The $186B Problem: A Program-Integrity Playbook for Improper Payments

The federal government reported an estimated $162 billion in improper payments for fiscal year 2024, and health programs account for the largest single slice of that total. If you run program integrity for a state exchange or a Medicaid agency, the fastest way to reduce that number is to instrument detection at the front door, where eligibility and enrollment data enter, rather than chasing dollars after payments clear. Pre-payment controls recover more, cost less, and protect legitimate enrollees from the disruption of clawbacks.

This is a playbook, not a lecture. It translates the GAO Fraud Risk Framework into operational roles, tells you where to put detection instruments, how to triage a backlog you cannot fully staff, and how to prove you reduced improper payments without raising premiums.

The through-line: fraud is a front-door problem. By the time a payment clears, you have already lost the use that pre-payment scoring gives you. Everything below assumes you want to catch problems before the money moves.

What $162 Billion Actually Buys You in Wrong Incentives

The FY2024 government-wide improper-payment estimate landed at roughly $162 billion across reporting programs [1]. Medicaid alone reported an estimated improper-payment rate of about 5.09 percent, translating to tens of billions in a single program [2]. These are not rounding errors. They are structural leakage.

Here is the distinction that changes your entire control strategy: an improper payment is not the same as confirmed fraud. GAO defines improper payments as any payment that should not have been made or was made in an incorrect amount, which includes documentation errors, eligibility mistakes, and duplicate payments, alongside actual fraud [1]. Most improper payments are process failures, not criminals. Fraud is the deliberate subset.

Why does that distinction matter operationally? Because if you treat every improper payment as fraud, you overwhelm investigators and terminate legitimate enrollees. If you treat none of it as fraud, organized rings run wild. You need controls that separate the honest error from the fabricated paystub and route each to the right response.

Frame this for your leadership as a premium and taxpayer problem, not an audit line item. Every improper dollar in a subsidized exchange is a dollar that either raises premiums for honest enrollees or gets recovered later at high administrative cost. When you present detection ROI, translate it into premium impact. That gets budget approved faster than an abstract compliance number.

The GAO Fraud Risk Framework, Translated Into Operations

The GAO Fraud Risk Framework has four components: commit to combating fraud, assess fraud risks, design and implement controls, and evaluate and adapt [3]. Most agencies treat it as a compliance checklist. It works better as an operating model with named owners and measurable outputs.

The problem is that most states stall at "assess." They run a risk assessment, produce a document, file it, and never build the continuous evaluate-and-adapt loop that actually reduces fraud over time. Assessment without instrumentation is theater.

Here is how each component maps to a real owner, a detection instrument, and something you can measure.

The evaluate-and-adapt loop is where the real money is. Fraud rings change tactics the moment your controls become visible. A synthetic-identity ring that used fabricated SSNs last quarter will pivot to reused deceased SSNs this quarter. If you are not measuring catch rate and retuning, your controls decay.

Build the loop first, even if it starts small. A weekly review of ten flagged cases, tracking which held up and which were false positives, beats a perfect annual risk assessment that nobody acts on.

Where to Instrument Detection: The Front Door vs. Pay-and-Chase

Pay-and-chase loses. When you recover fraud after payment, you pay for the fraud, the investigation, the referral, and the recovery effort, and you often recover cents on the dollar. GAO has repeatedly found that prevention through pre-payment controls is more cost-effective than post-payment recovery [3].

Instrument detection where the data enters the system: at application, at enrollment, and at special-enrollment-period triggers. This is the front door. Four detection layers work together here, and each catches something the others miss.

• Document forensics flags tampered IDs, fabricated paystubs, and altered special-enrollment letters by analyzing image metadata, font inconsistencies, and template reuse across applications.
• Synthetic-identity and SSN intelligence catches fabricated, duplicate, deceased, or reused Social Security numbers before an application becomes an enrollment.
• Broker and agent ring behavioral analytics surfaces organized fraud by linking applications that share devices, IP ranges, submission timing, or a common broker ID.
• Program-integrity scoring fuses those signals into a single priority score that feeds a case queue.

If you are designing this from scratch, study how an enrollment-fraud front-door architecture sequences these layers so that cheap checks run first and expensive forensic analysis runs only on suspicious applications. Pair it with a progressive trust model that raises verification requirements as risk signals accumulate, rather than treating every applicant as a suspect.

The economics are not subtle. Pre-payment interception avoids the payment entirely. Post-payment recovery requires you to have already paid, then locate the recipient, then litigate or negotiate. For organized rings that dissolve and reincorporate, post-payment recovery frequently returns nothing.

Scoring and Triage: How to Prioritize a 10,000-Case Backlog

You will never staff enough investigators to work every flag. A mid-size exchange can generate thousands of anomaly alerts a month. The question is not how to clear the queue. It is how to work the highest-value cases first.

A program-integrity score solves this by combining three factors: financial exposure (how much this case could cost if fraudulent), ring linkage strength (how many other applications connect to it), and evidence quality (how strong the forensic findings are). A case with high exposure, strong ring linkage, and a confirmed tampered document belongs at the top of the queue. A single low-subsidy application with a minor documentation gap does not.

Here is how those signals combine in practice:

def program_integrity_score(case):
    # Financial exposure, normalized 0-1 by annualized subsidy at risk
    exposure = min(case.annual_subsidy / 25000, 1.0)

    # Ring linkage: shared device, IP, broker, or submission cluster
    linkage = min(case.linked_applications / 50, 1.0)

    # Evidence strength from forensic layers (0-1 confidence)
    evidence = max(
        case.document_forensics_confidence,
        case.ssn_intelligence_confidence,
        case.broker_ring_confidence,
    )

    # Weighted composite; evidence is gated so weak signals cannot
    # inflate a score on financial exposure alone
    score = (0.35 * exposure) + (0.30 * linkage) + (0.35 * evidence)

    # Ring cases get a multiplier: organized fraud scales
    if case.linked_applications >= 10 and evidence >= 0.6:
        score = min(score * 1.4, 1.0)

    return round(score, 3)

Translate the score into tiers that tell investigators exactly what to do and where human review is mandatory.

The tiering matters because it converts a scary 10,000-case backlog into a workable queue. If your critical tier is 200 cases, your team can realistically work those this week while automation handles verification requests for the medium tier.

Building Referral-Grade Cases for MFCUs and CMS

An anomaly alert is not evidence. Medicaid Fraud Control Units and CMS reject thin referrals that lack documentation, chain of custody, and a defensible audit trail. If your referral is a spreadsheet row that says "suspicious SSN," it goes in the trash.

A referral-grade packet contains the forensic findings with the underlying artifacts, a complete audit trail showing who reviewed what and when, chain of custody for every document, and a clear narrative tying the evidence to a specific violation. It should map identity findings to a recognized standard like NIST 800-63 identity assurance levels so a prosecutor understands the rigor behind the identity-proofing failure [4].

Here is the difference between what most systems produce and what MFCUs actually accept.

The gap between these two columns is the gap between a program-integrity unit that generates noise and one that generates prosecutions. MFCUs accept referrals they can act on. If your evidence is defensible, your acceptance rate climbs, and investigators stop wasting time re-building cases you should have delivered complete.

Tie your identity findings to CMS MARS-E control expectations as well [5]. When your referral shows both a NIST 800-63 identity-assurance failure and the specific MARS-E control that should have caught it, you give reviewers a clear line from evidence to remedy.

Measuring Catch Rate Without Hiking Premiums

If you cannot measure it, you cannot defend the budget. Track four core metrics and report them monthly.

Premium neutrality is the math that keeps your program funded. Add avoided payments (fraud stopped pre-payment) to recoveries, then divide by your program-integrity operating cost. If you protect three dollars for every dollar spent, you are premium-neutral or better, and you can prove detection does not raise costs, it lowers them.

Do not optimize catch rate alone. A team chasing a higher catch number will flag more aggressively, drive up false positives, and harm legitimate enrollees who then appeal, cost you money, and lose trust in the exchange. Catch rate and false-positive rate must move together. A rising catch rate with a rising false-positive rate is a failing program wearing a success mask.

Watch time-to-referral closely. Rings dissolve fast. A packet that takes 90 days to assemble often refers a shell that no longer exists. Under 30 days keeps your referrals actionable.

The 90-Day Playbook: What to Ship First

You do not need a two-year transformation. You need to ship a working loop in 90 days and improve it.

1. Days 1 to 30, instrument the front door. Stand up document forensics and SSN intelligence at application intake. Start scoring every new application. Do not wait for perfect coverage; score what you can and expand.
2. Days 31 to 60, build the triage queue. Implement the program-integrity score and risk tiers. Route critical and high tiers to investigators with mandatory human review. Automate verification requests for the medium tier.
3. Days 61 to 90, produce referral-grade packets and measure. Ship your first defensible packets to your MFCU. Stand up the four-metric dashboard and hold your first monthly evaluate-and-adapt review.

This closes the GAO loop that most agencies never reach. You commit, you assess, you implement, and critically, you evaluate and adapt, retuning thresholds as rings shift tactics.

FAQ

What is the difference between improper payments and fraud? Improper payments include any payment that should not have been made or was made in the wrong amount, covering errors, documentation gaps, and fraud. Fraud is the deliberate subset. Most improper payments are process failures, which changes how you respond [1].

Where should detection run? At the front door: application, enrollment, and special-enrollment triggers. Pre-payment controls prevent the loss instead of chasing it after payment [3].

How do you prioritize a large case backlog? Use a program-integrity score combining financial exposure, ring linkage, and evidence strength, then work the highest-scoring tier first with mandatory human review before any adverse action.

What makes a referral acceptable to an MFCU? Forensic findings with source artifacts, a complete audit trail, chain of custody, and alignment to standards like NIST 800-63 and CMS MARS-E [4][5].

Your next 30 minutes

Pull your last 100 flagged applications and score them against the three-factor model in this article: financial exposure, ring linkage, evidence strength. Rank them. You will likely find that fewer than 20 account for most of the exposure. That ranked list is your first triage queue.

This week, start tracking one metric: dollars protected per operational dollar. It is the number that proves detection lowers costs instead of raising premiums, and it is the number that turns a $162 billion problem into a defensible line item you actively control.

References

[1] U.S. Government Accountability Office, "Improper Payments: Fiscal Year 2024 Estimates and Opportunities for Improvement," 2025. https://www.gao.gov/improper-payments

[2] Centers for Medicare & Medicaid Services, "2024 Medicaid and CHIP Improper Payments Report (PERM)," 2024. https://www.cms.gov/data-research/monitoring-programs/improper-payment-measurement-programs/payment-error-rate-measurement-perm

[3] U.S. Government Accountability Office, "A Framework for Managing Fraud Risks in Federal Programs (GAO-15-593SP)," 2015 (still the governing federal framework). https://www.gao.gov/products/gao-15-593sp

[4] National Institute of Standards and Technology, "NIST Special Publication 800-63-4: Digital Identity Guidelines," 2025. https://pages.nist.gov/800-63-4/

[5] Centers for Medicare & Medicaid Services, "Minimum Acceptable Risk Standards for Exchanges (MARS-E) 2.0," 2024. https://www.cms.gov/marketplace/resources/regulations-guidance