8.12

Risk Assessment

Principle 8 - Assess Fraud, Improper Payment, and Information Security Risk

Attribute 8.12 - Management considers improper payment risk factors, both internal and external, which may include the following:

• whether the program or activity is new to the entity;
• the complexity of the program or activity;
• the volume of payments made through the program or activity;
• whether the payments or payment eligibility decisions are made through external parties;
• recent major changes in program funding, legal authorities, practices, or procedures;
• the level and experience of and quality of training for personnel responsible for making payment eligibility determinations or verifying that payments made are accurate;
• the extent to which the entity relies on potential recipients self-certifying their own eligibility;
• identified internal control deficiencies that might hinder accurate payment processing;
• similarities to other programs or activities that have reported improper payment estimates or been deemed susceptible to significant improper payments;
• improper payment estimates previously reported for the program or activity, or other indicator of potential susceptibility to improper payments;
• whether the program or activity lacks the information or database to confirm eligibility or verify the accuracy of the payment; and
• the risk of fraud related to the program or activity.