about 11.4 million PPP loans, totaling about $789 billion.
15This information is based on GAO analysis of improper payment estimate data from fiscal year 2022 as reported on
paymentaccuracy.gov. All references to the EIDL program in this report refer to the program administered in response to the COVID-19
pandemic unless otherwise noted.
16GAO-20-625 and GAO, COVID-19: Sustained Federal Action Is Crucial as Pandemic Enters Its Second Year, GAO-21-387
(Washington, D.C.: Mar. 31, 2021).
17GAO, 2017 Disaster Relief Oversight: Strategy Needed to Ensure Agencies’ Internal Control Plans Provide Sufficient Information,
GAO-19-479 (Washington D.C.: June 28, 2019).
18OMB disagreed with our recommendation. OMB staff stated that OMB did not believe the sufficiency or timeliness of control plans
presented material issues that warranted OMB action. OMB staff also stated that agency management and not OMB has responsibility
for ensuring compliance with applicable laws and regulations. While agencies were responsible for submitting their internal
control plans, federal law places the responsibility of establishing the criteria for the internal control plans with OMB. Therefore, we
believe that our recommendation remains warranted.
19The White House, Memorandum on Authorizing the Other Needs Assistance Program for Major Disaster Declarations Related to
Coronavirus Disease 2019 (Aug. 8, 2020). This program was authorized under the Other Needs Assistance category of FEMA’s
Individual and Households program. According to 42 U.S.C. § 5174(a)(1), after a disaster, the President, in consultation with the state
governor, may provide financial assistance to cover necessary expenses and serious needs in cases where the individual or household
is not able to meet such expenses or needs through other means.
20Department of Homeland Security, Office of Inspector General, FEMA Did Not Implement Controls to Prevent More Than $3.7 Billion
in Improper Payments from the Lost Wages Assistance Program, OIG-22-69 (Washington, D.C.: Sept. 16, 2022). FEMA approved Lost
Wages Assistance grant applications totaling more than $37.3 billion in grant obligations for 49 states, four territories, and the District of
Columbia. South Dakota was the only state that did not apply for or participate in the Lost Wages Assistance program. The U.S.
territories that participated in the program were the Northern Mariana Islands, Guam, Puerto Rico, and the U.S. Virgin Islands. As of
April 2022, $36.5 billion had been expended by the state workforce agencies.
21Department of Homeland Security, Office of Inspector General, OIG-22-69. These 21 state workforce agencies distributed more than
80 percent of the $36.5 billion of lost wages assistance—approximately $30 billion in total—and later detected $3.3 billion in potentially
fraudulent payments. In addition, they identified $21.6 million in overpayments and $403 million in payments made without obtaining
claimants’ required self-certifications of eligibility.
22Pub. L. No. 116-136, § 19010, 134 Stat. 281, at 579-81 (2020). See app. I for the list of congressional addressees for this work.
23Pub. L. No. 116-117, 134 Stat. 113 (2020) (codified at 31 U.S.C. §§ 3351-3358); OMB Circular A-123, Appendix C, Requirements for
Payment Integrity Improvement (OMB M-21-19); GAO, Standards for Internal Control in the Federal Government, GAO-14-704G
(Washington, D.C.: Sept. 10, 2014); and GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP
(Washington, D.C.: July 28, 2015).
24These entities are the National Association of State Comptrollers, Auditors and Treasurers; the American Institute for Certified Public
Accountants; the Association of Government Accountants; and the Association of Local Government Auditors.
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 35
25The five components of internal control (Control Environment, Risk Assessment, Control Activities, Information and Communication,
and Monitoring) must be effectively designed, implemented, and operating together in an integrated manner for an internal control
system to be effective.
26In March 2022, we recommended that Congress consider requiring OMB to provide guidance for agencies to develop internal control
plans that would then be ready for use in, or adaptation for, future emergencies or crises and requiring agencies to report these plans to
OMB and Congress. See GAO-22-105715.
27OMB, in coordination with Treasury, developed the Do Not Pay initiative as a web-based, centralized data-matching service for
federal agencies to use in preventing and detecting improper payments. The Do Not Pay working system allows agencies to review
multiple databases before making payments. Although PIIA established the requirement that all executive agencies use Do Not Pay
prior to issuing payments, officials from Treasury’s Bureau of the Fiscal Service told us that not all agencies are in compliance. As of
May 2022, the Bureau of the Fiscal Service was working with 47 federal agencies and 286 federally funded programs. Bureau officials
stated that they conduct significant outreach to increase awareness of the initiative and to bring more agencies into compliance with
PIIA. In 2013, OMB also issued guidance to help agencies protect privacy while reducing improper payments with the Do Not Pay
system. Office of Management and Budget, Protecting Privacy While Reducing Improper Payments with the Do Not Pay Initiative, OMB
Memorandum M-13-20 (Washington, D.C.: Aug. 16, 2013).
28Small Business Administration, Office of Inspector General, Inspection of SBA’s Implementation of the Paycheck Protection Program,
21-07 (Washington D.C.: Jan. 14, 2021).
29Department of Labor, Office of Inspector General, COVID-19: States Struggled to Implement Cares Act Unemployment Insurance
Programs, 19-21-004-03-315 (Washington D.C.: May 28, 2021).
30Individuals who filed a new Pandemic Unemployment Assistance claim on or after January 31, 2021, were required to provide
documentation of employment or self-employment within 21 days of application, or following the state deadline if later (with exceptions
for good cause). Individuals who received Pandemic Unemployment Assistance on or after December 27, 2020, were required to
provide this documentation within 90 days, or within the state deadline if later (with exceptions for good cause). For Pandemic
Unemployment Assistance claims filed on or after January 26, 2021, states were required to use administrative procedures to verify the
identity of Pandemic Unemployment Assistance applicants and provide timely payment, to the extent reasonable and practicable. The
Continued Assistance Act included a new statutory requirement for weekly self-certification by claimants of a COVID-19-related
condition for weeks on or after January 26, 2021. For more information, see also GAO-22-105051.
31Joint Financial Improvement Program, Key Practices to Reduce Improper Payments through Identity Verification (Washington, D.C.:
July 2022).
325 U.S.C. § 552a(o); see also OMB Memorandum M-21-19 and Joint Financial Improvement Program, Key Practices. Federal
executive agencies generally may enter into Computer Matching Agreements with other agencies for ongoing data matching that
assists in the detection and prevention of improper payments. These agreements are limited to 18 months followed by a renewal period
and must contain certain information, such as a description of the records that will be matched.
335 U.S.C. § 552a(b). For example, data sharing between federal agencies may be allowed if it is for a purpose that is compatible with
the purpose for which the data were collected, referred to as routine use. 5 USC 552a(b)(3),(a)(7). While increased data sharing can
help identify and reduce improper payments, identity verification involves individuals’ personal information, such as mailing address,
date of birth, and Social Security number, which can create privacy risks. According to the National Institute of Standards and
Technology (NIST), organizations could potentially mitigate these risks by assessing the risk associated with online transactions and
selecting the appropriate assurance level for each. A low assurance level reduces the amount of personal information that organization
must collect, but increases the risk of improper payments. On the other hand, a high assurance level may increase the burden on
applicants, including those who are not misrepresenting their identities. NIST develops information-security standards and guidelines,
including the minimum requirements for federal information systems. Joint Financial Improvement Program, Key Practices.
34
GAO-20-625. For the economic impact payments made during the pandemic, starting with the fourth batch of payments, the SSA
death records were used by Treasury’s Bureau of the Fiscal Service to identify deceased individuals. This occurred after Treasury and
IRS, in consultation with counsel, determined that such individuals were not entitled to receive the payment.
35Pandemic Response Accountability Committee, Fraud Alert: PRAC Identifies $5.4 Billion in Potentially Fraudulent Pandemic Loans
Obtained Using over 69,000 Questionable Social Security Numbers (Jan. 30, 2023).
36For more information, see GAO, High Risk Series: Dedicated Leadership Needed to Address Limited Progress in Most High-Risk
Areas, GAO-21-119SP (Washington, D.C.: Mar. 2, 2021). Due to Medicare’s size, complexity, and susceptibility to improper payments,
GAO first designated it as a high-risk program in 1990.
37GAO-21-119SP.
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 36
38GAO-15-593SP.
39GAO, Identity Theft: IRS Needs to Strengthen Taxpayer Authentication Efforts, GAO-18-418 (Washington D.C.: June 22, 2018).
40GAO made 11 recommendations. Of those, IRS had addressed 10 by September 2022; it had partially addressed the remaining
recommendation as of January 2023.
41GAO-20-625; Small Business Administration, Office of Inspector General, Inspection of Small Business Administration’s Initial
Disaster Assistance Response to the Coronavirus Pandemic, 21-02 (Oct. 28, 2020); and Department of Labor, Office of Inspector
General, Alert Memorandum: The Pandemic Unemployment Assistance Program Needs Proactive Measures to Detect and Prevent
Improper Payments and Fraud, 19-20-002-03-315 (May 26, 2020).
42Pandemic Response Accountability Committee, Lessons Learned in Oversight of Pandemic Relief Funds Updated (Washington D.C.:
June 8, 2022).
43Federal program managers are responsible for identifying, assessing, and responding to risks (including the potential for fraud) while
a program seeks to achieve its objectives. According to Standards for Internal Control in the Federal Government, a risk assessment is
the identification and analysis of risks related to achieving the defined objectives, and the assessment forms the basis for designing risk
responses. When conducting a risk assessment, managers should consider internal risk factors, such as the complex nature of the
program, and external factors, such as potential natural disasters. To focus managers’ attention on the need to take a more strategic,
risk-based approach to managing fraud risks, managers are required to consider the potential for fraud and fraud risks as part of their
risk assessment activities. GAO’s Framework for Managing Fraud Risks in Federal Programs provides comprehensive guidance for
conducting these assessments and using the results as part of the development of a robust antifraud strategy. Additionally, some
programs may be statutorily required to do other types of risk assessments, such as an improper payment risk assessment. OMB
Memorandum M-21-19 provides additional guidance to agencies on conducting the improper payment risk assessment.
44A state auditor told us that the COVID-19 pandemic created unique personnel challenges that affected distribution of funds. For
example, staff had to work from home, and in certain situations they did not have the proper equipment to do so. The auditor noted that
only eight of the 54 staff within the office owned a laptop to be able to conduct work remotely.
45GAO-20-625 and Pandemic Response Accountability Committee, Lessons Learned.
46Pandemic Response Accountability Committee, Lessons Learned, and Small Business Administration, Office of Inspector General,
21-02.
47OMB Memorandum M-21-19 and GAO-14-704G. According to federal internal control standards, program managers should define
their risk tolerances and consider them in the context of the applicable laws, regulations, and standards as well as the agency’s
standards of conduct, oversight structure, organizational structure, and expectations of competence. An internal control system is a
continuous built-in component of operations, effected by people, that provides reasonable assurance, not absolute assurance, that an
entity’s objectives will be achieved.
48By statute, agencies must conduct improper payment risk assessments at least once every 3 years for all programs with annual
outlays of more than $10 million. PIIA defines “significant” improper payments as improper payments in the preceding fiscal year that
may have exceeded either (1) 1.5 percent of program outlays and $10 million or (2) $100 million (regardless of the improper payment
rate). 31 U.S.C. § 3352(a).
49OMB Memorandum M-21-19.
50After the first improper payment risk assessment is conducted, agencies can adjust the time frame so future assessments are aligned
or staggered with other agency programs on a 3-year improper payment risk assessment cycle. OMB Memorandum M-21-19.
51GAO-21-191.
5231 U.S.C. § 3352. OMB designates programs with estimated improper payments resulting in a monetary loss greater than or equal to
$100 million as high-priority programs, which are subject to requirements in addition to those for programs deemed susceptible to
improper payments. See OMB Memorandum M-21-19.
53GAO-14-704G. According to federal internal control standards, management should consider the potential for fraud when identifying,
analyzing, and responding to risks.
54
The CARES Act created the Pandemic Unemployment Assistance program and initially allowed applicants to self-certify their eligibility
and did not require them to provide any documentation of self-employment or prior income. The Consolidated Appropriations Act of
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 37
2021 included a requirement for individuals to submit documentation of employment or self-employment when applying for the
Pandemic Unemployment Assistance program. See GAO-22-105051.
55The National Association of State Workforce Agencies’ Integrity Data Hub provides states a secure and centralized platform to assist
in detecting and preventing fraud, identity theft, and improper payments in the unemployment insurance program. The platform brings
state workforce agencies together to compare and analyze claims data for enhanced detection and prevention of fraud and improper
payments. Specifically, states can submit unemployment insurance claims data to the data hub, which then cross-matches these data
with a variety of datasets to determine if a claim has suspicious attributes that may indicate fraud or identity theft before the agency
issues payment. As we previously reported, according to DOL Inspector General officials, some state IT systems may not have been
easily compatible with the Integrity Data Hub. See GAO-22-105162.
56GAO-21-387; Small Business Administration, Office of Inspector General, Follow-Up Inspection of SBA’s Internal Controls to Prevent
COVID-19 EIDLs to Ineligible Applicants, 22-22 (Washington D.C.: Sept. 29, 2022); and Pandemic Response Accountability
Committee, Lessons Learned.
57Of the 109 provider payment requests that the HHS Office of Inspector General included in its audit, 100 were correctly paid, six were
incorrectly approved but CMS identified the error before the payment was made, and in three of the cases, CMS identified the errors
immediately after the payments were made and recovered the improper payments. Department of Health and Human Services, Office
of Inspector General, Payments Made to Providers Under the COVID-19 Accelerated and Advance Payments Program Were Generally
in Compliance with the CARES Act and Other Federal Requirements (Washington, D.C.: October 2022).
58Department of Labor, Office of Inspector General, 19-20-002-03-315. In addition, the DOL Inspector General recommended that the
department seek additional guidance or clarification from Congress concerning whether a claimant is entitled to establish and continue
to receive Pandemic Unemployment Assistance payments without providing documentation. The department agreed to consult with
Congress and provide technical assistance if Congress wished to amend the self-certification provision within the Pandemic
Unemployment Assistance program to require submission of documentation to substantiate an individual’s previous employment. The
DOL Inspector General closed this recommendation on April 28, 2021, based on actions taken by Congress when it created
documentation requirements for Pandemic Unemployment Assistance claimants in the Continued Assistance to Unemployed Workers
Act of 2020.
59For more information, see GAO-15-593SP.
60The Integrity Data Hub allows state workforce agencies to perform various cross-matches of data, such as identifying claims filed
using deceased persons’ and federal inmates’ Social Security numbers. Department of Labor, Office of Inspector General, Alert
Memorandum: The Employment and Training Administration Needs to Ensure State Workforce Agencies Implement Effective
Unemployment Insurance Program Fraud Controls for High Risk Areas, 19-21-002-03-315 (Washington D.C.: Feb. 22, 2021).
61Department of Labor, Office of Inspector General, 19-21-002-03-315.
62Postpayment reviews and improper payment recovery audits are financial management practices that agencies can use to determine
whether payments were made appropriately to eligible recipients in correct amounts and used by recipients in accordance with law and
applicable agreements. “Pay and chase” refers to the practice of detecting improper payments after payments have been made and
attempting to recover funds.
63Department of Health and Human Services, Office of Inspector General, HHS’s and HRSA’s Controls Related to Selected Provider
Relief Fund Program Requirements Could Be Improved (Washington, D.C.: September 2022). In October 2021, we recommended that
the Health Resources and Services Administration (HRSA), within HHS, establish time frames for completing postpayment reviews and
finalize and implement procedures for postpayment recovery of any Provider Relief Fund improper payments. GAO-22-105051.
64GAO-15-593SP.
65According to federal internal control standards, program managers should (1) monitor the effectiveness of internal controls (including
internal controls to mitigate improper payments and fraud risk) and evaluate the results and (2) remediate identified internal control
deficiencies on a timely basis.
66GAO-14-704G.
67Under certain circumstances, executive agencies are statutorily required to produce an annual estimate of a program’s improper
payments, i.e., if the program has been determined through the improper payment risk assessment to be susceptible to significant
improper payments, or otherwise as required by law. 31 U.S.C. § 3352(c)(1) and OMB Memorandum M-21-19. While improper
payments could suggest that a program may be vulnerable to fraud, improper payment estimates are not valid indicators of the extent
of fraud in a particular program.
68OMB Memorandum M-21-19.
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 38
69GAO, Emergency Rental Assistance: Additional Grantee Monitoring Needed to Manage Known Risks, GAO-22-105490 (Washington
D.C.: Feb. 10, 2022). Treasury did not agree or disagree with our recommendation. Treasury stated it planned to update its compliance
testing procedures to include information on control systems expected for grantees that rely on administrative flexibilities, which
generally aligned with our recommendation.
70Pub. L. No. 98-502, 98 Stat. 2327 (1984) (codified, as amended, at 31 U.S.C. §§ 7501-7506). States, local governments, and
nonprofit organizations that expend $750,000 or more in federal awards in a fiscal year are required to undergo a single audit or, in
limited circumstances, a program-specific audit.
71One step that can help support improved audits would be to have a more complete Compliance Supplement, which is issued annually
by OMB and provides guidance to auditors performing single audits of nonfederal entities that receive funding from federal assistance
programs. OMB requires federal awarding agencies to provide annual updates to agency program information before publishing the
supplement each year, including adding additional requirements as a result of changes in statutory or regulatory requirements, such as
those in the COVID-19 relief laws. The agency-specific information included in the supplement can support an auditor’s determination
of whether the recipient has complied with federal statutes, regulations, and award terms. Without the supplement, auditors would need
to research many statutes and regulations for each program under audit to identify compliance requirements that could have a direct
and material effect on that program. In April 2022, we recommended that the Departments of Education, Health and Human Services,
and the Treasury document their policies and procedures for providing information to OMB to better enable OMB to annually update the
Compliance Supplement. Establishing written policies and procedures could help expedite OMB’s final issuance of the supplement,
ensure that concerns can be resolved prior to issuance, and strengthen the quality of single audit guidance. As of January 2023, these
recommendations had not been implemented.
72Pandemic Response Accountability Committee, Lessons Learned; Small Business Administration, Office of Inspector General,
Paycheck Protection Program Loan Recipients on the Department of Treasury’s Do Not Pay List, 21-06 (Washington D.C. Jan. 11,
2021).
73GAO, Payment Integrity: Selected Agencies Should Improve Efforts to Evaluate Effectiveness of Corrective Actions to Reduce
Improper Payments, GAO-20-336 (Washington, D.C.: Apr. 1, 2020).
74According to federal internal control standards, management should externally communicate the necessary quality information to
achieve the entity’s objectives. GAO-14-704G.
75GAO, Influenza Pandemic: Lessons from the H1N1 Pandemic Should Be Incorporated into Future Planning, GAO-11-632
(Washington, D.C.: June 27, 2011).
76The CARES Act also stipulated that Coronavirus Relief Fund recipients only use the funds for costs that (1) were necessary
expenditures incurred due to the public health emergency with respect to COVID-19 and (2) were not accounted for in the budget most
recently approved as of March 27, 2020.
77Department of the Treasury, Office of Inspector General, American Rescue Plan—Application of Lessons Learned from the
Coronavirus Relief Fund, OIG-CA-21-020 (Washington D.C.: May 17, 2021).
78
PIIA requires offices of inspector general to report on executive agency compliance with six statutory criteria: (1) publishing payment
integrity information with the annual financial statement and posting the annual financial statement and any accompanying materials as
required under OMB guidance on the agency website; (2) conducting improper payment risk assessments for any program or activity
with annual outlays greater than $10 million at least once every 3 years to identify each program or activity that may be susceptible to
significant improper payments; (3) if required, publishing improper payment estimates for each such identified susceptible program or
activity in the accompanying materials to the annual financial statement; (4) publishing a corrective action plan for each such identified
susceptible program or activity in the accompanying materials to the annual financial statement; (5) publishing an improper payment
reduction target for each such susceptible program and activity in the accompanying materials to the annual financial statement and
demonstrating improvements and developing a plan to meet the reduction target; and (6) reporting an improper payment estimated rate
of less than 10 percent for each program and activity for which an estimate was published in the accompanying materials to the annual
financial statement. OMB Memorandum M-21-19 expands these six criteria into 10 by breaking down some criteria into subcomponents
and, in some cases, adding new elements.
79GAO-22-105122.
80GAO-23-105837.
81According to federal internal control standards, management should use quality information to achieve the entity’s objectives. GAO-
14-704G.
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 39
82GAO-22-105490. Section 501 of Division N of the Consolidated Appropriations Act, 2021 appropriated $25 billion for the delivery of
emergency rental assistance to eligible households suffering unemployment or other financial hardship due to the novel coronavirus
pandemic. Treasury allocated these funds to states, the District of Columbia, U.S. territories, Indian Tribes, tribally designated housing
entities, the Department of Hawaiian Homelands, and units of local government. Congress later appropriated an additional
$21,550,000,000 for emergency rental assistance under the American Rescue Plan Act of 2021.
83Office of the Inspector General, Montgomery County, Maryland, COVID-19 Rental Assistance Programs (Rockville, Md.: Oct. 8,
2021).
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 40
Appendix IV: GAO Contact and Staff Acknowledgments
GAO Contacts
For more information on fraud risk, contact Johana Ayers at (202) 512-6722 or ayersj@gao.gov.
For more information on improper payment risk, contact Beryl Davis at (202) 512-2623 or davisbh@gao.gov.
Staff Acknowledgments
In addition to the contacts named above, Dan Garcia-Diaz (Managing Director), Alicia Puente Cackley
(Director), Andrew Pauline (Assistant Director), Brandon Jones (Analyst-in-Charge), and Sarah Garcia
(Analyst-in-Charge) made key contributions to this publication. Also contributing to this publication were
Stephanie Adams, Robert Dacey, Jason Kirwan, Jill Lacey, Diana Lee, Kun-Fang Lee, Maria McMullen, Marc
Molino, Jessica Sandler, Jennifer Schwartz, Rebecca Shea, and Matthew Valenta.
A Framework for Managing Improper Payments in Emergency Assistance Programs | GAO-23-105876 Page 42
GAO’s Mission
The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress
in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal
government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and
provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding
decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimonies
The fastest and easiest way to obtain copies of GAO documents at no cost is through our website. Each weekday
afternoon, GAO posts on its website newly released reports, testimony, and correspondence. You can also subscribe to
GAO’s email updates to receive notification of newly posted products.
Order by Phone
The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number
of pages in the publication and whether the publication is printed in color or black and white.
Pricing and ordering information is posted on GAO’s website, https://www.gao.gov/ordering.htm.
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order.
Call for additional information.
Connect with GAO
Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Subscribe to our RSS Feeds or Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.
To Report Fraud, Waste, and Abuse in Federal Programs
Contact FraudNet:
Website: https://www.gao.gov/about/what-gao-does/fraudnet
Automated answering system: (800) 424-5454 or (202) 512-7700
Congressional Relations
A. Nicole Clowers, Managing Director, ClowersA@gao.gov, (202) 512-4400, U.S. Government Accountability Office,
441 G Street NW, Room 7125, Washington, DC 20548
Public Affairs
Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, DC 20548
Strategic Planning and External Liaison
Stephen J. Sanford, Managing Director, spel@gao.gov, (202) 512-4707
U.S. Government Accountability Office, 441 G Street NW, Room 7814, Washington, DC 20548
File and source
- File
- gao-23-105876.pdf
- Size
- 2,287,200 bytes
- SHA-256
- df3c81a134f900954f5c6c19fed4470ea89649856e95f62acfd94c49f5ea1bad
- Our copy
- gao-23-105876.pdf
- Original
- www.gao.gov