Background CCDF Laws and Regulations The Child Care and Development Block Grant (CCDBG) Act, as amended, is the main federal law governing state child-care programs for low-income working families. The act was reauthorized in 2014, and the reauthorization included a focus on improving the overall quality of child- care services and development of participating children. In September 2016, OCC published new rules (CCDF regulations) to provide clarity to states on how to implement this law and administer the program in a way that best meets the needs of children, child-care providers, and families. The CCDBG Act and CCDF regulations allow states flexibility in developing CCDF programs and policies that best suit the needs of children and parents within that state. According to OCC, these new rules also align child-care requirements with new Head Start regulations, including certain requirements for background checks, annual monitoring, and prelicensure inspections for some CCDF providers. OCC also added regulatory requirements for state lead agencies to describe in their State Plans effective internal controls that are in place to ensure integrity and accountability including 1. processes to ensure sound fiscal management, 2. processes to identify areas of risk, 3. processes to train child-care providers and staff of the lead agency and other agencies engaged in the administration of the CCDF about program requirements and integrity, and 4. regular evaluation of internal control activities. Lead agencies are also required to describe in their State Plans the processes that are in place to identify fraud or other program violations, and to investigate and recover fraudulent payments and to impose sanctions in response to fraud. CCDF Program Administration OCC is a program office within ACF that works with the states to administer the CCDF program. OCC and states each have responsibility for overseeing and protecting the integrity of the CCDF program. Each state must develop, and submit to OCC for approval, a State Plan that identifies the purposes for which CCDF funds will be spent for a 3-year grant period and designates a lead agency responsible for administering child-care programs. To administer CCDF funds, federal law and regulations require that states report their CCDF expenditures and data on the number of children served by CCDF subsidies. The current reporting structure as described by OCC and ACF officials is shown in figure 1. State Plan Review and Approval Process To request funding from the CCDF, states submit a State Plan for administering their CCDF programs to OCC. OCC provides states with a Plan Preprint, which serves as a template and includes instructions and guidance on developing the State Plans and providing information required by law and regulations. Further, OCC has used the Plan Preprint to request additional information from the states. The Plan Preprint developed for fiscal years 2019–2021 State Plans consists of eight sections and is the first to include the new CCDF regulatory requirements, added in September 2016 as required by the 2014 reauthorization. One of the new requirements is for state lead agencies to describe in their State Plans effective internal controls that are in place to ensure integrity and accountability. In addition, OCC modified the Plan Preprint for fiscal years 2019–2021 State Plans to add the instruction requesting states to report information about the results of their program-integrity and fraud- fighting activities, in addition to providing descriptions of the activities themselves. The Secretary of Health and Human Services, through OCC, has the responsibility to approve State Plans that satisfy the requirements, and review and monitor state compliance with the approved State Plan. According to OCC officials, the Program Operations Division within OCC, in partnership with the OCC regional program unit staff (regional offices), reviews the State Plans and approves those that they determine have satisfied the requirements of the CCDBG Act and CCDF regulations. CCDF Improper-Payment Reporting The CCDF has been designated as a high-priority program, as defined by OMB, under the Improper Payments Elimination and Recovery Improvement Act of 2012 (IPERIA), meaning that it is a program susceptible to significant improper payments. Federal statutes require federal agencies to evaluate programs for improper-payment risk and, for programs susceptible to significant improper payments, to report on actions taken to reduce improper payments. CCDF regulations implement these requirements by requiring states to calculate and report estimates of their improper payments, including proposed actions to address sources of error. These reports are developed by the states on a 3-year rotational cycle, and HHS reports the aggregate results in its Agency Financial Report. The CCDF gross improper payment estimate for fiscal year 2019 is approximately $325 million, and the estimated improper payment rate is 4.53 percent. OCC oversees states’ compliance with the prescribed procedures for estimating improper-payment error rates by approving the preliminary documents, approving any changes to the case samples, conducting the Joint Case Reviews, and reviewing and approving the final State Improper Payments Report and CAP submissions. If a state reports an error rate at or above 10 percent, it must also submit a CAP, which includes detailed descriptions of specific activities planned to reach a targeted reduction in errors. It must then submit an update on its progress and a new CAP the following year if it has not completed the proposed corrective actions or if the error rate is still at or above 10 percent. The improper-payment reporting process is illustrated in figure 2. OCC Monitoring System In fiscal year 2019, OCC launched a formal Monitoring System to review a selection of states annually over the course of the 3-year State Plan period. According to OCC officials, the three main purposes of the Monitoring System are to: (1) ensure compliance with the CCDBG Act, CCDF regulations, and the approved State Plans; (2) identify state technical-assistance needs; and (3) identify promising practices to inform continuous quality improvement. The Monitoring System focuses on 11 topic areas, which include program integrity and accountability. In addition, other topic areas include disaster preparedness, consumer education, and health and safety requirements. OCC officials told us that monitoring is completed on a rolling basis, and that they plan to monitor one-third of states each fiscal year, from fiscal years 2019 to 2021. According to OCC officials, they scheduled the monitoring to ensure that a state will not be submitting an improper- payment report in the same year that it participates in the monitoring. Figure 3 provides additional details regarding the OCC Monitoring System process, which includes an on-site visit to monitored states. Fraud Risk Management Fraud and “fraud risk” are distinct concepts. Fraud risk exists when individuals have an opportunity to engage in fraudulent activity, have an incentive or are under pressure to commit fraud, or are able to rationalize committing fraud. Although the occurrence of fraud indicates there is a fraud risk, a fraud risk can exist even if fraud has not yet been identified or occurred. For example, suspicious billing patterns or complexities in program design may indicate a risk of fraud even though fraud has not been identified or occurred. When fraud risks can be identified and mitigated, fraud may be less likely to occur. According to federal standards and guidance, executive-branch agency managers are responsible for managing fraud risks and implementing practices for combating those risks. Specifically, federal internal control standards state that management should consider the potential for fraud when identifying, analyzing, and responding to risks. As part of these standards, management assesses risks the entity faces from both external and internal sources. In addition, in July 2015, GAO issued the Fraud Risk Framework, which provides a comprehensive set of key components and leading practices that serve as a guide for agency managers to use when developing efforts to combat fraud in a strategic, risk-based way. The Fraud Risk Framework describes leading practices in four components, as shown in figure 4. The Fraud Reduction and Data Analytics Act of 2015, enacted in June 2016, required OMB to establish guidelines for federal agencies to create controls to identify and assess fraud risks, and design and implement antifraud control activities. The act further required OMB to incorporate the leading practices from the Fraud Risk Framework in the guidelines. In July 2016, OMB published guidance about enterprise risk management and internal controls in federal executive departments and agencies. Among other things, this guidance affirms that managers should adhere to the leading practices identified in the Fraud Risk Framework. OCC Provides Oversight by Approving State Plans but Has Not Established Policies for Reviewing State Plans and Has Not Defined Its Informational Needs As part of its oversight of states’ CCDF programs, OCC reviewed and approved State Plans for the current grant period (fiscal years 2019– 2021). However, OCC has not established written policies to guide staff review and approval of these State Plans, a process that occurs every 3 years. OCC’s lack of established policies limits its ability to ensure that staff follow appropriate protocols for consistency when reviewing and approving State Plans and to retain organizational knowledge in the event of staff turnover, which OCC noted as occurring during each review period. Further, OCC requested that states report information about the results of states’ program-integrity activities. However, most of the State Plans that it approved did not provide the results of states’ program- integrity activities as requested. OCC officials told us that they plan to continue to request that states report on the results of their program- integrity activities, but OCC has not identified what it considers to be “results” of program-integrity activities. Without taking additional steps to define its informational needs and encourage states to report the results of their program-integrity activities, OCC will not have this information to help determine whether states are effectively ensuring the integrity of the CCDF program. OCC Reviewed and Approved State Plans To provide oversight of states’ CCDF program-integrity activities, OCC reviewed and approved State Plans for the current grant period, covering fiscal years 2019–2021. To do so, OCC officials described to us a process that began with a high-level review of the draft State Plans submitted through an electronic system. After an initial review for completeness, OCC staff focused on the contents of the State Plans including states’ responsiveness to each requirement. For example, one requirement is to describe the processes that the state will use to identify risk in its CCDF program. OCC officials also stated that they consider clarity, consistency, and compliance when assessing State Plans. OCC officials also explained that they reviewed the responses to determine whether they were sufficiently detailed, and sought clarification from the states when necessary. OCC officials stated that, prior to the final approval of the State Plans, staff completed a validation form that consists of a table listing the State Plan subsections with checkboxes next to each subsection. Figure 5 outlines the timeline for review and approval of State Plans. OCC Does Not Have Finalized Written Policies to Implement the Review Process OCC has developed a draft procedure for the State Plan review and approval process, but had neither finalized written policies before beginning its review of the fiscal years 2019–2021 State Plans, nor finalized written policies for future review periods that occur every 3 years. Instead, OCC officials told us that for the review and approval process completed in 2018, they provided their staff a variety of training materials and draft documents that encouraged discussion among those involved. These documents contained information and guidance on the process, such as explaining the overall operational processes for reviewing and approving State Plans and general roles and responsibilities. However, none of the documents were finalized as OCC’s written policies for staff to follow when implementing the fiscal years 2019–2021 State Plan review and approval process, or for subsequent review periods. In response to our request for finalized policies pertaining to how OCC reviewed and approved State Plans, OCC provided documents that have substantial limitations for explaining to OCC staff how they should review and approve State Plans. For example, OCC provided what it characterized as a three-page summary protocol, which, in part, contained a historical record of what occurred during the recently completed review period rather than guidance that would help OCC achieve its State Plan review objectives on a continuous basis. Specifically, the protocol describes the regular internal meetings and interactions that OCC staff had from September 2018 to December 2018. As such, the protocol does not describe the process that OCC staff should follow, or the meetings that should occur, when reviewing and approving State Plans in future years (i.e., on a continuous basis). OCC also developed in August 2018 a more-detailed draft procedure for reviewing and approving State Plans. The draft procedure contains information on the communication process between the central and regional offices, recognizes that there may be variation in internal processes among regional offices and from one review period to the next, and includes guidance on steps for resolving questions about State Plans, among other guidance. Unlike the three-page summary protocol, the draft procedure explicitly states its applicability to future review periods as well as the current State Plan review period, and therefore would have provided guidance for staff on a continuous basis had a finalized version been shared with staff and established as OCC’s written policies. However, because of the volume of work and differences in caseloads among regional offices, OCC officials stated that they did not share a finalized procedure with staff and that staff were neither expected nor required to use the draft procedure when conducting their review of State Plans for the fiscal years 2019–2021 review period. As such, this draft procedure did not represent the formal policies for staff to follow in performing their roles. In explaining why it relies on the three-page summary protocol and draft procedure rather than finalized written policies to guide its State Plan review and approval process, OCC officials stated that OCC needs flexibility in its policies during the review period. Specifically, there are staffing changes in both the central and regional offices for each State Plan review period, and having flexibility within the framework provided by the three-page summary protocol allows them to accommodate those changes. OCC officials noted that some of the processes are unique to each of the 10 regional offices because of differences in their structure, staffing, and caseloads. Likewise, OCC officials stated that the regional offices need flexibility to continuously adjust processes and timelines so that they can accommodate varying responsiveness from states, and evaluate the State Plans without undermining the flexibility afforded to states through the block grant. However, it is possible for OCC to establish written policies to guide processes that are common from one review period to the next, and across all regions, while still maintaining the necessary flexibility to accommodate staffing changes and regional differences, as it had already begun to do by developing its August 2018 draft procedure. In this regard, Standards for Internal Control in the Federal Government states that management should implement control activities through policies. In doing so, management communicates the policies to personnel so that personnel can implement the control activities for their assigned responsibilities. Further, Standards for Internal Control in the Federal Government includes minimum documentation requirements, such as that management develop and maintain documentation of its internal control system. An internal control system is a continuous built-in component of operations that provides reasonable assurance that an entity’s objectives will be achieved. Internal control is not one event, but a series of actions that occur throughout an entity’s operations. Further, internal control is recognized as an integral part of the operational processes management uses to guide its operations, and internal control is built into the entity as a part of the organizational structure to help managers achieve the entity’s objectives on an ongoing basis. As such, documentation of the internal control system should reflect a continuous, built-in component of operations rather than a historical record of a past event. Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel. OCC’s lack of established written policies limits its ability to ensure that staff follow appropriate protocols on a continuous basis when implementing the State Plan review and approval process, and limits its ability to provide a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel. Without finalizing written policies, an effort that could include leveraging its previously developed August 2018 draft procedure, OCC risks losing that knowledge each time there are staffing changes among central and regional offices. OCC Has Not Defined Information Needed to Analyze States’ Program- Integrity Results In response to a 2016 HHS OIG report, OCC has attempted to collect information about the results of states’ program-integrity and fraud- fighting activities by adding a new instruction to the fiscal years 2019– 2021 Plan Preprint requesting states to report such information in their State Plans. Specifically, the HHS OIG recommended that collecting data on program-integrity and fraud-fighting results would be an important step in monitoring states’ efforts to safeguard the CCDF program. Additionally, OCC officials told us that obtaining information on the results of program-integrity activities is important for understanding national trends and helping to inform OCC’s technical assistance to states and ensure states’ accountability over their program-integrity activities. However, our review of 51 approved State Plans found that 43 State Plans (about 84 percent) did not report the results of program-integrity activities as requested (see fig. 6). The other eight states (about 16 percent) reported the results of program-integrity activities. State Plans must meet the requirements set forth in the law and the CCDF regulations to be approved. OCC officials told us that the State Plans were approved without the information on the results of program- integrity activities because, although there are instructions in the Plan Preprint for states to report this information, the CCDF regulations do not require it. Further, OCC officials told us that when OCC submitted the Plan Preprint to OMB for approval under the Paperwork Reduction Act, OCC had indicated that the program-integrity results would be collected on an informational basis, and states would not be required to provide this information. According to an OCC official, only portions of the Plan Preprint with instructions for states to report on the results of program- integrity activities were requested on an informational basis, and all other information in that section was required for approval of the State Plans. OCC officials also told us that OCC will continue to request that states report on the results of their program-integrity activities in the State Plans, but OCC has not defined what information it needs regarding the “results” of states’ program-integrity activities and has not communicated the need to states or its staff. OCC officials told us that they will ensure that states submit this information by providing guidance to states on the purpose of collecting this information. However, OCC was not able to provide us with a definition or examples of what it considers to be “results” of program- integrity activities that would be helpful for ensuring states’ accountability over their program-integrity activities. In addition, OCC officials said that OCC did not communicate to states that the information about the results of program-integrity activities was being requested on an informational basis only. According to OCC officials, OCC did not specifically communicate its intention to states because it wanted states to provide a response, if possible. Similarly, OCC had not developed any specific internal criteria for its staff to use when reviewing State Plans to determine whether certain responses were sufficient for their informational needs, such as to better understand national trends. OCC officials also stated that there was no internal written guidance explaining to OCC staff that such information was not required for State Plan approval. Rather, this standard was communicated to staff during weekly meetings. Standards for Internal Control in the Federal Government states that management should use quality information to achieve the entity’s objectives. In doing so, management identifies the information requirements needed and defines the information requirements at the relevant level and requisite specificity for appropriate personnel. Further, Standards for Internal Control in the Federal Government states that management should internally and externally communicate the necessary quality information to achieve the entity’s objectives. In this context, after defining its informational needs regarding the results of program-integrity activities, OCC’s internal and external communication could include communication to the states, which are requested to include this information in the State Plans, and to its staff who will be responsible for analyzing this information. Until OCC defines what information it needs regarding program-integrity activity results, it will be limited in its ability to obtain quality information. By not communicating informational needs to states and staff, OCC will continue to lack quality information about the results of states’ program-integrity efforts and will not be able to use that information to analyze national trends and help ensure states’ accountability over their program-integrity activities, as described. OCC Provides Oversight of States’ Improper Payment Risks but Lacks Documented Guidance for Assessing States’ Corrective Actions Since 2013, seven states with improper-payment rates at 10 percent or above have submitted 14 corrective action plans (CAP) to OCC for review. However, OCC does not have any documented criteria to guide the review of the CAPs submitted by states to ensure the proposed actions are aimed at root causes of improper payments and are effectively implemented. OCC also has not documented the procedures it uses to follow up with states subject to CAPs, but said it is planning to. OCC Lacks Guidance for Ensuring Corrective Actions Are Aimed at Root Causes and Effectively Implemented Federal improper-payment statutes require federal agencies to review programs susceptible to significant improper-payment risks and develop actions to reduce improper payments. For example, the Improper Payments Elimination and Recovery Act of 2010 (IPERA) specifically requires agencies administering programs that are susceptible to significant improper payments, such as the CCDF, to report on actions the agency is taking to reduce improper payments. Because the CCDF is administered by states, this requirement is implemented in CCDF regulations by requiring states reporting improper-payment error rates at or above 10 percent to develop and implement CAPs. The OMB guidance implementing IPERA states that agencies should ensure that each corrective action is specifically aimed at a root cause of improper payments and that the actions are effectively implemented to prevent and reduce improper payments. According to this guidance, a root cause is something that would directly lead to an improper payment and, if corrected, would prevent the improper payment. In the proposed rulemaking in which OCC introduced the CAPs, OCC stated that the CAPs are intended to be comprehensive and detailed, so as to improve upon the descriptions of corrective actions already reported on a 3-year cycle, which sometimes lack detail or specificity. OCC officials told us that OCC reviewers use their CAP Review Tool to evaluate the CAPs for approval, which also lays out the protocol for conducting reviews. However, the CAP Review Tool does not require reviewers to document whether the corrective actions proposed by states are aimed at root causes of improper payments, or effectively implemented. Further, the written review procedure that accompanies the CAP Review Tool does not contain guidance for reviewers on evaluating whether corrective actions are aimed at root causes and are effectively implemented. OCC officials explained to us that, in their view, states are in the best position to identify the most-feasible approach to corrective actions based on their individual circumstances. We acknowledge that states should have flexibility to identify corrective actions based on their individual circumstances. However, according to OMB guidance, it is federal agencies that are to ensure that corrective actions are aimed at root causes of improper payments and effectively implemented. Further, in the proposed rulemaking in which OCC introduced the CAPs, OCC stated that it intended the CAPs to be used for OCC to hold states accountable as part of its compliance with IPERA. Accordingly, without providing additional guidance to its reviewers, OCC will lack assurance that states’ proposed corrective actions are aimed at root causes and effectively implemented. OCC officials also stated that the majority of the seven states subject to CAPs reduced their error rates over time, specifically to below 10 percent. OCC officials explained that this determination is based on the submission of the State Improper Payment Report for the next required reporting cycle or on states’ voluntarily conducting a review of a sample of cases and submitting the results to OCC to demonstrate they had reduced their error rate to below 10 percent. We did not independently corroborate OCC’s determination because assessing the reliability of the self-attested internal error-rate reviews conducted by certain states and reviewing this information was outside the scope of our work. However, as part of our review of the 14 CAPs that have been submitted to OCC in response to OCC’s improper-payment reviews since 2013, we found that one state was required to submit CAPs for 3 consecutive years and consistently proposed the same error-rate reduction targets, with different dates. This observation underscores the need to ensure the corrective actions a state proposes are specifically aimed at root causes of improper payments and are effectively implemented. OCC does not have guidance in place for its reviewers to determine whether the ongoing corrective actions a state proposes to reduce improper payments will be specifically aimed at root causes of improper payments and effectively implemented. This could leave the CCDF program at continued risk of improper payments. OCC Plans to Document Its CAP Follow-up Process OCC does not have written policies for its CAP follow-up process or documentation that follow-up has been completed for past CAPs. OCC officials told us that they plan to develop such written policies, but officials did not specify a timeline for completion. OCC officials described their process used to monitor states while they are subject to a CAP, which includes additional contact when the same state has been subject to CAPs for consecutive years. This CAP follow-up process is illustrated in figure 7. According to OCC officials, OCC intends to develop written policies for the CAP follow-up process but did not provide a time frame for completion. This will include, at a minimum, a written protocol for the activities illustrated above, which will be included in the next revision of the instructions given to states for improper-payment reporting. According to OCC officials, each region currently has its own process for documenting discussions with CAP states. Having established written policies for the CAP follow-up process will help ensure that OCC’s oversight and monitoring of CAPs is carried out consistently. OCC Has Taken Some Steps to Monitor States’ Program-Integrity Activities but Does Not Evaluate Their Effectiveness OCC Has Initiated a Monitoring System, but the System Does Not Assess Effectiveness of States’ Program-Integrity Control Activities OCC officials told us that their Monitoring System, initiated in fiscal year 2019, plays a part in OCC’s role to ensure that states’ program-integrity activities are effective. According to OCC officials, OCC uses two tools as part of its Monitoring System—a Compliance Demonstration Packet and Data Collection Tool. States complete the Compliance Demonstration Packet to outline how they propose to demonstrate compliance with regulatory requirements and implementation of the approved State Plans throughout the Monitoring System’s phases. For example, to show effective internal controls are in place to ensure integrity and accountability, states may provide OCC with state or local policies and manuals (previsit phase), and may submit to interviews or provide system demonstrations (on-site visit phase). OCC staff use the Data Collection Tool to record comments about the evidence observed, and to note whether additional follow-up is needed. Both of these tools contain language indicating that the effectiveness of states’ program-integrity and fraud-fighting activities are evaluated by OCC staff. For purposes of the Monitoring System, OCC officials said that states have broad flexibility to propose, in the Compliance Demonstration Packet, what documents and evidence to provide. In addition, states have the flexibility to propose how the state will demonstrate compliance with regulatory requirements. This includes the requirement to describe in its State Plan effective program-integrity control activities, which includes fraud-fighting activities. OCC officials further told us that OCC does not collect the same set of information or evidence across the country. Rather, OCC collects state-specific information based on what each individual state proposes. For example, the Compliance Demonstration Packet allows states to propose an approach for demonstrating their compliance with the requirement to describe in their State Plans effective internal controls that are in place to ensure integrity and accountability. OCC officials said the primary purpose of the Monitoring System is to ensure that states are in compliance with CCDF regulations and implementing the State Plans as approved, rather than to make an assessment of the efficacy of the State Plans. When we asked OCC officials how they determine whether a state has provided appropriate and adequate documentation for the purposes of the Monitoring System, these officials told us that staff develop specific questions for each state and look for evidence showing that states are implementing the State Plans as approved. For example, OCC officials might look for evidence of a state’s implementation of certain program-integrity activities described in its approved State Plan to verify that the activities described are in place. OCC officials also stated that staff decide what is acceptable through consensus and attempt to build consistency through internal discussions regarding the appropriateness of the material that states provide. However, there are no specific criteria to guide OCC staff’s assessment of the effectiveness of states’ program-integrity activities during these discussions. For example, there are no specific criteria to help OCC staff assess whether states’ implemented control activities are effective at identifying areas of risk. OCC officials stated that the CCDF regulations and the approved State Plans are the most-detailed criteria that they use to assess data collected for the Monitoring System. However, neither the CCDF regulations nor the State Plans include specific criteria for assessing whether the control activities are effective. OCC is responsible for monitoring states’ compliance with the CCDF regulations, and these regulations explicitly require that states describe in their State Plans “effective internal controls that are in place to ensure integrity and accountability.” According to Standards for Internal Control in the Federal Government, an effective internal control system has a monitoring component that is effectively designed, implemented, and operating. Additionally, a leading practice of the Fraud Risk Framework is to examine the suitability of existing fraud controls. Managers who effectively implement an antifraud strategy monitor and evaluate the effectiveness of preventive activities in this strategy and take steps to help ensure external parties with responsibility over fraud control activities effectively implement those activities. Without developing and using criteria to assess whether states’ program-integrity control activities are effective, OCC cannot ensure that states’ internal controls for program integrity are effective. Likewise, without examining the suitability of, and monitoring the effectiveness of, the states’ fraud control activities, OCC will be challenged in effectively implementing an antifraud strategy to minimize the risk of fraud in the CCDF program. OCC Has Developed Technical Assistance to Improve Program Integrity and Has Further Opportunities to Use These Tools to Monitor States’ Program-Integrity Activities OCC developed the Grantee Internal Controls Self-Assessment Instrument (Self-Assessment Instrument) in 2010 and makes the technical-assistance tool available to the states through its website. In response to a 2016 HHS OIG report, ACF officials said that OCC would use the Self-Assessment Instrument to address the report’s recommendations to request that states examine the effectiveness of their program-integrity and fraud-fighting activities, and examine with states the benefits of expanding such activities. The Self-Assessment Instrument contains five sections: (1) Eligibility Determination and Review; (2) Improper Payment Case Review Process; (3) Fraud and Overpayment Prevention, Detection, and Recovery; (4) Federal Reporting; and (5) Audits and Monitoring. According to OCC officials, as of August 2019, 19 states have completed the Self-Assessment Instrument since its inception. OCC officials stated that use of the Self-Assessment Instrument is based entirely on states’ self-identified risks, and states are free to choose which, if any, of the sections to complete. OCC officials have noted benefits as a result of states completing the Self-Assessment Instrument. Specifically, OCC officials said that states have improved their implementation processes and policies, and improper-payment error rates have decreased. In addition to making the tool available to states, OCC officials told us that OCC also provides technical assistance in completing the Self-Assessment Instrument, which may include an on-site facilitated discussion. The facilitated discussion may cover areas including control activities to identify and prevent fraud, and strategies to investigate and collect improper payments. Following the on-site facilitated discussion, an OCC contractor compiles a report summarizing state-identified issues to address in states’ policies and procedures, according to one OCC official. However, OCC officials told us that states are not required to act on this report. In addition to the Self-Assessment Instrument, OCC has recently coordinated on the development of the Fraud Toolkit, which is a series of electronic spreadsheets that states can use to respond to questions about their fraud risk management activities—such as staff training, procedures for addressing suspected fraud, and program administration. The tools assign risk levels to these areas based on the state’s responses, and will also include recommended next steps for each of those areas and generate a report to summarize overall risk. For example, data from these tools would indicate whether states’ CCDF program staff are trained to identify forms, such as wage stubs or employer letters that may have been forged or altered. The data would also indicate whether the state has a fraud referral process in place to expedite investigations. OCC makes the Fraud Toolkit available for states to use upon request. However, other than making the tool available, OCC officials said that OCC does not usually have any further involvement in states’ use of the tool. OCC officials told us that they do not plan to use either the Self- Assessment Instrument or the Fraud Toolkit to collect data about states’ CCDF programs because both the Self-Assessment Instrument and the Fraud Toolkit are intended as primarily technical-assistance tools rather than monitoring tools or data-collection instruments. OCC officials also told us that, to formally collect information from states’ use of such tools, they would need to seek approval from OMB. OCC officials stated that OCC’s goal is to develop technical assistance that best meets the needs of the states, and not to impose additional reporting requirements on the states. Officials also noted a concern that states could cease to participate in or accept technical assistance if such assistance is seen as increasing reporting requirements. However, according to OCC officials, OCC has not conducted a cost-benefit analysis of collecting such information. Leading practices in the Fraud Risk Framework are to monitor and evaluate the effectiveness of preventive activities; collect and analyze data; and adapt activities to improve fraud risk management. Further, although external parties—in this case, the state lead agencies—may be responsible for specific fraud control activities, Standards for Internal Control in the Federal Government states that management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. As part of these standards, management retains responsibility for monitoring the effectiveness of internal control over the assigned processes performed by external parties. Management is responsible for meeting internal control objectives, and may decide how the entity evaluates the costs versus benefits of various approaches to implementing an effective internal control system. However, cost alone is not an acceptable reason to avoid implementing internal controls, and cost-benefit considerations support management’s ability to effectively design, implement, and operate an internal control system that balances the allocation of resources and other factors relevant to achieving the entity’s objectives. By not evaluating the feasibility of collecting information from the Self-Assessment Instrument or the Fraud Toolkit— such as evaluating the feasibility of doing so during its Monitoring System process—OCC may be missing an opportunity to monitor the effectiveness of the internal control system to help states adapt control activities to improve fraud risk management. OCC’s Program- Integrity and State- Oversight Activities Are Not Informed by a Fraud Risk Assessment As described above, OCC has developed several program-integrity activities that could help assess and manage fraud risk if they were part of an antifraud strategy. For example, the improper-payment reporting process and Monitoring System are not specific to fraud but may generate information relevant to fraud risks. However, according to OCC officials, ACF has not completed a fraud risk assessment for the CCDF, which would provide a basis for the development of an antifraud strategy that describes the program’s approach for addressing prioritized fraud risks identified, as described in the Fraud Risk Framework. The Assess component of the Fraud Risk Framework calls for federal managers to plan regular fraud risk assessments and to assess risks to determine a fraud risk profile. Furthermore, Standards for Internal Control in the Federal Government states that management should consider the potential for fraud when identifying, analyzing, and responding to risks. Leading practices for planning fraud risk assessments include tailoring the fraud risk assessment to the program and planning to conduct the assessment at regular intervals and when there are changes to the program or operating environment. The leading practices also include identifying the tools, methods, and sources for gathering information about fraud risks and involving relevant stakeholders in the assessment process. The Fraud Risk Framework also identifies leading practices for conducting fraud risk assessments and documenting the program’s fraud risk profile, as illustrated in figure 8. As discussed in the Fraud Risk Framework, the fraud risk profile provides a basis for managers to develop and document an antifraud strategy that describes the program’s approach for addressing prioritized fraud risks identified. According to ACF, there is currently a process in place at the ACF level that will lead to the development of a Fraud Risk Assessment. Specifically, ACF is in the process of developing a Fraud Risk Assessment template, which will include a program fraud risk profile. The CCDF will be part of the pilot program for this effort. The Fraud Risk Assessment template will consider the Fraud Risk Framework as well as guidance contained in OMB Circular A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control, according to OCC officials. These officials also stated that ACF will leverage its previously developed and implemented risk assessments, including the Program Risk Assessment that was completed for the CCDF between fiscal years 2011 and 2016 as part of the HHS Program Integrity Initiative. However, according to ACF, the development of a Fraud Risk Assessment template is currently on hold due to competing priorities. The ACF stated the agency expects to resume the process by December 2019, and OCC expects that the draft template will be completed by the end of the first quarter of fiscal year 2020. Because the CCDF is serving as the pilot for the new template, OCC expects that the initial assessment of the program will be complete by the end of the third quarter of fiscal year 2020. Until ACF finalizes its template and conducts a risk assessment for the CCDF, ACF will not be able to develop a fraud risk profile for the CCDF. The fraud risk profile is an essential piece of the antifraud strategy and informs the specific control activities managers design and implement. Although there is currently a process in place for ACF to develop a fraud risk assessment template, until ACF carries out the assessment of the CCDF and develops an associated fraud risk strategy, it will lack assurance that OCC’s program-integrity activities are suitable and targeted at prioritized fraud risks. Conclusions Both state lead agencies and OCC play an important role in overseeing and protecting the integrity of the CCDF program. However, OCC has not finalized written policies that describes how staff should implement or document the State Plan review and approval process, which is an important part of OCC’s oversight of the CCDF program. OCC’s lack of established written policies limits its ability to ensure that staff follow appropriate protocols when implementing the State Plan review and approval process, and limits its ability to retain organizational knowledge in the event of staff turnover, which OCC noted as occurring during each review period. In addition, most of the State Plans submitted to OCC for the fiscal years 2019–2021 grant period did not contain information on the results of their states’ program-integrity activities. OCC also has not defined or communicated what it considers to be the “results” of program- integrity activities for states, which are requested to include this information in State Plans, or for its staff who will be responsible for analyzing this information. Until OCC defines its informational needs regarding program-integrity activity results and communicates this information to the states and its own staff, OCC may continue to lack quality information to help ensure states’ accountability of their program- integrity activities. Further, OCC does not have documented criteria to guide the review of the CAPs to ensure the proposed corrective actions are aimed at root causes of improper payments and are effectively implemented to prevent and reduce improper payments. Without criteria for its staff to use in reviewing the CAPs, OCC does not have assurance that the corrective actions a state proposes to reduce improper payments will be specifically aimed at root causes of improper payments and effectively implemented, leaving the CCDF program at continued risk of improper payments. OCC also does not have written policies for its CAP follow-up process or documentation that follow-up has been completed for past CAPs. In addition, OCC officials told us that they plan to develop a written protocol for this process, but did not specify a timeline for completion. Having established written policies for the CAP follow-up process will help ensure that OCC’s oversight and monitoring of CAPs is carried out consistently. OCC’s Monitoring System process does not currently contain criteria to assess the effectiveness of states’ program-integrity control activities, including fraud-fighting activities. Without developing and documenting criteria to assess whether states’ program-integrity control activities are effective, OCC cannot ensure that such program-integrity control activities are effective. In addition, OCC does not plan to collect any data from its technical-assistance tools that could potentially help it to monitor and evaluate the effectiveness of states’ program-integrity activities. However, OCC has not evaluated the benefits of using these tools to collect information on program-integrity activities against any costs of doing so— such as the cost of seeking OMB approval to do so. By not evaluating the feasibility of collecting information from technical-assistance tools to monitor the effectiveness of states’ program-integrity control activities, OCC may be missing an opportunity to help states adapt control activities to improve their fraud risk management. All of the foregoing program-integrity oversight and monitoring activities could contribute to a strategy for managing fraud risks in the CCDF. However, OCC has not completed a fraud risk assessment or risk profile for the program. Although there is currently a process in place for ACF to develop a fraud risk assessment template, until ACF completes this template and carries out the assessment of the CCDF, it will lack a robust antifraud strategy and assurance that OCC’s current program-integrity activities are suitable and targeted at prioritized risk. Recommendations for Executive Action We are making the following nine recommendations, eight to the Director of OCC and one to the Assistant Secretary for ACF: The Director of OCC should establish internal written policies to effectively implement and document the State Plan review and approval process for future review and approval periods. (Recommendation 1) The Director of OCC should define the informational needs related to the results of program-integrity activities. (Recommendation 2) The Director of OCC should communicate externally to the states its informational needs related to the results of states’ program-integrity activities. (Recommendation 3) The Director of OCC should communicate internally to staff its informational needs related to the results of states’ program-integrity activities. (Recommendation 4) The Director of OCC should develop documented criteria to guide the review of CAPs submitted by states to ensure that proposed corrective actions are aimed at root causes of improper payments and are effectively implemented. (Recommendation 5) The Director of OCC should timely complete its effort to develop established written policies for the CAP follow-up process to ensure that OCC’s oversight and monitoring of CAPs is carried out consistently. (Recommendation 6) The Director of OCC should develop and document criteria to assess the effectiveness of states’ program-integrity control activities. (Recommendation 7) The Director of OCC should evaluate the feasibility of collecting information from the Grantee Internal Controls Self-Assessment Instrument (Self-Assessment Instrument) and Fraud Toolkit, such as during its Monitoring System process, to monitor the effectiveness of states’ program-integrity control activities. (Recommendation 8) The Assistant Secretary for ACF should ensure that ACF conducts a fraud risk assessment to provide a basis for the documentation and development of an antifraud strategy that describes the CCDF program’s approach to address prioritizing fraud risks identified. (Recommendation 9) Agency Comments We provided a draft of this report to HHS for review and comment. In its comments, reproduced in appendix I, HHS concurred with our recommendations. HHS also provided technical comments, which we incorporated as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services and appropriate congressional committees. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staffs have any questions about this report, please contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II. Appendix I: Comments from the Department of Health and Human Services Appendix II: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Jonathon Oldmixon (Assistant Director), Erica Varner (Analyst in Charge), Yue Pui Chin, and Daniel Dye made key contributions to this report. Other contributors include James Ashley, Maria McMullen, George Ogilvie, and Sabrina Streagle.