High-Risk Series: Heightened Attention Could Save Billions More and Improve Government Efficiency and Effectiveness

What GAO Found

Since GAO's 2023 update to the High-Risk List, Congress and executive branch agencies have taken actions resulting in notable improvements across the 37 high-risk areas. These efforts over the last two years resulted in about $84 billion in financial benefits. However, the progress made overall varied. Ten areas improved and three regressed, while the others maintained their position, were rated for the first time, or were newly added, as shown on page 5. Lasting solutions to high-risk problems save billions of dollars, improve service to the public, and increase government performance and accountability.

New Area: Improving the Delivery of Federal Disaster Assistance

Natural disasters have become costlier and more frequent. In 2024, there were 27 disasters with at least $1 billion in economic damages. Overall, these events resulted in 568 deaths and significant economic effects on the affected areas. Their frequency and intensity have severely strained the Federal Emergency Management Agency (FEMA) and its workforce.

Recent natural disasters—including wildfires in Southern California and hurricanes in the Southeast—demonstrate the need for federal agencies to deliver assistance as efficiently and effectively as possible and reduce their fiscal exposure.

Debris from Damaged Homes Following Hurricanes Helene and Milton, 2024, Florida

The federal approach to disaster recovery is fragmented across over 30 federal entities. So many entities involved with multiple programs and authorities, differing requirements and timeframes, and limited data sharing across entities could make it harder for survivors and communities to navigate federal programs.

FEMA and other federal entities—including Congress—need to address the nation's fragmented federal approach to disaster recovery. Attention is also needed to improve processes for assisting survivors, invest in resilience, and strengthen FEMA's disaster workforce and capacity.

Several Areas Critical to Better Managing the Cost of Government

Since 2003, federal agencies have reported about $2.8 trillion in estimated improper payments, including over $150 billion government-wide in each of the last 7 years. These figures do not represent a full accounting of improper payments because agencies have not reported estimates for some programs as required. For example, we found that agencies failed to report fiscal year 2023 improper payment estimates for nine risk-susceptible programs.

The areas on the High-Risk List include programs that represented about 80 percent of the total government-wide reported improper payment estimate. These include two of the fastest-growing programs—Medicare and Medicaid—as well as the unemployment insurance system and the Earned Income Tax Credit. While agencies and the Department of the Treasury are taking some steps to address this issue, much more needs to be done to control billions of dollars in overpayments and prevent fraud. Implementation of GAO's recommendations by agencies and the Congress would help achieve better program integrity.

In 2024, the Internal Revenue Service (IRS) projected that the gross tax gap—the difference between taxes owed and taxes paid on time—was $696 billion for tax year 2022. IRS estimated that it will collect an additional $90 billion through late payments and enforcement actions, leaving an estimated $606 billion net tax gap. Also, IRS is continually addressing billions of dollars of attempted tax fraud through identity theft. Further, the Department of the Interior does not have reasonable assurance that it is collecting the entirety of the billions owed on oil and gas leases on federal lands. Actions by federal agencies and Congress on related GAO recommendations can help significantly to close these gaps and improve the government's fiscal position.

The government has great difficulty in controlling the costs of major acquisitions in its more than $750 billion procurement portfolio. This includes procurements critical to national defense, nuclear weapon systems modernization and clean up, space programs, and health care to veterans. Many major acquisitions by agencies such as the Department of Defense (DOD), the Department of Energy, the National Aeronautics and Space Administration, and the Department of Veterans Affairs (VA) have experienced cost growth, schedule delays, or both. Implementation of GAO's recommendations, which include more consistently applying leading practices, could yield billions in savings and provide more timely delivery.

The federal government is one of the nation's largest property holders. Annual maintenance and operating costs for its 277,000 buildings exceeded $10.3 billion in fiscal year 2023. Managing real property was designated high risk in 2003 because of large amounts of underused property and the great difficulty in disposing of unneeded holdings and ensuring the safety of workers and visitors. Costliness and underuse of government property holdings have been exacerbated by the recent use of telework and growing amounts of deferred maintenance, which rose from $170 billion in 2017 to $370 billion in 2024.

GAO recommended more appropriate utilization benchmarks be established to guide better and more timely property management. Also, lessons need to be applied from recent failed attempts to expedite disposals to establish a more viable process. Efforts are also needed to better manage and maintain property.

DOD is the only major federal agency to have never achieved an unmodified “clean” opinion on its financial statements. The department is committed to the goal of achieving a clean opinion on its statements and has made important progress in reaping several financial and operational benefits. A clean opinion was recently obtained by the Marine Corps, in addition to several smaller components. DOD needs to redouble its efforts to revamp financial management systems, more promptly fix problems identified by its auditors, and focus more on ensuring a well-qualified workforce to attain proper accountability and potential savings.

Harnessing Modern Information Technology to Improve Services and Programs

The federal government spends more than $100 billion annually on IT, with the vast majority of this spent on operations and maintenance of existing systems rather than new technology. Currently, the government, in many cases, is carrying out critical missions with decades-old legacy technology that also carries tremendous security vulnerabilities. Many attempts to implement new systems have too often run far over budget, experienced significant delays, and delivered far fewer improvements than promised. Recent challenges at the Federal Aviation Administration (FAA), Department of Education, and VA vividly illustrate this situation.

• FAA has experienced increasing challenges with aging air traffic control systems in recent years and has been slow to modernize the most critical and at-risk systems. A 2023 operational risk assessment determined that of FAA's 138 systems, 51 (37 percent) were unsustainable with significant shortages in spare parts, shortfalls in sustainment funding, little to no technology refresh funding, or significant shortfalls in capability. An additional 54 (39 percent) were potentially unsustainable.
• The Department of Education's Office of Federal Student Aid did not adequately plan for its deployment of the Free Application for Federal Student Aid (FAFSA) Processing System. The initial rollout of the new system was delayed several times, faced several critical technical issues, and experienced very poor customer service. This contributed to about 9 percent fewer high school seniors and other first-time applicants submitting a FAFSA, as of August 25, 2024.
• After three unsuccessful attempts between 2001 and 2018, VA initiated a fourth effort—the electronic health record (EHR) modernization program—to replace its health records system. In 2022, the Institute for Defense Analysis estimated that EHR modernization life cycle costs would total $49.8 billion—$32.7 billion for 13 years of implementation and $17.1 billion for 15 years of sustainment. VA remains in the early stages of deploying its new EHR system across 160 locations. As of December 2024, VA deployed the EHR system to just six of its locations and plans to deploy it at four more locations in 2026. There are over 160 remaining locations for EHR implementation.

These are examples of poor performance that led GAO to designate Improving IT Acquisitions and Management as a government-wide high-risk area in 2015. There have been some improvements, including closing unneeded data centers, which saved billions of dollars. Congressional oversight by the House Committee on Oversight and Government Reform, Subcommittee on Government Operations, has helped spur improvements and included exhortations to have Chief Information Officers (CIO) more involved.

Of the 1,881 recommendations made by GAO for this high-risk area since 2010, 463 remained open as of January 2025. Agency leaders need to give this area a higher priority and provide their CIOs necessary authorities and support if the government is ever to reap the benefits of modern technology.

Expediting the Pace of Cybersecurity and Critical Infrastructure Protections

While improvements have been made and efforts continue, the government is still not operating at a pace commensurate with the evolving grave cybersecurity threats to our nation's security, economy, and well-being. State and non-state actors are attacking our government and private-sector systems thousands of times each day. In addition to national security and intellectual property, systems supporting daily life of the American people are at risk, including safe water, ample supply of energy, reliable and secure telecommunications, and our financial services.

GAO has made 4,387 related recommendations since 2010. While 3,623 have been implemented or closed, 764 have not been fully implemented. Also, greater federal efforts are needed to better understand the status of private sector technological developments with cybersecurity implications—such as artificial intelligence— and to continue to enhance public and private sector coordination.

Seizing Opportunities to Better Protect Public Health and Reduce Risk

Several of GAO's high-risk areas focus on addressing critical weaknesses in public health efforts. GAO's recommendations focus on

• ensuring the Department of Health and Human Services significantly elevates its ability to provide leadership and coordination of public health emergencies;
• providing the Food and Drug Administration with a much greater capacity to (1) inspect foreign drug manufacturers that produce many of the drugs consumed by Americans and (2) take stronger actions to address persistent drug shortages, including cancer therapies;
• improving the timeliness and quality of care given to our veterans, including mental health and suicide prevention, especially in rural areas;
• ensuring better health care by the Indian Health Service to Tribes and their members;
• providing national leadership to prevent drug abuse and further reduce overdose deaths; and
• ensuring the Environmental Protection Agency provides more timely reviews of potentially toxic chemicals before they are introduced into commercial production and widespread public use.

There is also a need for a more comprehensive approach to food safety to address fragmentation among 15 different federal agencies and at least 30 federal laws. While the United States has one of the safest food supplies in the world, every year millions of people are sickened by foodborne illnesses, tens of thousands are hospitalized, and thousands die. A more proactive, coordinated approach that takes greater advantage of modern technology would be in the best interest of Americans and would lead to a more efficient government.

Other Concerning High-Risk Areas

Actions are needed to strengthen oversight of financial institutions and address regulatory gaps. The March 2023 bank failures and rapid adoption of emerging technologies in the marketplace have highlighted continued challenges in the regulatory system since GAO initially designated this area as high-risk in 2009, during the financial crisis. In particular, the Federal Reserve should improve procedures so that decisions to escalate supervisory concerns happen in a timely manner and Congress should consider designating a federal regulator for certain crypto asset markets, as we recommended.

There is an essential need for Congress to clarify the federal role for Fannie Mae and Freddie Mac, two private sector entities that provide underwriting for the U.S. mortgage market. They are still in federal conservatorship from the 2008 global financial crisis with no clear path forward. The other key federal players, Ginnie Mae and the Federal Housing Administration, have had their portfolios greatly expanded to $2.6 trillion and $1.4 trillion respectively. Consequently, the federal government is greatly exposed to a downturn in the housing market.

Prison buildings are deteriorating and in need of repair and maintenance, while facilities are understaffed, putting both incarcerated people and staff at risk. Moreover, efforts to prevent recidivism have not been thoroughly evaluated, undermining a key goal to help incarcerated people make a successful transition into society once released. The Bureau of Prisons has made some progress, but much more needs to be done.

Congress acted to alleviate certain fiscal pressures and USPS is trying to reduce costs, but it is still losing money ($16 billion in fiscal years 2023 and 2024) and has extensive liabilities and debt ($181 billion in fiscal year 2024). USPS estimates that the fund supporting postal retiree benefits will be depleted in fiscal year 2031. At that point, USPS would be required to pay its share of retiree health care premiums, which USPS projects to be about $6 billion per year. There is a fundamental tension between the level of service Congress expects and what revenue USPS can reasonably be expected to generate. Congress needs to establish what services it wants USPS to provide and negotiate a balanced funding arrangement.

Twenty areas are on GAO's High-Risk List in part due to skills gaps or an inadequate number of staff. Moreover, the personnel security clearance system is not yet being managed in the best manner to ensure that people are adequately screened to handle sensitive information.

Icon sources: GAO, USPS, and Icons-Studio/stock.adobe.com.

GAO's 2025 High-Risk List

Legend: ↑ indicates area progressed on one or more criteria since 2023; ↓ indicates area declined on one or more criteria since 2023 ; ● indicates no change since 2023; n/a = not applicable

Source: GAO. | GAO-25-107743

^aLegislation is likely to be necessary to effectively address this high-risk area.

^bCoordinated efforts across multiple entities are necessary to effectively address this high-risk area.

Why GAO Did This Study

The federal government is one of the world's largest and most complex entities. About $6.8 trillion in outlays in fiscal year 2024 funded a broad array of programs and operations. GAO's High-Risk Series identifies government operations with serious vulnerabilities to fraud, waste, abuse, and mismanagement, or in need of transformation.

This biennial update describes the status of high-risk areas, outlines actions that are needed to assure further progress, and identifies a new high-risk area needing attention by the executive branch and Congress.

GAO uses five criteria to assess progress in addressing high-risk areas: (1) leadership commitment; (2) agency capacity; (3) an action plan; (4) monitoring efforts; and (5) demonstrated progress. Ratings are based on analysis of actions taken up to the end of the 118th Congress.

Efforts to address high-risk issues have contributed to hundreds of billions of dollars saved. Over the past 19 years (fiscal years 2006-2024), these financial benefits totaled nearly $759 billion or an average of $40 billion per year.