EPA Was Not Compliant with the Payment Integrity Information Act for Fiscal Year 2021


OFFICE OF INSPECTOR GENERAL

U.S. ENVIRONMENTAL PROTECTION AGENCY

CUSTOMER SERVICE * INTEGRITY * ACCOUNTABILITY

Compliance with the law

The EPA Was Not Compliant
with the Payment Integrity
Information Act for Fiscal
Year 2021

Report No. 22-P-0050

June 27, 2022

FY 2021 reporting

Allowability
of costs

Improper grant
payments

© O

° 0 °

\



A

-------
Report Contributors:	Catherine Allen

Melinda Burks
Komlan Gbezan
Chikara Mbah
Patrick Mclntyre
Gabriel Porras-Sanchez
Khadija Walker

Abbreviations:

AFR

Agency Financial Report



C.F.R.

Code of Federal Regulations



EPA

U.S. Environmental Protection Agency



FY

Fiscal Year



OCFO

Office of the Chief Financial Officer



OIG

Office of Inspector General



OMB

Office of Management and Budget



PI IA

Payment Integrity Information Act of 2019



SOP

Standard Operating Procedure

Key Definitions:

Please see Appendix A for key definitions.

Cover Image:

Payments for unallowable expenses are improper payment dollars.
(EPA OIG image)

Are you aware of fraud, waste, or abuse in an
EPA program?

EPA Inspector General Hotline

1200 Pennsylvania Avenue, NW (2431T)
Washington, D.C. 20460
(888) 546-8740
(202) 566-2599 (fax)

OIG Hotline@epa.gov

Learn more about our 0!G Hoiiine.

EPA Office of Inspector General

1200 Pennsylvania Avenue, NW (2410T)
Washington, D.C. 20460
(202) 566-2391

Subscribe to our" ;V;;
Follow us on Twitter!
Send us your j

-------
Office of Inspector General

U.S. Environmental Protection Agency

At a Glance

22-P-0050
June 27, 2022

Why We Did This Audit

The Office of Inspector General
conducted this audit to determine
whether the U.S. Environmental
Protection Agency met the
requirements of the Payment
Integrity Information Act of 2019
as they relate to the formulation
and inclusion of payment integrity
information in the Fiscal
Year 2021 Agency Financial
Report and accompanying
materials.

The Payment Integrity
Information Act of 2019 requires
inspectors general to determine
and report their agencies'
compliance with the Act every
fiscal year. The Act also requires
the heads of each agency to
periodically review and identify all
programs and activities with
costs exceeding the $10-million
statutory threshold that may be
susceptible to significant
improper payments. Prior to
fiscal year 2021, the EPA had
designated its grants payments
as susceptible to significant
improper payments.

This audit supports EPA mission-
related efforts:

•	Compliance with the law.

•	Operating efficiently and
effectively.

This audit addresses a top EPA
management challenge:

•	Managing infrastructure funding
and business operations.

Address inquiries to our public
affairs office at (202) 566-2391 or
OIG WEBCOMMENTS@epa.gov.

List of OIG reports.

The EPA Was Not Compliant with the Payment
integrity Information Act for Fiscal Year 2021

The EPA needs to implement
appropriate control
measures to better identify
and reduce the risk of its
improper payments.

What We Found

The EPA was not compliant with the Payment
Integrity Information Act of 2019 because the
Agency did not adhere to all of the Office of
Management and Budget improper payment
reporting requirements for fiscal year 2021.

Specifically, the EPA did not adequately
conclude whether its programs with annual outlays greater than $10 million
were likely to make improper payments above or below the statutory threshold.

The EPA divides its expenditures into ten payment streams, eight of which have
annual outlays greater than $10 million. In fiscal year 2021, with respect to the
grants payment stream, while the Agency reviewed payments to determine the
error rate and estimate the value of improper payments, it did not incorporate
the cost-allowance principles set forth in 2 C.F.R. part 200, subpart E. This
oversight occurred because the Office of the Chief Financial Officer's Standard
Operating Procedure Grants Improper Payment Review, which was updated in
September 2021, was not completed in time to use for the fiscal year 2021 risk
assessment. The standard operating procedure is intended to be used to review
the allowability of grant payments. For the remaining seven payment streams
with outlays greater than $10 million, the EPA did not establish an adequate
methodology for determining risk-assessment attributes and results.

The Agency may not have reported approximately $10.3 million in improper
payments—of which approximately $8.6 million may be subject to recovery—
because it did not apply the cost-allowance principles in the Agency's review of
grants payments. Further, because the EPA has not established an adequate
methodology for risk assessments, the Agency's risk-assessment process does
not provide reasonable assurance that payment streams are not susceptible to
improper and unknown payments above the statutory threshold or, in other
words, are susceptible to significant improper payments.

Recommendations and Planned Agency Corrective Actions

We make four recommendations to the chief financial officer, which address
reviewing the OIG-identified questioned costs, determining the payment
allowability, recovering costs and recalculating the error rate, conducting an
off-cycle risk assessment, updating applicable standard operating procedures,
and training Agency personnel on the application of cost principles. The EPA
agreed with our recommendations and provided an acceptable corrective action
for one recommendation. However, it did not provide acceptable corrective
actions for the remaining three recommendations. Recommendation 3 is
resolved with corrective actions pending. Recommendations 1, 2, and 4 remain
unresolved.

-------
UNITED STATES ENVIRONMENTAL PROTECTION AGENCY

WASHINGTON, D.C. 20460

THE INSPECTOR GENERAL

June 27, 2022

MEMORANDUM

SUBJECT: The EPA Was Not Compliant with the Payment Integrity Information Act
for Fiscal Year 2021
Report No. 22-P-0050

FROM: Sean W. O'Donnell

TO:

Faisal Amin, Chief Financial Officer

This is our report on the subject audit conducted by the Office of Inspector General of the
U.S. Environmental Protection Agency. The project number for this audit was QA-FY22-0028. This report
contains findings that describe the problems the OIG has identified and corrective actions the OIG
recommends. Final determinations on matters in this report will be made by EPA managers in accordance
with established audit resolution procedures.

The Office of the Chief Financial Officer is responsible for the issues discussed in this report. In accordance
with EPA Manual 2750, your office provided an acceptable planned corrective action and estimated
milestone date for Recommendation 3. This recommendation is resolved. A final response pertaining to
this recommendation is not required; however, if you submit a response, it will be posted on the OIG's
website, along with our memorandum commenting on your response.

Action Required

Recommendations 1, 2, and 4 are unresolved. EPA Manual 2750 requires that recommendations be
resolved promptly. Therefore, we request that the EPA provide us within 60 days its responses concerning
specific actions in process or alternative corrective actions proposed on the recommendations. Your
response will be posted on the OIG's website, along with our memorandum commenting on your response.
Your response should be provided as an Adobe PDF file that complies with the accessibility requirements
of Section 508 of the Rehabilitation Act of 1973, as amended. The final response should not contain data
that you do not want to be released to the public; if your response contains such data, you should identify
the data for redaction or removal along with corresponding justification. The Inspector General Act of
1978, as amended, requires that we report in our semiannual reports to Congress on each audit or evaluation
report for which we receive no Agency response within 60 calendar days.

We will post this report to our website at www.epa.gov/oig.

-------
The EPA Was Not Compliant
with the Payment Integrity
Information Act for Fiscal Year 2021

22-P-0050

Table of C

Chapters

1	Introduction	1

Purpose	1

Background	1

Responsible Offices	3

Scope and Methodology	4

Prior Reports	5

PIIA Compliance Table	5

2	The EPA Needs to Improve Risk Assessments to Adequately Conclude Whether

Program Improper and Unknown Payments Exceed the Compliance Threshold	7

The PI IA Requires Agencies to Conduct Risk Assessments to Determine Whether

Payments Exceed Statutory Threshold	7

The EPA Did Not Test Grant Payments for Cost Principles	9

The Grant SOP Used Does Not Require an Analysis of Cost Principles	11

The Risk Assessments for Programs on the Three-Year Review Cycle Were Insufficient,

and the Agency Lacked Clear Guidance for Conducting the Assessments	12

Conclusions	13

Recommendations	13

Agency Response and OIG Assessment	14

Status of Recommendations and Potential Monetary Benefits	17

Appendixes

A Key Definitions	18

B Agency Response to Draft Report	19

C Distribution	23

-------
Chapter 1

Introduction

Purpose

The U.S. Environmental Protection Agency's Office of Inspector General initiated this audit to determine
whether the EPA met the requirements of the Payment Integrity Information Act of 2019, or PIIA, as
they relate to the formulation and inclusion of payment integrity information in the Fiscal Year 2021
Agency Financial Report, or AFR, and accompanying materials.

Top Management Challenge Addressed

This audit addresses the following top management challenge for the Agency, as identified in OIG Report
No. 22-N-0004. EPA's Fiscal Year 2022 Top Management Challenges, issued November 12, 2021:

• Managing infrastructure funding and business operations.

Background

To improve efforts to identify and reduce governmentwide improper payments, Congress enacted the
PIIA on March 2, 2020. The PIIA repealed and replaced several related acts, including the:

• Improper Payments Information Act of 2002.

• Improper Payments Elimination and Recovery Act of 2010.

• Improper Payments Elimination and Recovery Act of 2012.

• Fraud Reduction and Data Analytics Act of 2015.

As noted in the PIIA, agencies must implement the Act's requirements in accordance with the guidance
that the Office of Management and Budget, or OMB, set forth and provided in Appendix C to OMB
Circular A-123, Management's Responsibility for Internal Control, which is also titled OMB
Memorandum M-21-19, Requirements for Payment Integrity Improvement. The March 2021 revision of
Appendix C outlined ten specific requirements related to the PIIA that agencies had to implement in
fiscal year 2021 to be in compliance with the Act. We
detail these ten requirements in the "PIIA Compliance
Table" section later in this chapter.

The PIIA directs the head of each executive agency to
periodically review all agency-administered programs
and activities—hereafter referred to collectively as
"programs"—with annual outlays greater than
$10 million, which is the statutory threshold set forth in
the PIIA, and to identify those programs that may be
susceptible to significant improper payments. Agency
heads must conduct these periodic reviews, generally referred to as "risk assessments," not less than
once every three years. As described in Appendix C to OMB Circular A-123, these risk assessments can
be either qualitative or quantitative but must reasonably determine whether a program is susceptible to

Improper and Unknown Payments

The PIIA defines an improper payment as "any
payment that should not have been made or that
was made in an incorrect amount, including an
overpayment or underpayment, under a statutory,
contractual, administrative, or other legally
applicable requirement."

An unknown payment is a payment that cannot be
determined either proper or improper because of
insufficient or lack of documentation.

22-P-0050

-------
significant improper payments. A quantitative risk-assessment reviews disbursements to formulate the
overall estimated improper payment rate. A qualitative risk assessment may use questionnaire
responses or other forms of data to identify the risk of improper payments.

Appendix C to OMB Circular A-123 states that a program is susceptible to significant improper payments
if the total improper and unknown payment amount exceeds the statutory threshold. The statutory
threshold for a program is either (1) both 1.5 percent of program outlays and $10 million of all program
payments made during the fiscal year or (2) $100 million of estimated improper payments.

Requirements for Programs Susceptible to Significant Improper Payments

For programs that are deemed susceptible to significant improper payments, the OMB requires agencies
to conduct statistically valid sampling-and-estimation quantitative risk assessments. The OMB further
requires agencies to publish both improper and unknown payment estimates for these programs in the
accompanying materials of the AFR. For agencies to achieve compliance, they must submit a Sampling
and Estimation Methodology Plan to the OMB in the fiscal year following the one in which the program
in question was deemed likely to be susceptible to improper payments.

To be compliant with the PIIA, agencies must report an improper and unknown payment estimate of less
than 10 percent for each program for which an estimate was published in the accompanying materials
of the AFR. Each program with an improper or unknown payment estimate above 10 percent is
considered noncompliant with the PIIA.

¦ Improper Payment Reporting

The EPA has divided its programs into ten payment streams. Eight of the EPA's ten payment streams
exceed $10 million in annual outlays and are thus required to undergo risk assessments at least once
every three years.

Beginning in its FY 2016 AFR, the Agency reported that one of those eight payment streams—the grants
payment stream—was susceptible to significant improper payments. Since making that determination,
the EPA annually conducted a sampling-and-estimation quantitative risk assessment for the grants
payment stream to determine an error rate for and to estimate the total dollar value of improper and
unknown payments.

In FY 2021, the EPA conducted the required sampling-and-estimation quantitative risk assessment for
the grants payment stream, as well as a combination of quantitative and qualitative risk assessments for
the seven other payment streams with outlays of over $10 million. Based on these risk assessments, the
EPA determined and subsequently reported in its FY 2021 AFR that none of the Agency's payment
streams were susceptible to significant improper payments (Table 1). Accordingly, the EPA stated that it
would not conduct any risk assessments again for three years, which would be in FY 2024.

Despite this determination, the EPA still reported information regarding the grants payment stream
improper payments in its FY 2021 AFR. The AFR noted that the EPA gathered and finalized this improper
payment information before determining that the grants payment stream was no longer susceptible to
significant improper payments. Specifically, the Agency reported grants payment stream outlays of
$1.63 billion, grants payment stream improper payments of $8.18 million, and grants payment stream
unknown payments of $8.15 million. Although the grants payment stream had total improper and
unknown payments exceeding $10 million, the grants payment stream was not deemed subject to

22-P-0050

-------
significant improper payments because it did not meet the additional statutory threshold of 1.5 percent
of annual outlays.

Table 1: EPA FY 2021 assessment of improper payment susceptibility

Payment stream

Exceeds $10 million in
annual outlays?

Is susceptible to significant
improper payments?

Commodities

Yes

No

Contracts

Yes

No

Clean Water State Revolving Fund

Yes

No

Drinking Water State Revolving Fund

Yes

No

Grants

Yes

No

Hurricane Sandy

Yes

No

Payroll

Yes

No

Purchase Cards

Yes

No

Travel

No

Not applicable

2018 Disaster Relief

No

Not applicable

Source: OIG analysis of data from the FY 2021 AFR. (EPA OIG table)

The OIG's Payment Integrity Requirements

The PI IA requires each agency's inspector general to annually determine the agency's compliance with
the PI IA and issue a report on that determination. Furthermore, Appendix Cto OMB Circular A-123
requires that:

•	Inspectors general evaluate the accuracy and completeness of their agencies' improper
payments reporting.

•	Agencies publish risk assessments at least once every three years for programs with outlays
above $10 million.

•	OIGs evaluate the risk assessments to determine if they adequately conclude whether the
program is likely to make improper and unknown payments above or below the statutory
threshold.

•	If an OIG determines that a risk assessment incorrectly identified whether a program or activity
was likely to make improper and unknown payments above or below the statutory threshold,
the OIG recommend changes to the agency's improper payment risk-assessment methodology.
Such recommendations may include that the agency conduct an off-cycle risk assessment.

Appendix C also states that an agency, at its own discretion, may determine that it should undertake an
off-cycle risk assessment for various reasons, including a significant increase in the funding level of a
program.1

Responsible Offices

The Office of the Chief Financial Officer, or OCFO, formulates the EPA's Annual Budget and Performance
Plan; coordinates the EPA's strategic-planning efforts; develops the EPA's Annual Performance Report

1 The Agency, because of an influx of appropriations from the Infrastructure Investment and Jobs Act, which was
enacted November 15, 2021, will see a significant increase in funding for grant programs.

22-P-0050

3

-------
and AFR; implements the Government Performance and Results Act; provides financial services for the
EPA; and makes payments to grant recipients, contractors, and other vendors. The OCFO is responsible
for creating policies for, issuing reports on, and providing oversight of the EPA's financial operations. The
Office of the Controller develops, manages, and supports the Agency's financial management by
interpreting fiscal legislation, maintaining fiscal operations, and implementing governmentwide external
reporting reforms.

Scope and Methodology

We conducted this performance audit from November 2021 to May 2022 in accordance with generally
accepted government auditing standards. Those standards require that we plan and perform the audit
to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions
based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our
findings and conclusions based on our audit objective.

We assessed the internal controls necessary to satisfy our audit objective.2 In particular, we assessed
the internal control components—as outlined in the U.S. Government Accountability Office's Standards
for Internal Control in the Federal Government—significant to our audit objective. Any internal control
deficiencies we found are discussed in this report. Because our audit was limited to the internal control
components deemed significant to our audit objective, it may not have disclosed all internal control
deficiencies that may have existed at the time of the audit. We assessed the control environment and
risk assessments. Additionally, we assessed the Agency's activity against the OMB Circular A-123
Appendix C requirement that programs proactively manage their payment integrity risk to prevent
improper and unknown payments. In combatting payment integrity risk, it is important to assess the
Agency's controls and the control environment.

To determine whether the EPA complied with the PIIA, we reviewed the EPA's FY 2021 AFR and its
accompanying materials. We also reviewed the Agency's Federal Managers' Financial Integrity Act
assurance letters; standard operating procedures, or SOPs; and risk-assessment methodologies. We
interviewed OCFO staff at EPA headquarters to obtain an understanding of the processes, procedures,
and controls used for improper payment detection and reporting across the EPA. To test transactions,
we used the Council of Inspectors General on Integrity and Efficiency's Guidance for Payment Integrity
Information Act Compliance Reviews, dated October 2021.

In accordance with Appendix C to OMB Circular A-123, OIGs are required to evaluate and report
whether their agencies are compliant with the PIIA. In FY 2021, the Agency conducted risk assessments
for eight payment streams that exceeded outlays of $10 million, as described in Table 1. While the EPA
reported in its FY 2021 AFR that the grants payment stream was no longer susceptible to significant
improper payments, the Agency still performed a quantitative risk assessment of the grants payment
stream. Therefore, the OIG was required to evaluate that risk assessment to verify the Agency's
determination that the grants payment stream was not susceptible to significant improper payments.

2 An entity designs, implements, and operates internal controls to achieve its objectives related to operations,
reporting, and compliance. The U.S. Government Accountability Office sets internal control standards for federal
entities in GAO-14-704G, Standards for Internal Control in the Federal Government, issued September 10, 2014.
These standards are the foundation for establishing and maintaining internal control, as well as for identifying and
addressing significant management challenges and areas at the greatest risk for fraud, waste, abuse, and
mismanagement.

22-P-0050

-------
To evaluate this, we judgmentally selected 25 (roughly 10 percent) of the 240 grant payments that the
EPA used to complete its risk assessment. We selected these 25 payments, which were made from
October 2019 through March 2021, based on their inherent risk and dollar value. The 240 grant
payments totaled $24,362,536, and the 25 grant payments we reviewed totaled $11,987,085—almost
one-half of the value of the grants that the Agency reviewed. We reviewed these 25 payments and
supporting documentation to identify any payment that that the Agency should not have made.

For the other seven payment streams with outlays over $10 million, we measured the content of the
completed assessments against the criteria for qualitative and quantitative assessments in Appendix C
to OMB Circular A-123.

Prior Reports

From 2019 to 2021, the OIG issued three reports—EPA OIG Report No. 21-P-0135. Report No. 19-P-Q163,
and Report No. 20-P-0167—pertaining to the EPA's compliance with the PIIA. In all three of those
reports, we noted a significant deficiency in applying the cost principles to the Agency's review process.
Also, in OIG Report No. 21-P-0135, we recommended that the EPA revise the OCFO's SOP for grants
improper payment reviews, titled Standard Operating Procedure Grants Improper Payment Review, to
include the cost-allowance principles set forth in 2 C.F.R. part 200, subpart E, in the EPA's improper
payment estimates for the grants payment stream and to provide training to staff on the updated SOP.
The Agency agreed with our recommendations and proposed to (1) limit the cost-allowance principles to
2 C.F.R. §§ 200.402-200.411 and not the entirety of subpart E and (2) apply those C.F.R. provisions for
risk assessments only when a program was designated susceptible to improper payments. The OIG
concurred with the proposed corrective actions. According to the EPA, the OCFO revised the Standard
Operating Procedure Grants Improper Payment Review, in September 2021, which was after the Agency
conducted the FY 2021 improper payment risk assessments. Therefore, we did not evaluate the
completeness of the corrective actions while reviewing the Agency's FY 2021 compliance with the PIIA.
As such, we did not determine whether the corrective action adequately included all cost principles that
federally funded grantees must follow.

PIIA Compliance Table

Appendix C to OMB Circular A-123 requires that each OIG report pertaining to PIIA compliance include a
high-level summary that clearly states the agency's overall compliance status. We determined that the
EPA did not comply with the requirement to adequately conclude whether programs with annual
outlays greater than $10 million were likely to make improper and unknown payments above or below
the statutory threshold. We determined that the EPA complied with five of the PIIA's other
nine requirements and that the other four requirements were not applicable. Table 2 summarizes our
findings on PIIA compliance.

22-P-0050

-------
Table 2: FY 2021 EPA PIIA compliance reporting table

Compliance element

Payment stream

Commodities

Contracts

Clean Water SRF

Drinking Water SRF

Grants

Hurricane Sandy

Payroll

Purchase Card

1a. Published payment integrity information with the annual
financial statement

~

~

~

~

~

~

~

~

1 b. Posted the annual financial statement and accompanying
materials on the agency website

~

V

~

~

~

~

~

~

2a. Conducted improper payment risk assessments for each
program with annual outlays greater than $10 million at least
once in the last three years

~

V

~

~

~

~

~

~

2b. Adequately concluded whether the program is likely to make
improper and unknown payments above or below the statutory
threshold*

X

X

X

X

X

X

X

X

3. Published improper and unknown payments estimates for
programs susceptible to significant improper payments in the
accompanying materials to the annual financial statement

~

~

~

~

~

~

~

~

4. Published corrective action plans for each program for which
an estimate above the statutory threshold was published in the
accompanying materials to the annual financial statement

*

*

*

*

*

*

*

*

5a. Published improper and unknown payment reduction target
for each program for which an estimate above the statutory
threshold was published in the accompanying materials to the
annual financial statement

*

*

*

*

*

*

*

*

5b. Demonstrated improvements to payment integrity or reached
a tolerable improper and unknown payment rate

*

*

*

*

*

*

*

*

5c. Developed a plan to meet the improper and unknown
payment reduction target

*

*

*

*

*

*

*

*

6. Reported an improper and unknown payment estimate of less
than 10 percent for each program for which an estimate was
published in the accompanying materials to the annual financial
statement

~

~

V

V

V

V

~

~

Source: EPA FY 2021 AFR. (EPA OIG table)

* Because the Purchase Card and Hurricane Sandy payment streams have significantly lower annual outlays, we
acknowledge that the probability that improper and unknown payments are above the threshold for these streams
is low. However, based on the Agency's inadequate methodologies, we cannot support the Agency's conclusions.

Legend:

V Complaint
X Noncompliant
* Not Applicable
SRF State Revolving Fund

22-P-0050

6

-------
Chapter 2

The EPA Needs to Improve Risk Assessments
to Adequately Conclude Whether Program
Improper and Unknown Payments
Exceed the Compliance Threshold

In FY 2021, the EPA was not compliant with one of the ten PIIA requirements under Appendix C to OMB
Circular A-123; therefore, the Agency was not compliant with the PI I A. Specifically, we found that the
EPA did not adequately conclude whether the EPA's eight payment streams with annual outlays greater
than $10 million were likely to make improper and unknown payments above or below the statutory
threshold, as follows:

•	For the grants payment stream, the Agency's improper payment procedures did not require the
use of the cost-allowance principles in 2 C.F.R. part 200, subpart E, when determining whether a
payment was improper.

•	For the remaining seven payment streams, the EPA's risk assessments were insufficient because
the EPA had not established an adequate methodology for determining risk-assessment
attributes and results.

Because the Agency did not apply the cost-allowance principles when reviewing the allowability of
payments for the grants payment stream, the Agency, which only reported $89,000 in improper grant
payments, should have potentially reported more than $10.3 million in improper grant payments. This
would mean that the Agency, which reported the improper payment rate to be 0.5 percent in its
FY 2021 AFR, should have potentially reported that rate to be 21 percent. The Agency has recovered
approximately $1.7 million of these improper payments, leaving $8.6 million that is potentially subject
to recovery. Further, by not establishing an adequate methodology for both qualitative and quantitative
risk assessments, the Agency cannot provide reasonable assurance that payment streams are not
susceptible to significant improper payments.

The PIIA Requires Agencies to Conduct Risk Assessments
to Determine Whether Payments Exceed Statutory Threshold

In accordance with Appendix C to OMB Circular A-123, each agency should develop an improper
payment risk-assessment methodology for programs with outlays greater than $10 million to ensure
that the results of the agency's risk assessments reasonably support whether the programs are likely to
make improper and unknown payments above or below the statutory threshold or, in other words, are
susceptible to significant improper payments. Agencies may choose to conduct a qualitative or
quantitative assessment. If a qualitative risk assessment is performed, the agency should develop and
apply a risk-scoring methodology to determine whether payment streams exceed the statutory
threshold. It is the agency's responsibility to determine the risk factors and the associated weighting
methodology for each program and risk. A quantitative assessment uses numerical data to determine
whether a payment stream exceeds the statutory threshold. This type of assessment must include
support to verify the calculated error rate or estimated improper payment dollars.

22-P-0050

7

-------
In FY 2021, the EPA conducted qualitative and quantitative risk assessments for the eight payment
streams that had expenditures over $10 million to determine whether the payment streams were
susceptible to significant improper payments. The risk assessments included reviews of payment data
and associated risks that covered multiple time periods ranging from July 2018 to June 2021.

Because the EPA reported in its FY 2020 AFR that the grants payment stream was susceptible to significant
improper payments, the Agency was required by Appendix C to OMB Circular A-123 to provide an
improper payment rate estimate for the program in the following fiscal year. The Agency prepared this
estimate using a statistical sampling methodology that incorporated a review of 240 selected grant
payments. When the Agency identifies any questioned costs in such an estimate, the OCFO submits those
questioned costs to the Grants Management Office to determine whether the payments were improper.

The OIG is responsible for evaluating the completeness and accuracy of the EPA's risk-assessment
methodology to determine whether the Agency is in compliance with the PI I A. Appendix C to OMB
Circular A-123 states that agencies should be mindful that OIGs must consider the adequacy of the
risk-assessment methodology used to evaluate compliance. OIG compliance evaluations will determine
whether the audits, examinations, and legal actions indicate a higher risk of improper payments.
Therefore, when developing a risk-assessment methodology, the OMB encourages agencies to review
the results of audits and to consider whether the results affect the risk of improper payments.

For the seven EPA payment streams (other than the grants payment stream) that the EPA did not
previously identify as being subject to significant improper payments and that the EPA conducts risk
assessments for every three years, we evaluated the:

• Risk assessments conducted.

• Methodology that the Agency used to determine if the risk assessments adequately concluded
whether the programs were likely to make improper and unknown payments above or below
the statutory threshold.

• Accuracy of the improper and unknown payment estimates and whether the Sampling and
Estimation Methodology Plan that the Agency used was appropriate given the programs'
characteristics.

• Improper payment risk-assessment methodology of the programs, including whether:

o Audits, examinations, and legal actions indicated a higher risk of improper payments,
o Actual improper payments were included in the improper payment risk assessments.

• Agency and program efforts to prevent and reduce improper and unknown payments.

In addition, we determined whether the Agency had published the results of risk assessments in the
Agency's AFR.

For the Agency's grants payment stream, we assessed the methodology for the EPA's review of the
240 grant payments. We applied the "questioned-cost" criteria defined in Appendix C to OMB
Circular A-123, which requires that we classify a cost as questionable if it:

• Resulted from a violation or possible violation of a statute, a regulation, or the terms and
conditions of a federal award, including those for funds used to match federal funds.

22-P-0050

-------
•	Was not supported by adequate documentation.

•	Appeared unreasonable and did not reflect the actions a prudent person would take in the
circumstances.

The EPA Did Not Test Grant Payments for Cost Principles

The Agency used the Standard Operating Procedure Grants Improper Payment Review to determine the
method for selecting and testing grant payments for improper payments in FY 2021. The Standard
Operating Procedure Grants Improper Payment Review did not incorporate the cost-allowance principles
prescribed in 2 C.F.R. part 200, subpart E, and all its subsections. In response to OIG Report
No. 21-P-0135, the Agency agreed to a proposed corrective action to incorporate the limited cost
principles in 2 C.F.R. part 200, subpart E, into an updated grant payment SOP. While the Agency stated
that it issued an updated SOP in September 2021 for future reviews that included the cost principles in
2 C.F.R. part 200, subpart E, and all its subsections, the updated SOP was not completed in time to be
implemented for the FY 2021 AFR risk assessments. Because the Agency used the old SOP for these
assessments, the Agency did not apply the cost principles.

In 16 (64 percent) of the 25 grants that the OIG reviewed, there was insufficient documentation to
support the costs or payments that were actual or possible violations of a statute, regulation, or grant
terms; therefore, grant recipients were paid for unallowable costs. Table 3 shows the results of the
OIG's review of payments and the OIG's identified questioned costs.

Table 3: Results of OIG-selected grants and areas of noncompliance

No.

Award number

Draw amount

Improper
payments
reported by
the EPA

Questioned

costs
identified by
the OIG

Potential or

actual
violation of

statute,
regulation, or
grant terms

Insufficient
documentation

1

BG00A00355

$51,686.00

$0

$48,106.36



X

2

196891001

80,496.00

0

45,938.62



X

3

PA00J99101

95,178.41

0

95,164.51



X

4

BG99T90420

150,000.00

0

119,280.99



X

5

GA99T78501

112,242.97

0

112,242.97

X



6

GA99T78501

130,323.00

0

130,323.00

X



7

DE01F24301

1,363,078.00

0

1,363,078.00

X



8

CB-96331101-7

371,904.51

0

371,904.51



X

9

BF00A005190

297,430.30

0

0





10

83587301

137,580.92

0

53,650.62



X

11

BF00E02375

77,530.92

0

15,676.14



X

12

00E02060

620,964.00

0

620,964.00

X

X

13

01J12201

1,851,776.62

0

1,851,776.62

X



14

00615819-2

410,429.86

0

410,429.86



X

15

99T29201

1,769,375.69

0

1,769,375.69

X



16

00905519

509,825.00

0

0





17

00E01523

1,573,164.61

0

1,573,164.61

X

X

18

BG98542816

1,103,020.00

0

805,216.91

X

X

19

C6-00E99209-3

168,877.75

0

58,617.75



X

20

L00640514-2

397,047.00

0

397,047.00



X

21

BG99T52020-1

161,178.73

40,462.24

0





22

83938701

360,135.31

4,164.57

355,970.74



X

23

A00408120

133,462.87

9,686.21

123,776.66



X

22-P-0050

9

-------
No.

Award number

Draw amount

Improper
payments
reported by
the EPA

Questioned

costs
identified by
the OIG

Potential or

actual
violation of

statute,
regulation, or
grant terms

Insufficient
documentation

A98055711-0

22,596.25

GA01J22401

37,780.51

12,398.06

25,382.45

Total

$11,987,085.23

$89,307.33

$10,347,088.01

Source: OIG analysis of gathered data (EPA OIG table)

Legend:

X Noncompliant

We questioned costs for 21 (approximately 84 percent) of the 25 grants we reviewed because there was
insufficient documentation to support the costs that the grant recipients claimed. For example, the
Agency reimbursed a grant recipient without receiving an invoice or other supporting documentation. If
requested, recipients are required, per grant terms and conditions, to provide supporting
documentation for reimbursement of costs. In addition, 2 C.F.R. § 200.403(g) requires that costs be
"adequately documented" to be allowable. According to Appendix C to OMB Circular A-123, when an
agency's review is unable to determine whether a payment was proper because of insufficient or
missing documentation, the payment must be considered an unknown payment.

For eight (approximately 32 percent) of the 25 grants we reviewed, we questioned costs for violations or
potential violations of a statute, regulation, or grant terms. For example, the Agency reimbursed a
recipient for a tax expense of $171,234.12 that may have been subject to a tax exemption. Pursuant to
2 C.F.R. § 400.470, the payment of taxes is not allowable if the taxes are subject to an exemption
afforded the federal government. Although 2 C.F.R. § 400.470 was not one of the cost-allowance
principles that the Agency agreed to apply in its corrective action, the OIG, in undertaking its own
review, applied all applicable regulations during the OIG's PIIA auditing.

There were also instances in which the Agency already identified and recovered improper payments but
did not report them in the FY 2021 AFR. For example, a recipient erroneously withdrew and
subsequently returned funds on two occasions; however, the EPA did not report these transactions as
improper payments because the recipient returned the funds. Although the funds were recovered, the
grant withdrawals were improper payments at the time that they occurred. They are considered
improper payments that the Agency should report, even though there are no amounts that would be
subject to recovery. From the 25 grant files we reviewed, we identified approximately $1.7 million that
the Agency recovered because the funds were improperly paid; however, the Agency did not report the
funds as improper payments.

The EPA reported $89,307 in improper payments. In contrast, the OIG identified a total of $10,347,088
in questioned costs. Since these questioned costs resulted from an analysis of only 25 (approximately
10 percent) of the 240 grants that the Agency reviewed, there is a high probability that additional
improper and unknown payments exist within the remaining 215 grants. Based on our analysis, the
Agency may have underreported its improper and unknown payments by $10,256,781. If the Office of
Grants and Debarment determines these payments to be improper, the Agency's reported error rate
could increase from 0.50 percent to 21.88 percent—a recalculation that would indicate that the grants
payment stream exceeded the statutory threshold. Of the $10.3 million in payments the OIG identified,
the Agency has recovered approximately $1.7 million that needed to be reported, leaving approximately
$8.6 million as potentially recoverable.

22-P-0050

-------
The Grant SOP Used Does Not Require an Analysis of Cost Principles

The Agency's January 2020 version of Standard Operating Procedure Grants Improper Payment Review,
which the Agency used as guidance for the FY 2021 improper payment reviews, does not require OCFO
reviewers to analyze the allowability of costs according to 2 C.F.R. part 200, subpart E. As such, the
OCFO's review of grant payments was limited to examining supporting documentation for the following
three components:

• Purpose: there was an authorized need or intent for the cost.

• Time: the cost was incurred within the time frame of the grant.

• Amount: the cost was within the limits of the grant budget.

The Standard Operating Procedure Grants Improper Payment Review requires that any OCFO payment
reviewer who has questions about a particular cost refer the matter to the EPA's Office of Grants and
Debarment for further review. We concluded that the OCFO review did not fully apply cost principles,
which led to underreporting at least $10 million in questioned costs to the Office of Grants and
Debarment. Of the 25 grant payments, totaling $11,987,085.23, that we selected for review, OCFO grant
reviewers referred $89,307.33, or less than 1 percent, to the Office of Grants and Debarment for
examination of cost allowability. The other grant payments were never reviewed for cost allowability
beyond the limited analysis of purpose, time, and amount.

OCFO officials previously took the position that improper payment legislation does not require the
inclusion of the 2 C.F.R. part 200 requirement in reviews subject to significant improper payments.
Rather, OCFO management and staff interpreted the cost principles in 2 C.F.R. part 200, subpart E, as
pertaining to grant compliance reviews, which the OCFO does not perform. Additionally, OCFO
reviewers told us that their main priority was to follow the Standard Operating Procedure Grants
Improper Payment Review, which does not require the application of the C.F.R. cost-allowance
principles. OCFO reviewers could not provide sufficient evidence to support that the amounts paid met
the cost principles. However, Appendix C to OMB Circular A-123 advises agencies to be mindful that,
when evaluating compliance, inspectors general must consider the adequacy of the risk assessment and
methodology used.

In EPA OIG Report No. 20-P-0167, we noted the Agency's lack of inclusion of cost-allowance principles in
the Agency's review of grant payments and recommended that the Agency include the criteria in the
Standard Operating Procedure Grants Improper Payment Review. The Agency agreed to the corrective
action, but the updated Standard Operating Procedure Grants Improper Payment Review was issued in
September 2021 and was, therefore, not updated in time for the FY 2021 review. The Agency's planned
corrective action was to apply limited cost-allowance principles (that is, 200 C.F.R. §§ 400.402-400.411)
only when a program was identified as being susceptible to significant improper payments. Because the
Agency was unable to implement the updated Standard Operating Procedure Grants Improper Payment
Review for its FY 2021 AFR risk assessment, we do not believe that the Agency adequately concluded
that the grants payment stream was no longer likely to make significant improper and unknown
payments under the statutory threshold. Moreover, even had the Agency been able to implement the
updated SOP, we would have still needed to determine whether the revised SOP—which included only
limited cost-allowance principles—would be sufficient to determine PIIA compliance. Accordingly, we
believe that it is necessary for the Agency to conduct an off-cycle risk assessment for the grants
payment stream rather than wait another three years.

22-P-0050

-------
The Risk Assessments for Programs on the Three-Year Review Cycle
Were Insufficient, and the Agency Lacked Clear Guidance for
Conducting the Assessments

The EPA conducted 12 risk assessments for the eight payment streams that had outlays over $10 million.
However, none of the 12 assessments contained sufficient support for the weighting methodology used
for each program and risk, with the exception of the grants payment stream. We found that the risk
assessments were insufficient or that they only accounted for a portion of the payment stream. Further,
the Agency lacked a standard methodology to adequately determine program susceptibility to making
improper payments. Table 4 presents the results of our analysis of the risk assessments for the payment
streams with annual outlays of more than $10 million.

Table 4: The OIG's review of the EPA's risk assessments

Payment stream

Risk assessment

Deficiencies the OIG identified

Commodities

1 qualitative
1 quantitative

• No support provided for the process to assign scores to the
qualitative risk assessment.

• Insufficient support to verify the error rate or estimated dollars
for the quantitative risk assessment.

Contracts

2 qualitative
1 quantitative

• No support provided for the process to assign scores to the
qualitative risk assessment.

• No consolidated qualitative risk-assessment score provided.

• Insufficient support to verify the error rate or estimated dollars
for the quantitative risk assessment.

Clean Water State
Revolving Fund

1 qualitative

• Incomplete with not all required data included.

• No support provided for the process to assign scores to the
qualitative risk assessment.

Drinking Water State
Revolving Fund

1 qualitative

• Incomplete with not all required data included.

• No support provided for the process to assign scores to the
qualitative risk assessment.

Hurricane Sandy

1 quantitative

• Insufficient support to verify the error rate or estimated dollars
for the quantitative risk assessment.

• No analysis of unknown payments.

Payroll

1 quantitative

• Insufficient support to verify the error rate or estimated dollars
for the quantitative risk assessment.

Purchase Card

2 qualitative

• No support provided for the process to assign scores to the
qualitative risk assessment.

• No consolidated qualitative risk-assessment score provided.

Grants

1 quantitative

• No cost principles included. See OIG analysis of grants payment
stream in Table 3.

Total

12 Assessments

Source: OIG analysis of payment stream risk assessments. (EPA OIG table)

Payment Streams Complicated the Risk-Assessment Process

To conduct risk assessments, the Agency divided improper payment reviews into payment streams
instead of programs (see Chapter 1, Table 1). Appendix C to OMB Circular A-123 allows agencies to
determine the most appropriate grouping of activities that would constitute a program. However, it
states the grouping should be in a manner that most clearly identifies and reports improper payments
for the agency. In addition, Appendix C to OMB Circular A-123 states that the agency should not put

22-P-0050

-------
activities into groupings that may mask significant improper payment estimates by the large size or
scope of the grouping. We identified more than 40 programs with outlays over the $10-million
threshold. The OCFO did not provide a reconciliation of these programs; therefore, we could not
determine which programs were included in the ten payment streams. The risk assessments were
ultimately compiled by payment streams, and program risk information was disjointed, sometimes
missing, and incomplete. The decision to delineate programs via payment streams and the lack of
standards to outline the process for conducting the risk assessments led to them being incomplete. For
example, the Hurricane Sandy payment stream had outlays greater than $10 million. The Agency
advised that the risk assessment for the Hurricane Sandy payment stream was included in the Clean and
Drinking Water State Revolving Fund assessments. However, it was not clear to us that the Hurricane
Sandy payments were included in those assessments because the Agency did not delineate the
programs captured within each payment stream. As such, we could not determine whether the Agency
appropriately evaluated this payment stream for compliance.

The OC d Not Hav ? \ ess for Conducting Risk Assessments

OCFO officials and staff indicated significant deficiencies in both the risk-assessment process and the
scoring methodology. OCFO officials stated that the risk-factor weighting methodology was subjective in
nature and structured around the judgment or experience of the payment-integrity reviewer. OCFO staff
told us that, unlike the Standard Operating Procedure Grants Improper Payment Review for risk
assessments, they do not have an SOP for performing the risk assessments for payment streams other
than the grants payment stream. This lack of guidance includes an absence of standard policies and
procedures for identifying risk factors for the improper-payment reporting or the risk-factor weighting
process. Lastly, reviewers stated that they did not have enough time to fully complete the assessments
for two of the payment streams—the Clean and Drinking Water State Revolving Funds.

Conclusions

The EPA may not have reported $10,256,781 in improper grant payments, of which approximately
$8.6 million is potentially subject to recovery. This oversight occurred because the Agency did not apply
the cost-allowance principles in its review of grants payments. Further, by not having an adequate
methodology for scoring risk assessments, the Agency's risk-assessment process does not provide
reasonable assurance in determining whether payments streams are susceptible to significant
improper payments.

When the EPA reports unreliable improper payment estimates in the AFR, Agency leadership, Congress,
and the public cannot be assured that the EPA has the appropriate internal-control measures and
focused strategies to identify and reduce the risk of improper payments. Improving SOPs and
considering the allowability of grant costs would aid the EPA in more accurately estimating improper
payments and lead to better use of funds for environmental and supporting programs.

Recommendations

We recommend that the chief financial officer:

1. Review the OIG-identified questioned costs for the grants payment stream, determine the
payment allowability, recover costs as appropriate, and recalculate the error rate.

22-P-0050

-------
2. Conduct an off-cycle risk assessment, applying the Standard Operating Procedure Grants
Improper Payment Review, dated September 2021, and include the risk assessments in the
Agency's Fiscal Year 2023 Agency Financial Report, ensuring that the risk assessments contain:

a. An assessment of all programs and activities with outlays greater than $10 million.

b. An identification of which programs and activities with annual outlays exceeding the
statutory threshold are included in each risk assessment.

c. A mechanism for identifying, accounting for, estimating, and reporting improper and
unknown payments and for detailing efforts taken to prevent and reduce such
payments.

3. For payment streams other than the grants payment stream, update the standard operating
procedures so that they establish a sufficient methodology for programs and activities with
outlays of more than $10 million to adequately conclude whether they are susceptible to
significant improper payments. The standard operating procedures should identify which
programs or activities are included.

4. Periodically train Agency personnel on and provide completed course training certificates for:

a. The Standard Operating Procedure Grants Improper Payment Review, dated
September 2021, which includes the Payment Integrity Information Act Review
Checklist. Such training should include any updates to these documents and emphasize
the application of the cost-allowance principles and adherence to the terms and
conditions of federal awards.

b. All standard operating procedures, as well as any updates to them, implemented for
other payment streams.

Agency Response and OIG Assessment

The Agency provided a response to our draft report (Appendix B). In that response, the OCFO stated that
it disagrees with the OIG's finding that the EPA was not compliant with FY 2021 OMB improper payment
reporting requirements. The OCFO stated that the finding implies that it did not follow improper
payment requirements because its review was based on OMB Memorandum M-18-20, Improving the
Management of Federal Programs and Projects through Implementing the Program Management
Improvement Accountability Act (PMIAA). OMB Memorandum M-18-20, which was issued in June 2018
and preceded OMB Memorandum M-21-19 and Appendix C to OMB Circular A-123, was the guidance in
place when the EPA started its improper grant payments review in October 2020. In the OCFO's view,
OMB Memorandum M-21-19 and Appendix C to OMB Circular A-123, which were issued in March 2021
and guided the OIG's review, should not be applied retroactively. However, the OCFO agrees with the
OIG that cost principles should be incorporated in grants payment stream improper payment reviews.

The OIG maintains that its finding of noncompliance is appropriate. Both OMB Memorandums M-18-20
and M-21-19 define improper payments to mean any payment that was an incorrect amount under any
"legally applicable requirements," which would include the cost principles set forth in 2 C.F.R. part 200,
subpart E, that govern federal grants, to determine program susceptibility to improper payments. In

22-P-0050

-------
addition, the OIG's determination of noncompliance was based not only on the nonapplication of cost
principles for the grants payment stream but also on the deficiencies noted in this report regarding the
other payment stream risk-assessment methodologies that did not sufficiently determine whether a
program exceeded the statutory threshold.

With regard to specific report recommendations, the OCFO responded that it agreed with
Recommendation 1. The OCFO has referred the OIG-questioned costs to the Office of Grants and
Debarment to determine which costs are improper. Any costs deemed improper will be reported in the
FY 2022 AFR. However, the OCFO did not state that it would include a recalculated error rate or recover
costs that were deemed improper. Therefore, we consider this recommendation unresolved.

The OCFO stated that it agreed with Recommendation 2, but its corrective actions did not fully address
all the parts of the recommendation. More specifically:

• Recommendation 2 stated that the Agency should conduct an off-cycle risk assessment for the
grants payment stream, with three subparts for what the off-cycle assessment should include.
While, as discussed below, the OCFO stated that it agreed with the recommendation subparts, it
did not expressly state that it would conduct an off-cycle review.

• For Recommendation 2a, the OCFO stated that it agreed with our recommendation to do an
assessment of all programs and activities with outlays greater than $10 million. However, the
OCFO did not state that it would provide an assessment. Instead, the OCFO stated that it would
"provide documentation to support the OMB's approval" of the OCFO's use of payment
streams.

• For Recommendation 2b, although the OCFO stated that it agreed with our recommendation for
an identification of programs and outlays exceeding the statutory threshold, it stated that it
already has documented methodologies for identifying, accounting for, estimating, and
reporting improper and unknown payments. In its response, the OCFO proposed to consolidate
the various existing methodologies; however, the OIG concluded in this report that those
methodologies do not sufficiently address the weighting methodology required to be used to
measure program risk. As such, the consolidation of existing methodologies does not satisfy the
intent of the recommendation.

• For Recommendation 2c, although the OCFO stated that it agreed with our recommendation for
establishing a mechanism for identifying, accounting for, estimating, reporting, and preventing
improper and unknown payments, the OCFO stated that it will assess the roles and
responsibilities regarding the incorporation of cost principles and implement them into the

FY 2023 improper payment review. However, it is unclear how this this action ties to the
recommendation, which is to provide a mechanism for addressing, reporting, and preventing
improper and unknown payments.

Based on the above, we consider Recommendation 2 unresolved.

The OCFO agreed with Recommendation 3, stating that it would update current internal guidance
documents into a consolidated SOP. The OCFO provided a corrective action completion date of
October 1, 2022. This corrective action satisfies our recommendation; therefore, we consider this
recommendation resolved with corrective actions pending.

22-P-0050

-------
Recommendation 4 stated that the OCFO should train Agency personnel on all improper payment SOPs,
including training specific to the cost-allowance principles for the grants payment stream. While the
OCFO agreed that it would "coordinate all payment streams to ensure that agency personnel are trained
and documentation of the training is retained/' the OCFO did not expressly agree to provide training
with respect to the application of the cost-allowance principles for the grants SOP. Since the OCFO only
partially addressed the overall recommendation, we consider Recommendation 4 unresolved.

22-P-0050

16

-------
Status of Recommendations
and Potential Monetary Benefits

RECOMMENDATIONS

Rec.
No.

Page
No.

Subject

Status1

Action Official

Planned
Completion
Date

Potential
Monetary
Benefits
(in $000s)

1

13

Review the OIG-identified questioned costs for the grants
payment stream, determine the payment allowability, recover
costs as appropriate, and recalculate the error rate.

U

Chief Financial Officer



$8,624

2

14

Conduct an off-cycle risk assessment, applying the Standard
Operating Procedure Grants Improper Payment Review, dated
September 2021, and include the risk assessments in the
Agency's Fiscal Year 2023 Agency Financial Report, ensuring
that the risk assessments contain:

a.	An assessment of all programs and activities with outlays
greater than $10 million.

b.	An identification of which programs and activities with annual
outlays exceeding the statutory threshold are included in
each risk assessment.

c.	A mechanism for identifying, accounting for, estimating, and
reporting improper and unknown payments and for detailing
efforts taken to prevent and reduce such payments.

U

Chief Financial Officer





3

14

For payment streams other than the grants payment stream,
update the standard operating procedures so that they establish
a sufficient methodology for programs and activities with outlays
of more than $10 million to adequately conclude whether they
are susceptible to significant improper payments. The standard
operating procedures should identify which programs or activities
are included.

R

Chief Financial Officer

10/1/2022



4

14

Periodically train Agency personnel on and provide completed
course training certificates for:

a.	The Standard Operating Procedure Grants Improper
Payment Review, dated September 2021, which includes the
Payment Integrity Information Act Review Checklist Such
training should include any updates to these documents and
emphasize the application of the cost-allowance principles
and adherence to the terms and conditions of federal
awards.

b.	All standard operating procedures, as well as any updates to

U

Chief Financial Officer





them, implemented for other payment streams.

1 C = Corrective action completed.

R = Recommendation resolved with corrective action pending.
U = Recommendation unresolved with resolution efforts in progress

22-P-0050

17

-------
Appendix A

Key Definitions

Improper Payment: A payment that was made in an incorrect amount under statutory, contractual,
administrative, or other legally applicable requirements.

Payment Integrity Information Act of 2019: An Act that requires agencies to identify, report, and reduce
improper payments in their programs. Federal agencies are required to assess and identify high-risk or
significant programs and activities and share these findings in an annual publication.

Questioned Cost: A cost that is questioned by the auditor because of an audit finding, including that the
cost resulted from a violation or possible violation of statute, regulation, or the terms and conditions of
the award or that the cost was not supported by adequate documentation.

Unknown Payment: A payment that cannot be determined to be proper or improper because of
insufficient or lacking documentation.

22-P-0050

18

-------
Appendix B

Agency Response to Draft Report

UNITED STATES ENVIRONMENTAL PROTECTION AGENCY

WASHINGTON, D.C. 20460

June 7, 2022

OFFICE OF THE
CHIEF FINANCIAL OFFICER

MEMORANDUM

SUBJECT: Response to the Office of Inspector General Draft Report, Project No. OA-FY22-0028,
"The EPA Was Not Compliant with the Payment Integrity Information Act for Fiscal
Year 2021, " dated May 20, 2022

FROM: Faisal Amin, Chief Financial Officer Amin, Amt^ Fabai"6''^

Office of the Chief Financial Officer FdlSal —e-

TO: Khadija Walker, Director

Business Operations Audits
Office of Audit

Thank you for the opportunity to respond to the issues and recommendations in the subject draft report.
The following is a summary of the U.S. Environmental Protection Agency's overall position, along with
its position on the report's recommendations.

AGENCY'S OVERALL. POSITION

The draft report contains four recommendations for the Office of the Chief Financial Officer. The OCFO
generally agrees with the Office of Inspector General's recommendations. However, the OCFO does not
support the finding of non-compliance. The OIG's decision to not find the OCFO compliant implies the
agency did not follow improper payment regulations applicable during our FY 2021 improper payment
review, which began in October 2020 and concluded in March 2021.

The OCFO's FY 2021 review was based on the Office of Management and Budget's guidance M-18-20,
"Requirements for Payment Integrity Improvement." Flistorically, the OIG has found the OCFO to be
compliant with improper payment regulations. The OCFO acknowledges that the OIG had unofficially
recommended incorporating the cost principles in title 2 of the Code of Federal Regulations, part 200,
subpart E, following previous OCFO reviews of improper payments for grants. The OMB guidance at the
time of our previous reviews and at the time the OCFO initiated our FY 2021 review, though, did not
require incorporating cost principles.

During the OIG's exit conference with the OCFO, the OIG stated it followed updated Appendix C to
OMB Circular A-123, guidance issued through M-21-19 on March 5, 2021, which directed Inspectors
General to begin assessing the adequacy of methodologies used to determine whether costs were improper
or unknown. The OIG stated that its audit of the OCFO's FY 2021 review, and any audit or evaluation

# S

V pR0^°

22-P-0050

-------
performed by the OIG after the issuance of the March 2021 OMB guidance, must follow the new
guidelines regardless of when the OCFO's FY 2021 review was performed. Based upon the updated
standards, the OIG determined the OCFO could not adequately assess improper or unknown payments for
the grant payment stream due to the lack of incorporating the cost principles in part 200 of title 2 of the
C.F.R. in our FY 2021 review.

The OCFO does not agree that the M-21-19 guidance should be applied retroactively. Incorporation of the
cost principles subpart of part 200 of title 2 of the C.F.R. would have necessitated a more detailed review
beyond the scope of the OCFO's review performed in FY 2021. Based on the OIG's interpretation of M-
21-19, the agency would not have been able to conduct full cost principle reviews on the 240 sampled
grant payment drawdowns in time to support this audit.

Although the OCFO does not agree with the OIG's finding of non-compliance, we agree with the OIG's
recommendations, based upon updated OMB guidance, that 2 C.F.R., part 200, Subpart E - Cost
Principles should be incorporated in grant payment stream improper payment reviews. The OCFO will
work with the Office of Mission Support's Office of Grants and Debarment to determine the next steps
for completing the corrective actions discussed below.

AGENCY RESPONSE TO DRAFT REPORT RECOMMENDATIONS

No.

Recommendation

High-Level Corrective Action(s)

Estimated Completion Date

Review the OIG-identified questioned costs
for the grants payment stream, determine the
payment allowability, recover costs as
appropriate, and recalculate the error rate.

1. Aaree. The OCFO completed its
review of the OIG-identified questioned
costs and determined, based on the
existing standard operating procedures,
that the costs were properly
documented. The OCFO provided the
OGD and the Grants Management
Officers with the questioned costs to
determine if these costs should be
considered improper. Based on the
OGD's and GMOs' review, the OCFO
will include any costs identified as
improper in the FY2022 Agency
Financial Report.

11/15/2022

Conduct off-cycle risk assessment, applying
the

Standard Operating Procedure
Grants Improper Payment Review, dated
September 2021, and include the risk
assessments in the Agency's Fiscal Year
2023 Agency Financial Report,
ensuring that the risk assessments contain:

2a. Aaree. The OCFO defines its
programs by payment stream. All
programs and activities with outlays
greater than $10 million are included
within one or more payment streams.
The OCFO will provide documentation
to support the OMB's approval for the
OCFO's process.

10/1/2022

a. An assessment of all programs and
activities with outlays greater than $10
million.

2b. Aaree. The OCFO has a
documented methodology for
identifying, accounting for, estimating,
and reporting improper payments and
unknown payments. The OCFO agrees
and will consolidate the various
methodologies.

10/1/2022

22-P-0050

-------

b. An identification of which programs and
activities with annual outlays exceeding the
statutory threshold are included in each risk
assessment.

c. A mechanism for identifying, accounting
for, estimating, and reporting improper and
unknown payments and for detailing efforts
taken to prevent and reduce such payments.

2c. Aaree. The aaencv will assess the
roles and responsibilities regarding the
incorporation of cost principles and
implement them into the FY 2023
improper payment review.

10/1/2022

For payment streams other than the grants
payment stream, update standard operating
procedures that establish a sufficient
methodology for programs and activities
with outlays of more than $10 million to
adequately conclude whether they are
susceptible to significant improper
payments. The standard operating procedure
should identify which programs or activities
are included.

3. Aaree. Per aDDroval from the OMB.
the OCFO defines programs and
activities by payment streams. All
expenditures of the agency are
represented in at least one of the
payment streams. The OCFO currently
has documentation defining how to
conduct reviews of non-grant payment
streams. However, the OCFO agrees to
update current internal guidance
documents into a consolidated standard
operating procedure, to include the
agency's methodology for identifying,
accounting for, estimating, and
reporting improper payments and
unknown payments.

10/1/2022

Periodically train Agency personnel on and
provide completed course training
certificates for:

a. The Standard Operating Procedure Grants
Improper

Payment Review, dated
September 2021, which includes
the Payment Integrity Information Act
Review Checklist, as well as any updates, to
emphasize the application of the cost-
allowance principles and the adherence to
the terms and conditions of the federal
awards.

b. All standard operating procedures, as well
as any updates, implemented for other
payment streams.

4a. Aaree. The aaencv will assess the
roles and responsibilities regarding the
incorporation of cost principles and
implement them into the FY 2023
improper payment review.

12/1/2022

4b. Aaree. The OCFO will coordinate
all payment streams to ensure that
agency personnel are trained and
documentation of the training is
retained.

12/1/2022

CONTACT INFORMATION

If you have any questions regarding this response, please contact the OCFO's Audit Follow-up
Coordinator, Andrew LeBlanc, at leblanc.andrew@epa.gov or (202) 564-1761.

cc: David Bloom
Lek Kadeli
Carol Terris
Meshell Jones-Peeler
Richard Gray
OCFO-OC-MANAGERS

22-P-0050

-------
Catherine B. Allen
Patrick Mclntyre
Michael Osinski
Kysha Holliday
Marilyn Armstrong
Susan Perkins
Mark T. Howard
Andrew LeBlanc
Jose Kercado Deleon

22-P-0050

22

-------
Appendix C

Distribution

The Administrator

Deputy Administrator

Chief of Staff, Office of the Administrator

Deputy Chief of Staff, Office of the Administrator

Chief Financial Officer

Agency Follow-Up Coordinator

General Counsel

Associate Administrator for Congressional and Intergovernmental Relations

Associate Administrator for Public Affairs

Deputy Chief Financial Officer

Associate Chief Financial Officer

Associate Chief Financial Officer for Policy

Controller

Deputy Controller

Associate Deputy Controller

Director, Office of Continuous Improvement, Office of the Chief Financial Officer
Director, Office of Planning, Analysis and Accountability, Office of the Chief Financial Officer
Director, Policy, Training, and Accountability Division, Office of the Controller
Chief, Management, Integrity and Accountability Branch; Policy, Training, and Accountability

Division, Office of the Controller
Audit Follow-Up Coordinator, Office of the Administrator
Audit Follow-Up Coordinator, Office of the Chief Financial Officer

22-P-0050

23

-------