Financial Management
Improvements Needed in National Flood Insurance Program's Financial Controls and Oversight Gao ID: GAO-10-66 December 22, 2009Due to the federal government's role as guarantor, floods impose an enormous potential financial burden on the federal government. Consequently, decision makers at the Department of Homeland Security (DHS), the Federal Emergency Management Agency (FEMA), and the Congress need accurate and timely financial information to assess the effectiveness of the National Flood Insurance Program (NFIP). This report assesses whether controls in place during the 2005 to 2007 time frame were effective and whether actions to improve controls are likely to address identified weaknesses. The Government Accountability Office (GAO) reviewed and analyzed FEMA/NFIP guidance, data, and financial reports, reviewed prior audit reports, interviewed FEMA officials and contractors, and selected a sample of claim losses paid to determine whether claim files contained key documents.
Weaknesses in internal controls impaired FEMA's ability to maintain effective transaction-level accountability. These weaknesses limited FEMA's ability to assure accurate NFIP financial data during the 3-year period from fiscal year 2005 through 2007, which included the financial activity related to the 2005 Gulf Coast hurricanes. FEMA relies heavily on Write Your Own (WYO) insurance companies to carry out NFIP financial activities such as documenting and maintaining claim files. FEMA's Bureau and Statistical Agent (BSA) serves as a liaison between the government and WYO insurance companies. GAO identified weaknesses at three levels of the NFIP transaction accountability and financial reporting process. First, at the WYO level, our internal control testing of a statistical sample determined that almost 71 percent of WYO company claims loss files did not have the necessary documents to support the claims, or reports were filed late. Second, incomplete BSA-level premium data files (lacking key information such as insureds' names and addresses) prevented an assessment of the reliability of reported NFIP premium amounts. Further, BSA-level internal control activities were ineffective in verifying the accuracy of WYO-submitted data. Lastly, FEMA's financial reporting process uses summary data that is overly reliant on error-prone manual data entry. GAO found that FEMA's broader oversight structures were also of limited effectiveness. Specifically, GAO found weaknesses in three key structures FEMA relies on to provide oversight over NFIP and monitor financial activity: (1) WYO company audits--specifically, we found that FEMA did not collect the results of state insurance department audits related to flood insurance activity and did not perform any audits for cause; (2) triennial operational reviews of WYO insurance companies--we found that FEMA did not perform operational reviews at almost one third of all WYO companies over the 3-year period; and (3) FEMA's claims reinspection program--we found that FEMA used flawed sampling procedures in the claims reinspection program. These findings are consistent with weaknesses GAO has previously identified. These oversight weaknesses limited FEMA's ability to identify and address financial transaction control breakdowns resulting from the 2005 hurricanes. FEMA's initiatives to improve specific internal control weaknesses and the overall NFIP control environment since the 2005 Gulf Coast hurricanes have done little to address many of the NFIP financial data deficiencies highlighted by these catastrophic events. FEMA has made improvements such as revising its claim reinspection selection methodology to provide for review of a random selection of a statistically representative sample of claim files. However, the modified reinspection methodology still does not include all claims. FEMA has also implemented a tracking system to monitor the number of WYO biennial audits obtained and reviewed. Further, FEMA has a system modernization development and implementation effort under way. It is too soon to determine the extent to which these efforts will achieve program efficiencies.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-10-66, Financial Management: Improvements Needed in National Flood Insurance Program's Financial Controls and Oversight
This is the accessible text file for GAO report number GAO-10-66
entitled 'Financial Management: Improvements Needed in National Flood
Insurance Program's Financial Controls and Oversight' which was
released on January 21, 2009.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to the Ranking Member, Committee on Banking, Housing, and Urban
Affairs, U.S. Senate:
United States Government Accountability Office:
GAO:
December 2009:
Financial Management:
Improvements Needed in National Flood Insurance Program's Financial
Controls and Oversight:
GAO-10-66:
GAO Highlights:
Highlights of GAO-10-66, a report to the Ranking Member, Committee on
Banking, Housing, and Urban Affairs, U.S. Senate.
Why GAO Did This Study:
Due to the federal government‘s role as guarantor, floods impose an
enormous potential financial burden on the federal government.
Consequently, decision makers at the Department of Homeland Security
(DHS), the Federal Emergency Management Agency (FEMA), and the Congress
need accurate and timely financial information to assess the
effectiveness of the National Flood Insurance Program (NFIP). This
report assesses (1) whether controls in place during the 2005 to 2007
time frame were effective in providing accountability and reliable
financial reporting for NFIP transactions; (2) whether effective
oversight structures were in place during this time frame to monitor
NFIP financial activity; and (3) whether recent and planned actions to
improve controls are likely to address identified financial control
weaknesses. GAO reviewed NFIP guidance and financial reports, reviewed
prior audit reports, interviewed FEMA officials and contractors,
analyzed FEMA and NFIP financial data, and selected a sample of claim
losses paid to determine whether claim files contained key documents.
What GAO Found:
Weaknesses in internal controls impaired FEMA‘s ability to maintain
effective transaction-level accountability. These weaknesses limited
FEMA‘s ability to assure accurate NFIP financial data during the 3-year
period from fiscal year 2005 through 2007, which included the financial
activity related to the 2005 Gulf Coast hurricanes. FEMA relies heavily
on Write Your Own (WYO) insurance companies to carry out NFIP financial
activities such as documenting and maintaining claim files. FEMA‘s
Bureau and Statistical Agent (BSA) serves as a liaison between the
government and WYO insurance companies. GAO identified weaknesses at
three levels of the NFIP transaction accountability and financial
reporting process. First, at the WYO level, our internal control
testing of a statistical sample determined that almost 71 percent of
WYO company claims loss files did not have the necessary documents to
support the claims, or reports were filed late. Second, incomplete BSA-
level premium data files (lacking key information such as insureds‘
names and addresses) prevented an assessment of the reliability of
reported NFIP premium amounts. Further, BSA-level internal control
activities were ineffective in verifying the accuracy of WYO-submitted
data. Lastly, FEMA‘s financial reporting process uses summary data that
is overly reliant on error-prone manual data entry.
GAO found that FEMA‘s broader oversight structures were also of limited
effectiveness. Specifically, GAO found weaknesses in three key
structures FEMA relies on to provide oversight over NFIP and monitor
financial activity: (1) WYO company audits”specifically, we found that
FEMA did not collect the results of state insurance department audits
related to flood insurance activity and did not perform any audits for
cause; (2) triennial operational reviews of WYO insurance companies”we
found that FEMA did not perform operational reviews at almost one third
of all WYO companies over the 3-year period; and (3) FEMA‘s claims
reinspection program”we found that FEMA used flawed sampling procedures
in the claims reinspection program. These findings are consistent with
weaknesses GAO has previously identified. These oversight weaknesses
limited FEMA‘s ability to identify and address financial transaction
control breakdowns resulting from the 2005 hurricanes.
FEMA‘s initiatives to improve specific internal control weaknesses and
the overall NFIP control environment since the 2005 Gulf Coast
hurricanes have done little to address many of the NFIP financial data
deficiencies highlighted by these catastrophic events. FEMA has made
improvements such as revising its claim reinspection selection
methodology to provide for review of a random selection of a
statistically representative sample of claim files. However, the
modified reinspection methodology still does not include all claims.
FEMA has also implemented a tracking system to monitor the number of
WYO biennial audits obtained and reviewed. Further, FEMA has a system
modernization development and implementation effort underway. It is too
soon to determine the extent to which these efforts will achieve
program efficiencies.
What GAO Recommends:
GAO makes seven recommendations to FEMA to improve NFIP financial
management controls and oversight. They include modifying the financial
reporting process to reduce the risk of errors and improving procedures
to strengthen oversight.
View GAO-10-66 or key components. For more information, contact Susan
Ragland at (202) 512-9095 or raglands@gao.gov.
[End of section]
Contents:
Letter:
Background:
Weaknesses in NFIP Transaction Controls and Processing Limited
Accountability and Financial Reporting:
Weaknesses in FEMA's Oversight Structures Limited Effectiveness in
Monitoring NFIP Financial Activity:
Recent and Planned Initiatives Do Little to Address Identified
Weaknesses:
Conclusions:
Recommendations for Executive Action:
Agency Comments and Our Evaluation:
Appendix I: Scope and Methodology:
Appendix II: Comments from the Department of Homeland Security:
Appendix III: GAO Contact and Staff Acknowledgments:
Related GAO Products:
Table:
Table 1: Description of Claims Populations and Related Statistical
Samples:
Figures:
Figure 1: Key Participants in the NFIP WYO Program:
Figure 2: NFIP Financial Reporting Process for Fiscal Years 2005 to
2007:
Figure 3: WYO Companies with Operational Reviews Completed by FEMA in
Fiscal Years 2005 through 2007:
Figure 4: Companies That Had Biennial Financial Audits Completed or Not
Completed for Fiscal Years 2005 through 2007:
Abbreviations:
BSA: Bureau and Statistical Agent:
DHS: Department of Homeland Security:
FEMA: Federal Emergency Management Agency:
FFMIA: Federal Financial Management Improvement Act of 1996:
Financial Control Plan: NFIP WYO Program Financial Control Plan
Requirements and Procedures:
HHS: Department of Health and Human Services:
IFMIS: Integrated Financial Management Information System:
NFIP: National Flood Insurance Program:
OCFO: Office of the Chief Financial Officer:
OIG: Office of Inspector General:
TIER: Treasury Information Executive Repository:
TRRP: Transaction Record Reporting and Processing:
WYO: Write Your Own:
[End of section]
United States Government Accountability Office:
Washington, DC 20548:
December 22, 2009:
The Honorable Richard C. Shelby:
Ranking Member:
Committee on Banking, Housing, and Urban Affairs:
United States Senate:
Dear Senator Shelby:
The Federal Emergency Management Agency (FEMA), a component of the
Department of Homeland Security (DHS), is charged with administering
the National Flood Insurance Program (NFIP). NFIP, established in 1968,
is primarily implemented through private insurance companies that
participate in FEMA's Write Your Own (WYO) program. Through the WYO
program, insurance companies sell and service flood insurance policies
and adjust claims after flood losses. The federal government acts as a
guarantor of flood insurance coverage for WYO policies issued under the
WYO Arrangement. As a guarantor, the federal government is liable for
paying NFIP claim losses should premiums collected be insufficient to
cover these payments. To the extent possible, the program is designed
to pay operating expenses and flood insurance claims with premiums
collected on flood insurance policies rather than by tax dollars.
Flood losses have imposed an enormous financial burden on the federal
government. Until 2004, NFIP was able to cover most of its losses.
However, in order to pay claims arising from the 2005 hurricanes
(Katrina, Rita, and Wilma), the Congress authorized loans to NFIP of
about $16.8 billion from the Treasury that the program used to cover
the enormous number of claims.[Footnote 1] Given this large debt and
ongoing complex financial challenges created by the 2005 Gulf Coast
hurricanes, the fiscal sustainability of the flood insurance program
has come under scrutiny.
In March 2006, we designated NFIP as a high-risk program in part
because of the program's financial condition and inability to repay
borrowed funds. Since then, we have made recommendations[Footnote 2] to
improve rate-setting methods and program oversight. The program remains
on our January 2009 list of high-risk federal programs.
This report provides the results of our review of NFIP financial
transactions related to Hurricane Katrina and other hurricanes of the
2005 season. Specifically, this report,
* assesses whether controls were effective in providing accountability
and reliable financial reporting for NFIP transactions during the 2005
to 2007 time frame,
* evaluates oversight structures in place to monitor NFIP financial
activity for that 3-year period, and:
* assesses whether recent and planned actions to improve NFIP controls
and the overall control environment are likely to address identified
financial control weaknesses.
To assess whether controls were effective in providing accountability
and reliable financial reporting for NFIP transactions during the 2005
to 2007 time frame, we obtained and reviewed available transaction data
and financial reports for NFIP for fiscal years 2005 through 2007. We
reviewed the WYO Financial Control Plan, WYO Accounting Procedures
Manual, and other relevant NFIP policy guidance documents to determine
the design of NFIP financial reporting processes and related internal
controls. We reviewed NFIP transaction accountability in accordance
with the guidelines of the Federal Financial Management Improvement Act
of 1996 (FFMIA).[Footnote 3] We conducted interviews and walkthroughs
of reporting processes with officials from FEMA, FEMA contractors, and
the DHS Office of Inspector General (OIG) to document and obtain an
understanding of the financial reporting process and related internal
controls for NFIP transactions. We obtained NFIP's databases of claim
losses paid for fiscal years 2005 through 2007 and selected a
statistical sample from the insurance claim losses paid databases for
testing of data fields such as coverage and deductible amounts, claim
payment amounts, and policy effective dates against source documents.
To evaluate oversight structures in place to monitor NFIP financial
activity for the 3-year period covering 2005 to 2007, we reviewed prior
GAO and DHS OIG reports to identify and follow up on any previously
reported weaknesses or concerns. Previously reported weaknesses
included the sample selection process for claims reinspections and the
lack of tracking results of biennial financial audits. We also
identified and assessed significant oversight structures outlined in
the WYO Financial Control Plan.
To assess whether recent and planned actions to improve NFIP controls
and the overall control environment are likely to address identified
financial control weaknesses, we met with key program officials to
discuss the NextGen system-development effort. We also discussed recent
and planned NFIP program changes to address the internal control
weaknesses and oversight issues previously identified by us and the DHS
OIG. Appendix I provides more details on our scope and methodology.
We conducted this performance audit from February 2008 to December 2009
in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. Our audit
objectives were not designed to detect fraud. We believe that the
evidence obtained provides a reasonable basis for our findings and
conclusions based on our audit objectives.
Background:
Congress established NFIP in the National Flood Insurance Act of 1968
to provide an alternative to disaster assistance that would reduce the
escalating costs to the federal government of repairing flood damage.
[Footnote 4] FEMA, within DHS, administers NFIP and is responsible for
its management and oversight. Under NFIP's WYO program, FEMA enters
into an arrangement with individual private-sector insurance companies
licensed by states to provide property insurance. The arrangement
allows these companies--using their customary business practices--to
offer flood insurance coverage to eligible property owners. Figure 1
provides an overview of the WYO companies and other key participants in
NFIP.
Figure 1: Key Participants in the NFIP WYO Program:
[Refer to PDF for image: illustration]
Homeowner:
* Purchases NFIP policy;
* Seeks information on coverage;
* Files claim after flood event.
Insurance agent:
* Under contract to sell NFIP policies in the name of one or more WYO
insurance companies.
WYO company:
* Underwrites policy;
* Collects premiums;
* Processes claims;
* Sends in flood adjuster.
Flood adjuster:
* Assesses damage;
* Estimates losses;
* Submits required reports to insurance companies.
FEMA and its Bureau and Statistical Agent (BSA):
* Manages National Flood Insurance Fund;
* Pays WYO providers based on schedule of operating costs;
* Receives premium deposits;
* Manages and regulates NFIP.
Source: GAO analysis of FEMA data.
[End of figure]
WYO Companies:
A private insurance company becomes a WYO company[Footnote 5] by
entering into an agreement with FEMA known as the Financial Assistance/
Subsidy Arrangement. Under the arrangement, private insurance companies
agree to issue flood policies in their own name. The WYO companies
adjust flood claims as well as settle, pay, and defend all claims
arising from the flood policies. Participating WYO companies are to
comply with FEMA's NFIP WYO Program Financial Control Plan Requirements
and Procedures (Financial Control Plan), which outlines WYO insurance
companies' responsibilities for underwriting, claims adjustments, cash
management, and financial reporting.
Selling policies. NFIP coverage is available to all owners of insurable
property (a building or its contents, or both) in a community
participating in NFIP. Builders of buildings in the course of
construction, condominium associations, and owners of residential
condominium units in participating communities may also purchase flood
insurance. Insurance agents under contract to one or more WYO insurance
companies are the main point of contact for approximately 97 percent of
policyholders. Based on information the insurance agents submit, the
WYO insurance companies issue policies, collect premiums from
policyholders, deduct an allowance for expenses from the premium, and
remit the balance to the National Flood Insurance Fund. The remaining 3
percent of policies are written directly by the federal government
through a FEMA contractor known as the Direct Servicing Agent.[Footnote
6] The Direct Servicing Agent provides an alternative, for example,
when a WYO company is unable or unwilling to write a flood insurance
policy.
Adjusting claims. Insurance companies employ certified[Footnote 7]
flood adjusters to settle NFIP claims. When flood losses occur,
policyholders report them to their insurance agent, who notifies the
WYO insurance company. The WYO insurance company assigns a flood
adjuster who is responsible for assessing damage, estimating losses,
and submitting required reports, work sheets, and photographs to the
WYO insurance company, where the claim is reviewed and, if approved,
processed for payment. NFIP's claims payment policy states that FEMA
will pay only that part of the loss that exceeds the deductible amount,
subject to the applicable limit of liability (i.e., the amount of
insurance coverage). FEMA provides funds to the WYO insurance companies
from the National Flood Insurance Fund for the amounts paid for
approved claims and related expenses. As of December 2008 the fund was
over $18 billion in debt.
FEMA Management and Oversight:
About 68 FEMA Mitigation Directorate employees, assisted by
approximately 105 to 110 Bureau and Statistical Agent[Footnote 8] (BSA)
contractor employees, are responsible for managing and overseeing NFIP
and the National Flood Insurance Fund into which premiums are deposited
and claims and expenses paid. FEMA and its contractor (the BSA) are
responsible for monitoring and overseeing the quality of the
performance of the approximately 90 WYO insurance companies to assure
that NFIP is administered properly. Their management responsibilities
include establishing and updating NFIP regulations and flood insurance
rates, offering training to WYO company insurance agents and adjusters,
and implementing the Financial Control Plan.
NFIP's Financial Reporting Process:
The NFIP financial reporting process begins at the WYO company level
when the companies provide summary-level financial data and transaction-
level statistical data to the BSA.[Footnote 9] The WYO Financial
Control Plan requires the WYO companies to submit a monthly financial
statement reporting package to the BSA, which is to include financial,
reconciliation, and certification statements, and statistical
transactions.[Footnote 10] The BSA uses the detailed transaction-level
data in the reporting package for statistical purposes that include
information on claims, losses, and premiums (such as claim payment and
coverage amounts, data on buildings and contents, and policy effective
dates). The BSA uploads the summary-level financial information to its
financial system which is used for financial reporting purposes.
After the BSA receives the reporting package,[Footnote 11] it performs
front-end balancing--a process intended to ensure the WYO company data
are consistent with the WYO companies' reconciliation statements. After
BSA personnel complete the front-end balancing process they use manual
processes to upload financial data into the Focus system from a
spreadsheet.[Footnote 12] The consolidated financial data in Focus is
then downloaded to a database to prepare journal entries that are then
uploaded into the Traverse financial reporting system. The BSA uses the
Traverse system to prepare the financial statement booklets and
ultimately produce four financial statements--for the Direct Servicing
Agent, WYO companies, BSA, and a consolidated report that includes all
three entities.
The BSA sends the financial statement booklets consisting of these four
sets of consolidated--but unaudited--financial statements to FEMA's
Office of the Chief Financial Officer (OCFO) monthly. The OCFO prepares
journal vouchers based on line items from the NFIP consolidated
financial statements that the BSA provides. OCFO personnel enter these
journal vouchers into the Integrated Financial Management and
Information System (IFMIS), which is FEMA/NFIP's official accounting
system of record. After the journal voucher entries are loaded into
IFMIS, OCFO personnel produce trial balance data and load it into the
Treasury Information Executive Repository (TIER), which is a data
warehouse for DHS' components' data.
See figure 2, which depicts NFIP's financial reporting processes.
Figure 2: NFIP Financial Reporting Process for Fiscal Years 2005 to
2007:
[Refer to PDF for image: illustration]
WYO insurance companies:
Provide documentation to the BSA on a monthly basis.
WYO documentation:
Certification statements, TRRP data, and financial exhibits.
Bureau and Statistical Agent (BSA):
Consolidates claims, underwriting, financial, and statistical data from
WYO insurance companies.
Front-end balancing:
BSA reviews WYO submitted data.
Focus mainframe system:
Houses financial statement information from WYO companies and provides
the basis for journal entries.
Data are reentered:
BSA personnel enter data from Focus into database to prepare journal
entries for Traverse.
Traverse system:
Processes general ledger and produces financial statement booklet
including statements for WYO companies, BSA, and direct servicing
agent.
Financial statement booklet:
Financial statement booklet is 1 of 11 FEMA status reports.
FEMA OCFO:
Receives hardcopy financial statement booklet on monthly basis and uses
data to prepare journal vouchers.
Data are reentered:
OCFO personnel rekey data from the financial statement booklets into
IFMIS through journal vouchers.
IFMIS-FEMA:
System for financial management of both appropriated funds and
reimbursable funds.
Treasury Information Executive Repository (TIER)-DHS:
Warehouses FEMA trial balance data extracted by DHS.
Source: GAO.
[End of figure]
Weaknesses in NFIP Transaction Controls and Processing Limited
Accountability and Financial Reporting:
Control weaknesses impaired FEMA's ability to maintain effective
transaction-level accountability. Consequently, NFIP had limited
assurance that its financial data for fiscal years 2005 to 2007 were
accurate. This impaired data reliability resulted from weaknesses at
all three levels of the NFIP transaction accountability and financial
reporting process: at the WYO companies, BSA, and FEMA. At the WYO
level, WYO companies did not adhere to policies and procedures
regarding required claims file documentation, and therefore almost one
third of the claims loss files we reviewed were missing supporting
documents. This deficiency undermined assurances regarding the
reliability of the claims loss financial data the WYO companies
reported. Further, incomplete BSA premium data files, such as missing
insureds' names and addresses, prevented our assessment of the
reliability of reported premium amounts. BSA-level controls were
ineffective in verifying the accuracy of WYO-submitted data. At the
FEMA level, financial reporting process controls were not based on
transaction-level data--instead FEMA relied primarily on summary data
compiled using error-prone manual data entry.
WYO Companies Did Not Provide Complete Documentation to FEMA for Claims
Transactions:
The WYO companies did not provide complete documentation to FEMA for
claims paid to insureds during fiscal years 2005 to 2007. According to
NFIP policies and procedures, claim loss files are to contain adequate
documentation relevant to the adjustment of a claim to support claim
payments. Our detailed testing of claim losses paid during fiscal years
2005 through 2007 showed that 20 percent (36 out of 177) of the claim
files reviewed were missing adjuster-prepared preliminary reports
[Footnote 13] and 20 percent (36 out of 177) did not contain adjuster-
prepared final reports[Footnote 14] required by the NFIP Adjuster
Claims Manual.[Footnote 15] In addition, for the claim files we
reviewed, WYO companies did not file 42 percent (74 out of 177) of the
preliminary and 34 percent (61 out of 177) final reports within the
required 15 and 45 days, respectively, from the date of loss in
accordance with NFIP policy. Our findings are consistent with prior
audit findings. Specifically, DHS' auditor for its financial statement
audit for fiscal year 2006 reported that preliminary and final reports
were not filed within the required time frames. Similarly, almost 71
percent (125 out of 177) of the statistically sampled claim losses paid
files we reviewed failed at least one internal control test. These
included tests such as determining whether claim file documents were
missing and whether adjusters filed required reports on time or late.
Although FEMA officials pointed to the unprecedented severity,
frequency, and complexity of flood claims during this period, these
internal control issues identified raise concerns that the claim
payment amounts were not adequately supported.
The BSA's Premium Database Was Incomplete:
Over 50 percent of the transactions in the NFIP databases for the
insurance premium policies for fiscal years 2006 and 2007 that the BSA
extracted for our testing either lacked or had incomplete insured
names, addresses, or policy effective dates. Consequently, we were
unable to test the accuracy of reported insurance premium amounts or
whether policy premium information was complete. Officials from the BSA
attributed the missing or incomplete insurance premium information to
their extraction process and difficulties they encountered (programming
errors) when extracting the data into a separate database specifically
for our use. Furthermore, the fact that BSA officials could not readily
produce reliable or complete data poses questions regarding their
capacity to analyze data and the NFIP program officials' ability to
identify appropriate managerial actions based on what is reported to
them by WYO companies through their own BSA contractor.
We developed alternative procedures that we planned to use to make
conclusions about the reliability of reported insurance premiums
written amounts. These alternative procedures involved testing the
premium and policy information from the sample we selected for claims
losses paid. However, we were unable to verify information in the
premiums database for many sample items because of the missing
information described previously and because of limitations in the
quality of the data.
BSA-Level Internal Controls Do Not Verify Accuracy of WYO Company Data:
We found weaknesses in two key controls outlined in the Financial
Control Plan for the BSA to ensure the accuracy of WYO company-
submitted data. These controls include front-end balancing, which is a
process intended to ensure the WYO company data are consistent with the
WYO companies' reconciliation statements, and variance reporting, which
analyzes WYO-submitted transaction-level (statistical) data in
comparison with summary-level financial data submitted by WYO
companies. These features do offer some assurances regarding the
consistency of data provided by WYO companies and recorded by the BSA.
However, neither offers any assurances that the WYO company-provided
information accurately reflects actual transactions. Consistent with
Standards for Internal Control,[Footnote 16] an agency must have
sufficient controls in place to provide reliable information to run and
control its operations. Such controls generally include procedures to
verify the validity and accuracy of the recorded transactions or
events.
Every month, after receiving summary financial and transaction-level
statistical data[Footnote 17] from WYO companies, the BSA performs
front-end balancing. As provided by the Financial Control Plan, front-
end balancing is a process intended to ensure the WYO company data are
consistent with the WYO companies' reconciliation statements that
compare the statistical transaction data to selected financial exhibit
entries. This process is intended to validate that the BSA has recorded
the same information that individual WYO companies have transmitted.
The BSA's front-end balancing, while helping to verify that the number
of records and dollar amounts agree to the reconciliation documents and
the timeliness of the WYO-submitted data, does not verify or validate
the data's accuracy. Although WYO companies submit statistical
transaction-level data for claims losses paid and premiums written,
which are the primary sources of financial activity for NFIP, the BSA
does not base its financial reporting on this transaction-level data,
but instead compiles the financial exhibits submitted by the WYO
companies, and therefore reduces assurances that activity reported to
FEMA represents actual transactions between WYO companies and
policyholders.
The BSA's monthly variance reporting[Footnote 18] was also not designed
to ensure WYO company data accuracy. The Financial Control Plan
requires the BSA to analyze WYO-submitted transaction-level
(statistical) data in comparison with summary-level financial data
submitted by WYO companies and produce a report identifying any
differences. BSA personnel told us that various parties, such as the
Standards Committee,[Footnote 19] use the Consolidated Variance Report
to monitor the statistical data and financial information reported by
the WYO companies. However--much like front-end balancing--the
usefulness of the variance reporting process was limited because the
BSA review was not designed to check the underlying NFIP transaction
data submitted by WYO companies against an independent source for
accuracy or completeness.
The Design of FEMA's Financial Reporting for NFIP Activity Increases
Risk:
Along with the internal control weaknesses discussed previously, the
design of FEMA's NFIP financial reporting process increased the risk of
inaccurate or incomplete data because it did not include a process of
analyzing the detailed data for accuracy or analyzing the financial
reports in relation to the transaction-level data currently submitted
by WYO companies for statistical purposes. Finally, the process places
an overreliance on manual procedures for processing and entering data.
The design weaknesses increase the likelihood of incomplete or
inaccurate NFIP financial information.
As FEMA's NFIP financial reporting process was designed, approximately
90 WYO insurance companies submit summary financial information in e-
mails to the BSA for consolidation and submission to FEMA. Throughout
the entire process, the BSA captures and processes key financial
information such as net written premiums on the financial statements
prepared by the WYO companies. By presenting the net written premium
amount, a WYO company does not show how much of its earned premiums
went to pay premium refunds. This process limits management and audit
visibility into identifying and resolving any underlying transaction
reliability issues because it does not show different components of
transactions. Furthermore, even when detailed transaction-level
financial data were available, we found that supporting documentation
was missing. Absent supporting transaction information, it was not
practical for FEMA to reconstruct or validate NFIP amounts reported.
FEMA's reliance on unverified WYO data and manual processing as
described in the background section of this report greatly increases
the chances of errors or misstatements. Similarly, a reliance on net
(aggregated) data increases the risk of undetected data errors at the
FEMA level. As a result, in fiscal year 2006, for example, FEMA OCFO
officials had to correct over 100 journal vouchers totaling an
estimated $260 billion. These errors occurred because FEMA OCFO
officials erroneously recorded NFIP financial activity during fiscal
year 2006. According to Standards for Internal Control implementation
guidance, excessive adjustments to numbers or account classifications
should not be necessary prior to finalization of financial reports.
Proper classification and recording of transactions or events should
take place throughout the entire life cycle of each transaction or
event, including authorization, initiation, processing, and reporting.
Weaknesses in FEMA's Oversight Structures Limited Effectiveness in
Monitoring NFIP Financial Activity:
Weaknesses in the broad oversight structures that FEMA relies on to
monitor NFIP financial activity in three key areas limited the
effectiveness of FEMA's oversight: (1) FEMA did not have processes to
monitor WYO company audits by independent public accountants and other
parties, including required biennial audits, state insurance department
audits, and audits for cause; (2) FEMA did not perform triennial
operational reviews of all WYO insurance companies; and (3) FEMA's
claims reinspection program used flawed sampling procedures. These
weaknesses are consistent with issues identified in our prior reports.
As a result of these oversight deficiencies, FEMA's ability to identify
and address NFIP financial transaction control breakdowns when
processing transactions related to the 2005 Gulf Coast hurricanes was
limited.
FEMA Did Not Monitor Completion or Results of WYO Company Audits:
FEMA did not have any mechanism for tracking completion and reviewing
the results of required biennial financial statement audits of WYO
companies, did not collect results of state insurance department audits
related to flood insurance activity, or conduct audits for cause.
According to the Financial Control Plan, biennial audits are FEMA's
primary oversight mechanism for obtaining assurance that it receives
complete and accurate financial management information from WYO
insurance companies. The plan provides that such audits are intended to
reduce or eliminate the need for FEMA auditors to conduct on-site
visits to WYO insurance companies to oversee their financial
activities; specifies that biennial financial statement audits are a
required condition of an insurance company's participation in the WYO
program; and states that they must be conducted by an independent
Certified Public Accountant.[Footnote 20] According to the Financial
Control Plan, these audits are to include an opinion on the fairness of
the financial statements, the adequacy of the internal controls, and
the extent of compliance with laws and regulations. In 2007, we
reported that 5 out of 94 (about 5 percent) WYO companies had biennial
audits completed for the 2-year period covering fiscal years 2005 and
2006.[Footnote 21] In response to findings that FEMA had failed to
consistently enforce the biennial audit requirement, FEMA officials
told us that they had exempted from this requirement companies that
said that they were overwhelmed with administering flood claims after
the 2005 hurricane season.
The Financial Control Plan also requires FEMA to consider the results
of other audits of the WYO companies such as state insurance department
audits, as appropriate. Based on our testing of FEMA's compliance with
the Financial Control Plan, we reported in August 2009[Footnote 22]
that FEMA rarely or never reviewed state insurance department audits.
FEMA officials clarified that state departments of insurance audits
require a "trigger." For such audits, a financial officer of the
insurer is to "trigger" an alert to FEMA of any state audit involving
NFIP activities. A more independent way for FEMA to learn of these
audits would be to have contact directly with the states. According to
FEMA, during our review period, FEMA did not receive any such notices.
These audits are typically in response to company-specific concerns--
they are not routine.
The Financial Control Plan outlines criteria that, in combination or
independently, may prompt FEMA to perform an audit for cause. Based on
our testing of FEMA's compliance with the Financial Control Plan, we
reported in August 2009[Footnote 23] that FEMA rarely or never
implemented audits for cause. According to FEMA officials, the last
audits for cause were done in the late 1990s. Because FEMA did not
systematically track and centrally store all required evaluations,
inspections, audits, or reviews, FEMA management had no basis for
timely access to them or effectively overseeing the 90-plus
participating insurance companies, and therefore had no reasonable
basis for determining whether any audits for cause were necessary. FEMA
told us that based on our August 2009 recommendations, it now plans to
implement such a system. It will be important for FEMA to maintain
ongoing awareness of state audit initiatives identified through an
independent information source.
Operational Reviews Are Ineffective:
FEMA did not perform operational reviews for all WYO companies on a
triennial basis as required and used a flawed sampling methodology to
select underwriting files at the WYO companies that it did review.
[Footnote 24] The Financial Control Plan calls for conducting the
following types of operational reviews: underwriting/policy
administration; claims; marketing; customer services; and litigation.
[Footnote 25] These reviews are intended to provide FEMA with an
effective mechanism to monitor, identify, and resolve problems related
to how WYO companies sell and renew NFIP policies and adjust claims.
According to Standards for Internal Control implementation guidance,
[Footnote 26] information should be available on a timely basis to
allow effective monitoring of events, activities, and transactions and
to allow prompt action. Given that operational reviews are FEMA's
primary method to monitor the WYO insurance companies for the two most
significant areas of the program--underwriting and claims processing--
it is important for FEMA to conduct these reviews on a regular basis.
Without the timely information regarding how WYO companies sell and
adjust claims gained through operation reviews, FEMA cannot be certain
that the WYO companies provide appropriate financial information to
NFIP program managers. Policies and procedures specify that all WYO
companies are to be reviewed at a minimum every 3 years. Therefore, we
expected that FEMA would have done an operational review of all the WYO
companies during the 3-year period covering 2005 to 2007. However, as
shown in figure 3, we found that FEMA had completed operational reviews
on only 71 percent (82 out of 116) of WYO companies during this period.
Figure 3: WYO Companies with Operational Reviews Completed by FEMA in
Fiscal Years 2005 through 2007:
[Refer to PDF for image: pie-chart]
WYO companies that had operational reviews completed: 71%;
WYO companies that did not have operational reviews completed: 29%.
Source: GAO analysis of data provided by FEMA.
[End of figure]
Further, as previously reported,[Footnote 27] FEMA did not use a
statistical sampling methodology to select files for operational
reviews--instead it uses nonprobability sampling processes. In
nonprobability sampling, staff are to select a sample based on their
knowledge of the population's characteristics. The major limitation of
this type of sampling is that the results cannot be generalized to a
larger population. A nonprobability sample is therefore not appropriate
to use if the objective is to generalize about the population from
which the sample is taken.[Footnote 28]
FEMA's Flawed Sampling Procedures Hamper Its Claims Reinspection
Program:
According to FEMA's Financial Control Plan, the claims reinspection
program is to serve as a mechanism supporting FEMA's oversight of WYO
insurance companies. The objectives of the claims reinspection program
were to (1) keep FEMA and the BSA informed, (2) assist in the overall
claims operation, and (3) provide necessary assurances and
documentation for dealing with external parties. The BSA is to conduct
all reinspections and prepare a report documenting the appropriateness
of the original claims adjuster's work. However, we found that FEMA did
not use a statistical sampling basis for selecting claims for
reinspection. Specifically, adjusters selected claims to reinspect
based upon judgmental criteria including, among other items, the size
and location of loss and complexity of claims. Further, FEMA only
required testing for a selection of claims for flood events with over
400 claims per a single flood event for a particular WYO company. Also,
the actual number of claim losses selected for reinspection only
represents a very small percentage of the total number of claim losses
processed. Using this flawed methodology for selecting samples for
claims reinspections, the percentage of claims reinspected by flood
event for fiscal years 2005 and 2006 was 1.8 percent for Katrina, 3.6
percent for Rita, and 5.0 percent for Wilma. By using a statistical
sampling methodology for selecting claim reinspections, FEMA would be
able to use this oversight mechanism to make conclusions about the
accuracy of the total amount of claims losses paid, with a similar
level of effort.
These findings are consistent with findings from previous audits.
Specifically, we previously reported in October 2005[Footnote 29] that
neither FEMA nor its program contractor used a statistically valid
method for selecting files for reinspections of claims adjusted after
each flood event because FEMA guidance did not include procedures on
the sample selection process. Without a statistically valid sampling
methodology that represents the population, the agency cannot project
the results of these reinspection oversight activities to confidently
determine the overall accuracy of claims settled for specific flood
events or assess the overall performance of insurance companies and
their adjusters in fulfilling their NFIP responsibilities. In December
2006, we again reported[Footnote 30] that FEMA neither used a random
sample of claims for its reinspections nor analyzed the overall results
of those reinspections to determine the total number of payment errors
and their potential causes.
Recent and Planned Initiatives Do Little to Address Identified
Weaknesses:
FEMA has revised its draft Financial Control Plan (dated August 2009)
to require selection of a statistically representative sample of claim
files for its reinspection reviews. However, the modified policy
continues to cover only those claims associated with single flood
events with over 400 claims per WYO company. Substantial claims
activity may still be excluded from reinspection. For fiscal years 2005
and 2006, almost $1.5 billion of the $16.5 billion in claims filed
would not have been considered for reinspection under this criterion.
Until processes are modified to make all cases eligible for
reinspection, FEMA will not be able to effectively determine whether
the case population is complete as well as whether the total amount of
claims losses paid is reasonable.
Available data indicate that the number of biennial financial audits
has increased since FEMA began tracking the results in fiscal year
2008. Figure 4 shows that few audits were conducted for fiscal years
2005 and 2006, but that there was considerable improvement for fiscal
years 2006 and 2007.
Figure 4: Companies That Had Biennial Financial Audits Completed or Not
Completed for Fiscal Years 2005 through 2007:
[Refer to PDF for image: stacked vertical bar graph]
Fiscal year: 2005-2006;
WYO companies that did not have financial audits completed: 89;
WYO companies that had financial audits completed: 5;
Total: 94.
Fiscal year: 2006-2007;
WYO companies that did not have financial audits completed: 49;
WYO companies that had financial audits completed: 46;
Total: 95.
Source: GAO analysis of data provided by FEMA.
Note: As the biennial audits cover a 2-year period, the fiscal year
2005 to 2006 audits were completed in fiscal year 2007 and the fiscal
year 2006 to 2007 audits were completed in fiscal year 2008.
[End of figure]
Prior to fiscal year 2008, FEMA had not tracked and reviewed these
audit results because FEMA did not follow NFIP policies and procedures
requiring it to receive and analyze such information. Accordingly, FEMA
could not determine whether it received and reviewed all required audit
reports, nor have a basis for monitoring implementation of necessary
corrective actions. In response to our previous recommendation
regarding this long-standing concern, FEMA is now using a tracking
mechanism to document audit reports received and those reviewed by FEMA
staff.[Footnote 31] According to FEMA, once the financial audit reports
are received, staff and management now review the audit reports and
document the results of their review on the tracking schedule. While
improvements have been made with regard to tracking and reviewing the
results of biennial audits, this is only one component of FEMA's
oversight structure and, as discussed in this report, we continue to
note weaknesses in the other areas.
FEMA has a system development and implementation effort, referred to as
NextGen,[Footnote 32] under way. This effort has experienced delays and
it is too soon to determine whether planned program efficiencies--such
as confirmation of insured's property address--will be achieved under
the new system. According to FEMA, the NextGen system implementation
effort is designed to be an insurance system that links key data
elements like claims and policies through shared processes. Under the
current system, the BSA maintains claim losses paid and premium
policies data in separate databases. FEMA officials have expressed
concern about the readiness of the NextGen system to support NFIP
program operations.
Conclusions:
As currently designed and implemented, FEMA's internal controls over
NFIP offer limited transaction-level accountability and assurances that
financial reporting is accurate or that insurance company operations
conform to program requirements. Transaction-level accountability and
reporting to administer NFIP are fundamental to attaining
accountability over program resources. Internal controls are also
critical to ensure that claim payments are adequately supported, and
FEMA was missing key documentation to support claims. Given the
involvement of multiple private entities participating in this
insurance program, establishing and implementing effective policies and
procedures to thoroughly implement required audits and overall
operational and targeted reviews will be critical for FEMA to exercise
its managerial responsibilities. FEMA has taken some steps to
strengthen NFIP internal controls such as overseeing WYO companies by
tracking and reviewing the results of their required biennial financial
audits. The enormous potential financial burden on the federal
government that flood events pose, coupled with the risks of inaccurate
and incomplete NFIP financial information described in this report,
serve to underscore that effective NFIP controls are critical. As such,
it will be important to take immediate actions to improve these
controls over NFIP transactions, financial reporting, and oversight.
Recommendations for Executive Action:
To improve the financial reporting process and strengthen internal
controls, we recommend that the Secretary of Homeland Security direct
the Acting Assistant Administrator, FEMA Mitigation Directorate, to
take the following seven actions:
* Augment NFIP policies to require the BSA to develop procedures to
analyze financial reports in relation to the transaction-level
information that WYO companies submit for statistical purposes.
* Revise required internal control activities for the BSA to provide
for verifying and validating the reliability of WYO-reported financial
information based upon a review of a sample of the underlying
transactions or events, or obtain verification that these objectives
have been met through independent audits of the WYO companies.
* Determine the feasibility of integrating and streamlining numerous
existing NFIP financial reporting processes to reduce the risk of
errors inherent in the manual recording of accounting transactions into
multiple systems.
* Establish and implement procedures to require reviewing available
information such as the results of biennial audits, operational
reviews, and claim reinspections to determine whether the targeted
audits for cause managerial tool should be used.
* Establish and implement procedures to require maintaining and
considering current information from an independent source regarding
state audit results to gather pertinent information such as customer
service issues and inform determinations about when to conduct audits
for cause.
* Establish and implement procedures to schedule and conduct all
required operational reviews within the prescribed 3-year period.
* Establish and implement procedures to select statistically
representative samples of all claims as a basis for conducting
reinspections of claims by general adjusters.
Agency Comments and Our Evaluation:
We requested comments on a draft of this report from the Secretary of
Homeland Security. Comments received from the DHS Departmental GAO/OIG
Liaison Office on behalf of FEMA are reprinted in appendix II. In its
comments, FEMA concurred with two of our recommendations, stated that
two recommendations were unnecessary in that the recommended procedures
were already in place, and disagreed with the remaining three
recommendations. We reaffirm all seven recommendations.
With respect to the recommendations for which FEMA concurred regarding
(1) streamlining financial reporting processes and (2) conducting
operational reviews, FEMA noted it has actions under way to integrate
and streamline numerous existing financial reporting processes in the
design of a new NFIP system, and stated that its new operational review
process will address our recommendation to schedule and conduct all
required operational reviews within the prescribed 3-year period.
Regarding our recommendation for establishing and implementing
procedures for reviewing all available audit and other reports, FEMA
stated that it already had a process in place to review WYO company
performance and trigger audits for cause. FEMA further commented that
the Standards Committee considers the results of biennial audits,
operational reviews, and claims reinspections when it reviews company
performance and considers whether to recommend audits for cause. We
disagree that the process FEMA has in place is sufficient to address
our recommendation. As discussed in our draft report, during the period
of our review, FEMA management, including the Standards Committee,
lacked timely access to all audit and other reports because FEMA did
not systematically track and centrally store all required evaluations,
inspections, audits, or reviews. Therefore, without further action to
establish additional procedures directed at ensuring access and a
systematic review of WYO company performance, FEMA will continue to be
unable to effectively oversee the 90-plus participating insurance
companies or determine whether any audits for cause are necessary.
Also, regarding our recommendation concerning selecting statistically
representative samples of claims for reinspections, FEMA stated that
the reinspections are not intended to be a definitive audit of the
NFIP's claims handling process, and cited the random sample of claims
it currently has in place. We disagree. As discussed in our draft
report, adjusters selected claims to reinspect based upon judgmental
criteria, not on a random sample. Further, FEMA only required
reinspection when there were more than 400 claims per flood event for a
particular WYO company. Because reinspections are conducted principally
on open claims files to document the appropriateness of the original
claims adjuster's work, the lack of a statistically representative
sample not only precludes FEMA from projecting the results of these
reinspections to determine the overall accuracy of claims, it also
limits FEMA's ability to continuously assess the overall performance of
insurance companies and adjusters in fulfilling their NFIP
responsibilities. FEMA also noted that claims operational reviews are
designed to provide feedback on claims settlements and ascertain
compliance by WYO companies. The claims operational reviews that FEMA
cited, while an important oversight mechanism, do not allow for
continuous feedback concerning the overall insurance company
performance.
We also continue to reaffirm our three recommendations for which FEMA
disagreed in its comments on our draft report. First, with respect to
our recommendations that FEMA develop financial reports using the
transaction-level information that WYO companies currently submit for
statistical purposes, FEMA stated that implementing our recommendation
would be onerous and burdensome because of the number of transactions
involved. We subsequently adjusted our recommendation to have NFIP
augment its policies to require the BSA to develop procedures to
analyze financial reports in relation to the transaction-level
information that WYO companies submit for statistical purposes. Such a
procedure would help compensate for the risks introduced by the current
approach of entering summary-level information to its financial
reporting system. Because WYO companies already submit transaction-
level data on claims losses paid and premiums written and FEMA uses
this information for statistical purposes, using these transaction-
level financial data to increase the reliability of FEMA's financial
reporting should impose minimal additional burden.
Also, with respect to FEMA's nonconcurrence with our recommendation to
verify and validate WYO-reported financial information, FEMA maintained
that the form and structure of the transaction-level detail is audited
at the source, including consideration of the relevance, reliability,
and accuracy of the transaction-level detail. However, as discussed in
our report, during the period of our review, we were not provided any
evidence showing that FEMA obtained any assurances concerning the
accuracy or validity of WYO company transaction-level financial data.
Specifically, FEMA did not demonstrate that it had mechanisms in place
during fiscal years 2005 through 2007 for receiving and reviewing the
results of the required biennial financial statement audits of WYO
companies, or for tracking completion of these audits. FEMA was unable
to provide evidence of whether all WYO companies had completed biennial
audits and had not reviewed the results of these WYO company biennial
audits. Further, as discussed in our report, FEMA officials exempted
certain WYO companies from the biennial audit requirement after the
2005 hurricane season. Therefore, FEMA had no assurance as to the
accuracy or validity of WYO company transaction-level financial data.
We reaffirm our recommendation that FEMA revise required internal
control activities for the BSA to provide required procedures for
verifying and validating the reliability of WYO-reported financial
information based upon a review of a sample of the underlying
transactions or events. We also adjusted our recommendation to include
the option for FEMA to obtain assurance of the reliability of WYO
company-reported financial data by verifying that those objectives were
met through the independent audits of WYO companies.
Finally, FEMA did not concur with our recommendation to maintain and
consider information from an independent source regarding state audit
results in determining whether to conduct audits for cause. FEMA
contended that such sources do not focus on federal programs, such as
NFIP. However, FEMA's Financial Control Plan states that it is expected
that audits of WYO companies by state insurance departments will
include flood insurance activity. Further, FEMA acknowledges receiving
information from a source independent of the WYO companies.
Specifically, it acknowledged receiving correspondence from state
insurance departments regarding issues of customer service with the WYO
companies. It is important for FEMA to establish and implement
procedures to require maintaining and considering all current
information available from an independent source regarding state audit
results. We found that FEMA rarely received or reviewed information
from state insurance department audits. Consequently, we continue to
reaffirm our recommendation to obtain and consider independent
information on state audits of the WYO companies, rather than
continuing to rely solely on the WYO company that underwrites policies
and processes claims to alert FEMA of any state issues.
FEMA also expressed concern over several points in our draft report's
narrative. We continue to affirm the process descriptions and the
findings in our draft report but made several changes in the report to
clarify the narrative. Our responses to other FEMA concerns with our
draft's narrative are provided following FEMA's comments in appendix
II.
As agreed with your office, unless you publicly announce the contents
of this report earlier, we plan no further distribution until 30 days
from the report date. At that time, we will send copies to the
Secretary of Homeland Security, relevant congressional committees, and
other interested parties. The report will also be available at no
charge on our Web site at [hyperlink, http://www.gao.gov].
If you or your staff have any questions about this report, please
contact me at (202) 512-9095 or raglands@gao.gov. Contact points for
our Offices of Congressional Relations and Public Affairs may be found
on the last page of this report. GAO contact and staff acknowledgments
are listed in appendix III.
Sincerely yours,
Signed by:
Susan Ragland:
Director, Financial Management and Assurance:
[End of section]
Appendix I: Scope and Methodology:
To assess whether controls were effective in providing accountability
and reliable financial reporting for National Flood Insurance Program
(NFIP) transactions during the 2005 to 2007 time frame, we obtained and
reviewed available transaction data and financial reports for NFIP for
fiscal years 2005 through 2007. We selected these years to identify
transactions relevant to the 2005 Gulf Coast hurricanes and to capture
more current financial information. We reviewed the Write Your Own
(WYO) Financial Control Plan, WYO Accounting Procedures Manual, and
other relevant NFIP policy guidance documents to determine the design
of NFIP financial reporting processes and related internal controls. We
reviewed NFIP transaction accountability in accordance with the
guidelines of the Federal Financial Management Improvement Act of 1996
(FFMIA).[Footnote 33] We also interviewed Federal Emergency Management
Agency (FEMA), FEMA contractors, and Department of Homeland Security
(DHS) Office of Inspector General (OIG) officials to document and
obtain an understanding of the financial reporting process and related
internal controls for NFIP transactions. We conducted walkthroughs to
understand the reporting process for financial transactions including
the review of related evidentiary supporting documentation, including
journal vouchers and adjusting journal entries. Further, to determine
how the financial transactions were recorded, specifically insurance
premiums written and claim losses paid, we reviewed NFIP financial
reports and met with NFIP program and FEMA officials to obtain an
understanding of the processing cycles for premiums written and claim
losses paid. We interviewed FEMA personnel and contractors responsible
for collecting and maintaining NFIP financial data to understand the
available data. In addition, we obtained requested extracts of NFIP
databases of the insurance premiums written and claim losses paid for
these fiscal years to identify the total population including the
number of transactions, and planned to select statistical samples of
claims and policies to test from these databases. We reconciled the
Bureau and Statistical Agent (BSA) extracts of net premiums written and
claim losses paid databases to the BSA prepared financial statements
based on the data provided to FEMA. Once we were able to successfully
complete our reconciliation,[Footnote 34] but before selecting samples,
we performed data reliability tests on the databases and determined
that the claims losses paid database was sufficiently reliable for our
purposes. We did not audit the data that WYO companies submit to FEMA's
contractor, CSC, nor did we audit the data produced by CSC or the
information included by FEMA in DHS' annual reports. We used the
statistical samples of insurance claim losses paid as outlined below to
perform detailed testing through verification of data fields such as
coverage and deductible amounts, claim payment amounts, and policy
effective dates against source documents. We also used these samples to
further test internal controls over NFIP financial reporting. Results
from the statistical samples were projected by fiscal year both
individually and combined. See table 1 below for details related to the
statistical samples.
Table 1: Description of Claims Populations and Related Statistical
Samples:
Fiscal year: 2005;
Type of sample: Classical probability proportionate to size sample;
Sample size: 59;
Total dollar value of claim losses selected in the sample (in
millions): $16.0;
Total number of claim losses in the sample population: 104,517;
Total dollar value of claim losses in the sample population (in
millions): $2,694.5.
Fiscal year: 2006;
Type of sample: Classical probability proportionate to size sample;
Sample size: 59;
Total dollar value of claim losses selected in the sample (in
millions): $10.3;
Total number of claim losses in the sample population: 189,776;
Total dollar value of claim losses in the sample population (in
millions): $16,179.7.
Fiscal year: 2007;
Type of sample: Classical probability proportionate to size sample;
Sample size: 59;
Total dollar value of claim losses selected in the sample (in
millions): $6.3;
Total number of claim losses in the sample population: 38,409;
Total dollar value of claim losses in the sample population (in
millions): $885.4.
Source: GAO.
[End of table]
Using the above statistical samples, we also tested other NFIP program-
oversight controls as deemed necessary and in accordance with our
engagement objectives. In order to ensure efficient detailed testing,
we conducted dual-purpose testing, which includes reviewing dollar
amounts as well as the related internal controls. We found information
in the premiums written database was not sufficiently reliable for our
purposes. We were unable to perform detailed testing of the premiums
written database due to a significant number of data-reliability issues
that we discovered.
To evaluate oversight structures in place to monitor NFIP financial
activity for the 3-year period covering 2005 to 2007, we reviewed prior
GAO and DHS OIG reports to identify and follow up on any previously
reported weaknesses or concerns, including sample selection for claims
reinspections and tracking results of biennial financial audits. We
also interviewed FEMA personnel and contractors regarding the oversight
structures in place. In addition, we identified and assessed
significant oversight structures as outlined in the WYO Financial
Control Plan, and analyzed the results of these controls.
To assess whether recent and planned actions to improve NFIP controls
and the overall control environment are likely to address identified
financial control weaknesses, we reviewed NFIP policy and procedural
guidance that has been issued subsequent to the 2005 Gulf Coast
hurricanes. We also met with key program officials to discuss the
NextGen system development effort. We also discussed recent and planned
NFIP program changes to address the internal control weaknesses and
oversight issues previously identified by GAO and the DHS OIG.
[End of section]
Appendix II: Comments from the Department of Homeland Security:
Note: GAO comments supplementing those in the report text appear at the
end of this appendix.
U.S. Department of Homeland Security:
Washington, DC 20528:
December 4, 2009:
Ms. Susan Ragland:
Director:
Financial Management and Assurance:
U.S. Government Accountability Office:
441 G Street, NW:
Washington, DC 20548:
Dear Ms. Ragland:
Re: Draft Report GAO-10-66, Financial Management: Improvements Needed
in National Flood Insurance Program's Financial Controls and Oversight
(GAO Job Code 195135):
The Department of Homeland Security (Department) appreciates the
opportunity to review and comment on the U.S. Government Accountability
Office's (GAO's) draft report referenced above. The Department,
specifically the Federal Emergency Management Agency (FEMA), disagrees
with three of the seven recommendations and has concerns about the
draft report narrative.
To improve the financial reporting process and strengthen internal
controls, GAO recommended that the Secretary of Homeland Security
direct the acting assistant administrator, FEMA Mitigation Directorate,
to take seven actions.
GAO Recommendation 1: Augment National Flood Insurance Program (NFIP)
policies and procedures to require the Bureau and Statistical Agent
(BSA) to use the transaction-level information that Write Your Own
(WYO) companies submit to develop financial reports, in addition to the
current practice of using transaction-level information solely for
statistical purposes.
FEMA's Response: FEMA disagrees with the recommendation. The NFIP' s
financial statements have been audited for over 20 years and internal
controls have been in place since the WYO program's inception. During
that time, independent auditors, the Inspector General or the GAO have
not suggested that the design of FEMA's financial reporting procedures
is flawed. Implementing this recommendation would be onerous and
burdensome because of the number of transactions involved.
GAO Recommendation 2: Revise required internal control activities for
the BSA to provide for verifying and validating the reliability of WYO-
reported financial information based upon a review of a sample of the
underlying transactions or events.
FEMA's Response: FEMA disagrees with the recommendation. The form and
structure of the transaction level detail is audited at the source,
including consideration of the relevance, reliability and accuracy of
the transaction level detail.
GAO Recommendation 3: Determine the feasibility of integrating and
streamlining numerous existing NFIP financial reporting processes to
reduce the risk of errors inherent in the manual recording of
accounting transactions into multiple systems.
FEMA's Response: FEMA agrees with the recommendation and is addressing
it in the design of the new NFIP system.
GAO Recommendation 4: Establish and implement procedures to require
reviewing available information such as the results of biennial audits,
operational reviews, and claim re-inspections to determine whether the
targeted Audits for Cause managerial tool should be used.
FEMA's Response: FEMA does not believe the recommendation is necessary.
The NFIP has always had a process in place to review company
performance and trigger Audits for Cause. The WYO Standards Committee
considers the results of biennial audits, operation reviews and claims
re-inspections when it reviews company performance and considers
whether to recommend Audits for Cause.
GAO Recommendation 5: Establish and implement procedures to require
maintaining and considering current information from an independent
source regarding state audit results to gather pertinent information
such as customer service issues and inform determinations about when to
conduct Audits for Cause.
FEMA's Response: FEMA disagrees with the recommendation since State
Departments of Insurance audits typically do not focus on the NFIP
because it is a Federal insurance program. FEMA does receive
correspondence from State Insurance Departments regarding issues of
customer service with a Write-Your-Own Company.
GAO Recommendation 6: Establish and implement procedures to schedule
and conduct all required operational reviews within the prescribed 3-
year period.
FEMA's Response: FEMA agrees with this recommendation. The new
Operation Review process will begin to address this recommendation in
2010.
GAO Recommendation 7: Establish and implement procedures to select
statistically representative samples of all claims as a basis for
conducting re-inspections of claims by general adjusters.
FEMA's Response: FEMA does not believe the recommendation is necessary.
The NFIP selects a random sample for claims re-inspections and a
statistically representative sample for Claims Operation Reviews.
FEMA Comments:
Background:
WYO Companies: Adjusting Claims:
GAO mistakenly asserts that the NFIP overpaid at least $113.6 million
by not taking the deductible from total losses despite FEMA's numerous
attempts to explain the flood insurance deductible. [See comment 1] In
wording that is comparable to that used throughout the property and
casualty insurance industry, the Standard Flood Insurance Policy says
it best. Section VI. A. of the Dwelling Form reads:
When a loss is covered under this policy, we will pay only that part of
the loss that exceeds your [the policyholder] deductible amount,
subject to the limit of liability that applies.
The value of the deductible is in small losses that are not payable
until the covered loss exceeds the deductible amount. This is why
deductible credits are given. For instance, if the policyholder
purchases $250,000 of building coverage, the maximum NFIP limits
available, with a $1,000 deductible, then no loss is payable until the
covered loss exceeds $1,000, the deductible amount. When the covered
loss is exactly $250,000, the deductible is taken from the covered loss
and $249,000 is paid. However, if the covered loss is $251,000, the
$1,000 deductible is also taken from the covered loss and $250,000 is
paid. If otherwise, a policyholder purchasing a $250,000 building limit
of liability would rightfully be disappointed to learn that only
$249,000 of the purchased limit could be paid regardless of the covered
loss amount. If the covered loss is $252,000, the $1,000 deductible is
taken from the covered loss, but ” as the policy states - the payment
is subject to the limit of liability that applies and only $250,000 is
paid.
The payment of the $250,000 policy limit does not necessarily indicate
a total loss. A building's value could be more than the $250,000 policy
limit and, as the example above demonstrates, the covered loss could be
in excess of the $250,000 limits. The key is the payment is subject to
the policy limits and no more than $250,000 may be paid. This treatment
of the deductible has been used since the inception of the NFIP and is
consistent with practices used by the property and casualty industry.
Moreover, audits by the GAO, the Inspector General, and independent CPA
firms have not indicated that there was a problem with the NFIP's
application of the flood insurance deductible.
NFIP's Financial Reporting Process:
GAO notes that the financial data received from the WYO companies is
consolidated into a single file. However, this file is uploaded into
Focus, not manually loaded or re-keyed. The Focus data is then
automatically downloaded into the Traverse financial reporting system.
The BSA personnel do not enter the data again as noted in the report
and process flow chart. This misunderstanding of the financial
reporting process was the basis for several inaccurate conclusions.
[Report incorporates additional detail on pages 6, 7, 11, and 12
clarifying FEMA's use of manual processes]
Weaknesses in NFIP Transaction Controls and Processing Limited
Accountability and Financial Reporting:
WYO Companies Did Not Provide Complete Documentation to FEMA for Claims
Transactions:
The 2005 to 2007 period that GAO reviewed was unprecedented in NFIP
history. In 2005, many of the 55,000 losses from four Florida
hurricanes in 2004 and much of the associated $2 billion in losses were
paid. Losses from Hurricanes Katrina, Rita and Wilma were also paid
primarily in 2005 and 2006. Hence, the $17.6 billion in paid losses for
2005 exceed the combined total losses for all years since the NFIP's
inception in 1978. These unprecedented times required unprecedented
solutions. Because of the frequency (209,000 losses), complexity, and
severity of the 2005 Hurricane Katrina losses, certain expedited claims
procedures were put in place. Hence, the requirement to file the
preliminary report and the final report was waived. [See comment 2]
GAO correctly describes the working of the Financial Assistance/Subsidy
Arrangement. Companies are required to process NFIP losses in
accordance with all the companies insurance policies. Over the years
the Operation Reviews have determined that the information included in
the NFIP forms are also provided by company proprietary forms. The
particular company referred to in the report is among the three largest
WYO companies; therefore the random sample reviewed by GAO may have
produced a larger number of claims files for this company, which could
have overstated the number of missing preliminary and final reports.
[See comment 3]
BSA-level Internal Controls Do Not Verify Accuracy of WYO Company Data:
The internal controls for the front end balancing process include
reconciliations, automated statistical edits, financial
reconciliations, balanced exhibits, signed certifications by executives
at the WYO companies, and policy, premium, and loss data detail edits
in the information system. These controls have been in place and
audited for over 20 years. Independent auditors, the Inspector General
and the GAO have not suggested that the design of the internal controls
governing FEMA's financial reporting procedures is flawed. The form and
structure of the transaction level detail is audited at the source,
including consideration of the relevance, reliability, and accuracy of
the transaction level detail and this does not limit assurance or
create material weaknesses in internal control. These recurring
internal control reviews and external audits are not mentioned as
mitigating consideration in the text of the report. [See comment 4]
The Design of FEMA's Financial Reporting for NFIP Activity is Flawed:
[Report addresses on pages 11 and 12]
There appears to be a philosophical difference between GAO and FEMA
regarding where the transaction level detail should reside. The design
of NFIP' s processing system is based on distributed accountability at
the WYO site with auditable compliance and oversight control at the
Bureau and Statistical Agent and FEMA. Distributed accountability is
not an internal control weakness and the design of FEMA's financial
reporting for the NFIP is not flawed. FEMA does not rely on unverified
WYO data and manual processing. GAO does not acknowledge this in the
report and does not sufficiently take into account the assurances
provided by reconciliation controls and independent audits. FEMA
officials believe the NFIP reports complete and accurate financial
information that withstands audit scrutiny.
Weaknesses in FEMA's Oversight Structure Limited Effectiveness in
Monitoring NFIP Financial Activity:
FEMA Did Not Monitor Completion or Results of WYO Company Audits:
In 2008, FEMA implemented a new process to track completion and review
of the results of the required biennial audits. FEMA received all
audits due in 2009 and, as necessary, followed-up with the WYO
companies.
GAO's suggestion that FEMA does not systematically monitor the WYO
companies is incorrect. The WYO Standards Committee regularly reviews
company performance including financial and statistical data
submissions, claims and underwriting operational review results,
biennial audit reports, and other material relating to company
performance. Should performance fall below an acceptable level, the
Committee can request an Audit for Cause. The Standards Committee's
vigilant monitoring of the WYO companies has reduced if not eliminated
the need for Audits for Cause, which GAO notes have not been done since
the 1990s. Regarding State Departments of Insurance audits, these
audits typically do not focus on the NFIP because it is a Federal
insurance program. FEMA does receive correspondence from State
Insurance Departments regarding issues of customer service with a Write-
Your-Own Company. FEMA officials know of no independent source that
could provide this information.
Operational Reviews Are Ineffective:
FEMA has revised its Operation Review process, which will be phased in
beginning in 2010, to address GAO's concerns. WYO companies are on a
three-year cycle for Operation Reviews. If a company fails a review, a
follow-up review is scheduled within 12 months. The recently revised
draft Financial Control Plan provides for a new process that addresses
the vendor's small, medium, medium-large, and large client WYO
companies. The large companies, those with more than 100,000 policies
in force, are independently reviewed every three years. Small and
medium sized companies can be part of a combined review and are also on
a three-year schedule. In addition, the new review process allows 30
additional randomly selected claims to be reviewed - 10 Increased Cost
of Compliance claims, 10 Residential Condominium Building Association
Policy claims, and 10 Post-FIRM (Flood Insurance Rate Map) elevated
building claims.
With regard to Litigation Operation Reviews, FEMA explained to GAO that
the litigation process is generally reviewed when a claim in litigation
is selected randomly, however, FEMA insurance examiners also review all
litigation claim expenses once the total fee exceeds a threshold
amount. In this way, FEMA insurance examiners review the substance of a
much greater number of litigation files than operation reviews would
allow.
FEMA's Flawed Sampling Procedures Hamper its Claims Reinspection
Program:
The purpose of the claims reinspection program is to identify and
mitigate procedural problems early in the claims adjustment process.
FEMA has used a random sample of claims for reinspections since 2007.
Reinspections are conducted as flood claims are occurring to minimize
errors in the settlement of claims. Reinspections are not intended to
be a definitive audit of the NFIP's claims handling process and hence,
GAO's conclusion that "the agency cannot project the results of these
reinspection oversight activities to confidently determine the overall
accuracy of claims settled for specific flood events or assess the
overall performance of insurance companies and their adjusters in
fulfilling their NFIP responsibilities" is erroneous.
Claims operation reviews are designed to provide feedback on claims
settlements and ascertain compliance by WYO companies. In response to a
previous GAO audit, FEMA began using a statistically representative
sample for Claims Operation Reviews. GAO's misunderstanding of the two
processes lead to incorrect conclusions regarding the efficacy of the
claims reinspection program.
Thank you again for the opportunity to comment on this draft report and
we look forward to working with you on future homeland security issues.
Sincerely,
Signed by:
Jerald E. Levine:
Director:
Departmental GAO/OIG Liaison Office:
The following section provides GAO's comments on DHS' letter dated
December 4, 2009.
GAO Comments:
1. We deleted the footnote containing this estimate, although the draft
report did not characterize it as an overpayment. We revised the text
on page 5 in the Background section to clarify our description of
FEMA's claims adjustment process.
2. Our report recognizes the unprecedented losses, but nevertheless the
internal control issues we identified raise concerns that the amounts
of the claims NFIP paid were not adequately supported even considering
the expedited procedures in place at the time.
3. Because we used a statistical sample from the insurance claim losses
paid databases, our sample allows us to make generalizations about the
population. The larger WYO companies that processed more claims would
constitute a larger number of claims in our statistical sample.
4. FEMA was unable to provide evidence of whether all WYO companies had
completed biennial audits and had not reviewed the results of any
biennial audits. Further, as discussed in our draft report, FEMA
officials exempted certain WYO companies from the biennial audit
requirement after the 2005 hurricane season. Therefore, FEMA had no
assurance as to the accuracy or validity of WYO company transaction-
level financial data.
[End of section]
Appendix III: GAO Contact and Staff Acknowledgments:
GAO Contact:
Susan Ragland, (202) 512-9095 or raglands@gao.gov:
Acknowledgments:
In addition to the contact named above, Chanetta Reed, Assistant
Director; Sharon Byrd, Assistant Director--Audit Sampling; Kwabena
Ansong; Gabrielle Fagan; Patrick Frey; Elizabeth Isom; Jason Kirwan;
Jason Kelly; Chelsea Lounsbury; Mary Osorno; and Gabrielle Perret made
significant contributions to this report.
[End of section]
Related GAO Products:
High-Risk Series: An Update. [hyperlink,
http://www.gao.gov/products/GAO-09-271]. Washington, D.C.: January
2009.
Flood Insurance: Options for Addressing the Financial Impact of
Subsidized Premium Rates on the National Flood Insurance Program.
[hyperlink, http://www.gao.gov/products/GAO-09-20]. Washington, D.C.:
November 14, 2008.
Flood Insurance: FEMA's Rate-Setting Process Warrants Attention.
[hyperlink, http://www.gao.gov/products/GAO-09-12]. Washington, D.C.:
October 31, 2008.
Information Technology: Management Improvements Needed on The
Department of Homeland Security's Next Generation Information Sharing
System. [hyperlink, http://www.gao.gov/products/GAO-09-40]. Washington,
D.C.: October 8, 2008.
National Flood Insurance Program: Financial Challenges Underscore Need
for Improved Oversight of Mitigation Programs and Key Contracts.
[hyperlink, http://www.gao.gov/products/GAO-08-437]. Washington, D.C.:
June 16, 2008.
National Flood Insurance Program: Greater Transparency and Oversight of
Wind and Flood Damage Determinations Are Needed. [hyperlink,
http://www.gao.gov/products/GAO-08-28]. Washington, D.C.: December 28,
2007.
Federal Emergency Management Agency: Ongoing Challenges Facing the
National Flood Insurance Program. [hyperlink,
http://www.gao.gov/products/GAO-08-118T]. Washington, D.C.: October 2,
2007.
National Disasters: Public Policy Options for Changing the Federal Role
in Natural Catastrophe Insurance. [hyperlink,
http://www.gao.gov/products/GAO-08-7]. Washington, D.C.: November 26,
2007.
Financial Management: Persistent Financial Management Systems Issues
Remain for Many CFO Act Agencies. [hyperlink,
http://www.gao.gov/products/GAO-08-1018]. Washington, D.C.: September
30, 2008.
National Flood Insurance Program: FEMA's Management and Oversight of
Payments for Insurance Company Services Should Be Improved. [hyperlink,
http://www.gao.gov/products/GAO-07-1078]. Washington, D.C.: September
5, 2007.
National Flood Insurance Program: Preliminary Views on FEMA's Ability
to Ensure Accurate Payments on Hurricane-Damaged Properties.
[hyperlink, http://www.gao.gov/products/GAO-07-991T]. Washington, D.C.:
June 12, 2007.
National Flood Insurance Program: New Processes Aided Hurricane Katrina
Claims Handling, but FEMA's Oversight Should Be Improved. [hyperlink,
http://www.gao.gov/products/GAO-07-169]. Washington, D.C.: December 15,
2006.
GAO's High-Risk Program. [hyperlink,
http://www.gao.gov/products/GAO-06-497T]. Washington, D.C.: March 15,
2006.
Federal Emergency Management Agency: Challenges for the National Flood
Insurance Program. [hyperlink, http://www.gao.gov/products/GAO-06-
335T]. Washington, D.C.: January 25, 2006.
Federal Emergency Management Agency: Improvements Needed to Enhance
Oversight and Management of the National Flood Insurance Program.
[hyperlink, http://www.gao.gov/products/GAO-06-119]. Washington, D.C.:
October 18, 2005.
National Flood Insurance Program: Oversight of Policy Issuance and
Claims. [hyperlink, http://www.gao.gov/products/GAO-05-532T].
Washington, D.C.: April 14, 2005.
[End of section]
Footnotes:
[1] As of December 2008, NFIP owed over $18 billion to the Treasury.
[2] See GAO, Flood Insurance: FEMA's Rate-Setting Process Warrants
Attention, [hyperlink, http://www.gao.gov/products/GAO-09-12]
(Washington, D.C.: Oct. 31, 2008); National Flood Insurance Program:
FEMA's Management and Oversight of Payments for Insurance Company
Services Should Be Improved, [hyperlink,
http://www.gao.gov/products/GAO-07-1078] (Washington, D.C.: Sept. 5,
2007).
[3] Federal Financial Management Improvement Act of 1996, Pub. L. No.
104-208, div. A., § 101(f), title VIII, 110 Stat. 3009, 3009-389 (Sept.
30, 1996). FFMIA was directed at ensuring that federal financial
management systems provide accurate, reliable, and timely financial
management information to government managers. FFMIA requires DHS and
23 other major departments and agencies to implement and maintain
financial management systems that comply substantially with (1) federal
financial management systems requirements, (2) federal accounting
standards, and (3) the U.S. Government Standard General Ledger at the
transaction level.
[4] The National Flood Insurance Act of 1968, as amended, is codified
at 42 U.S.C. §§ 4001 to 4129.
[5] There were approximately 90 WYO companies operating during 2008.
[6] The Direct Servicing Agent was outside the scope of our review.
[7] According to the NFIP Adjuster Claims Manual, the Bureau and
Statistical Agent (BSA) maintains a database of independent adjusters
who qualify to adjust flood claims. This database reflects whether the
adjuster has attended FEMA-recognized flood workshops.
[8] FEMA awards a contract for a BSA, which is responsible for
conducting financial and statistical reporting based upon data
submissions from the WYO companies, developing forms and information
related to NFIP, and providing various data analyses. The BSA serves as
the liaison between the government and insurance companies that issue
federally guaranteed NFIP policies.
[9] In addition, WYO companies house premium and claim files and
related records.
[10] The Transaction Record Reporting and Processing (TRRP) Plan
defines the reporting requirements applicable to the writing and
servicing of policies issued by the WYO companies. The plan contains
detailed specifications for recording and compiling data.
[11] The WYO Accounting Procedures Manual provides templates called
"Financial Exhibits" for the WYO companies to use in submitting
financial data. For purposes of our report, we use the term "financial
exhibit" when describing the financial statements submitted to the BSA
by the WYO companies.
[12] BSA personnel upload financial data from spreadsheets the WYO
companies submit into the Focus mainframe system. These spreadsheets
consist of the WYO companies' financial statement exhibits in a
standard format required by FEMA's WYO Accounting Procedures Manual.
[13] Preliminary reports are to be completed by adjusters for all flood
losses and must be submitted within 15 days after receipt of the loss
assignment. The preliminary report documents information on the
insurance policy, the risk, and the cause of the loss.
[14] Final reports are also to be completed by adjusters for all flood
losses and are due 30 days after the preliminary report is submitted.
The final report documents information on the history of the premises
such as date constructed, any alterations, and any prior losses, as
well as information on the mortgagee, a summary of the claim, and any
excluded damages.
[15] We noted that 35 of these claim files missing preliminary and
final reports are for claims adjusted by one particular WYO company.
According to FEMA, this WYO company has historically taken the position
that they will provide the information required but will do so in
accordance with the processing of all its insurance policies as allowed
by the Financial Assistance/Subsidy Arrangement. In other words, it
will use its own forms that contain the information in the NFIP
preliminary and final reports. While complying with the Financial
Assistance/Subsidy Arrangement, based on our review of the information
in the claim files as compared to the standard preliminary and final
reports, we noted that the company's forms in the files do not contain
certain information such as any salvage amount and the prior condition
of the building and contents. In addition, the forms are not
consistently signed by the adjuster and it is not clear whether the
reports were prepared timely.
[16] GAO, Internal Control Management and Evaluation Tool, [hyperlink,
http://www.gao.gov/products/GAO-01-1008G] (Washington, D.C.: August
2001).
[17] The WYO Financial Control Plan requires WYO companies to submit a
monthly financial statement reporting package to the BSA. This package
is to include financial statements, reconciliation statements,
certification statements, and statistical transactions. The WYO
Accounting Procedures Manual provides templates called "Financial
Exhibits" for the WYO companies to use in submitting financial data.
For purposes of our report, we use the term "financial exhibit" when
describing the financial statements submitted to the BSA by the WYO
companies.
[18] Variance reporting is the preparation of a report--by the BSA
using spreadsheet software--that shows variances or differences between
financial information and statistical information. This report also
tracks year-to-date and historical financial and statistical
information.
[19] The Standards Committee meets three times a year (and is alerted
to WYO company activity by the BSA and FEMA officials throughout the
year) to discuss the status of NFIP on such topics as WYO company
performance issues and material variances between statistical and
financial data in excess of 1 percent or $50,000 for Net Written
Premium or Net Paid Losses or $5,000 for Federal Policy Fees.
[20] According to GAO's previous report, National Flood Insurance
Program: FEMA's Management and Oversight of Payments for Insurance
Company Services Should Be Improved [hyperlink,
http://www.gao.gov/products/GAO-07-1078], biennial audits were not
performed consistently as required by regulation.
[21] See [hyperlink, http://www.gao.gov/products/GAO-07-1078]. We did
not evaluate the quality of the biennial audits conducted.
[22] See GAO, Flood Insurance: Opportunities Exist to Improve Oversight
of the WYO Program, [hyperlink, http://www.gao.gov/products/GAO-09-455]
(Washington, D.C.: Aug. 21, 2009).
[23] See [hyperlink, http://www.gao.gov/products/GAO-09-455].
[24] According to GAO's previous report, Federal Emergency Management
Agency: Improvements Needed to Enhance Oversight and Management of the
National Flood Insurance Program, [hyperlink,
http://www.gao.gov/products/GAO-06-119] (Washington, D.C.: Oct. 18,
2005), the process FEMA used to select a sample of claims files for
operational reviews and the process its program contractor used to
select a sample of adjustments for reinspections did not produce a
sample that was randomly chosen or statistically representative of all
claims.
[25] FEMA officials told us that they are revising the Financial
Control Plan and no longer perform marketing, customer services, and
litigation operational reviews. There were no reviews of this type
performed during the period of our review (fiscal years 2005 to 2007).
The FEMA officials said each of these functions were being reviewed by
other methods; however, we reported that the draft Financial Control
Plan did not incorporate these other methods.
[26] GAO, Internal Control Management and Evaluation Tool, [hyperlink,
http://www.gao.gov/products/GAO-01-1008G] (Washington, D.C.: August
2001).
[27] See [hyperlink, http://www.gao.gov/products/GAO-06-119].
[28] GAO, Policy Manual (Washington, D.C.: Jan. 1, 2004).
[29] See [hyperlink, http://www.gao.gov/products/GAO-06-119].
[30] See GAO, National Flood Insurance Program: New Processes Aided
Hurricane Katrina Claims Handling, but FEMA's Oversight Should Be
Improved, [hyperlink, http://www.gao.gov/products/GAO-07-169]
(Washington, D.C.: Dec. 15, 2006).
[31] See [hyperlink, http://www.gao.gov/products/GAO-07-1078].
[32] According to FEMA, NextGen is intended to be a full life-cycle
NFIP technology-modernization effort focused on providing business-
driven solutions for the NFIP BSA using state-of-the-art, industry-
proven technologies. The principal NextGen project goals are to improve
BSA and WYO company processes to benefit all NFIP stakeholders, while
achieving more efficient and effective program operations. We currently
have work under way looking at this system.
[33] Federal Financial Management Improvement Act of 1996, Pub. L. No.
104-208, div. A., § 101(f), title VIII, 110 Stat. 3009, 3009-389 (Sept.
30, 1996). FFMIA was directed at ensuring that federal financial
management systems provide accurate, reliable, and timely financial
management information to government managers. FFMIA requires DHS and
23 other major departments and agencies to implement and maintain
financial management systems that comply substantially with (1) federal
financial management systems requirements, (2) federal accounting
standards, and (3) the U.S. Government Standard General Ledger at the
transaction level.
[34] We were able to successfully reconcile the second set of premium
data we requested and received for fiscal years 2006 and 2007; a third
set of premium data was requested for fiscal year 2005 and then we were
able to reconcile this set. We performed this reconciliation between
the financial statements and the database financial information.
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Phone:
The price of each GAO publication reflects GAO‘s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO‘s Web site,
[hyperlink, http://www.gao.gov/ordering.htm].
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional
information.
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
