America’s High-Risk Government Programs: Where Fraud, Waste and Mismanagement Can Occur

RED TARGET TIPIKOR / U. S. Investigations & Government Accountability

By: [Editorial Staff]

Every two years, the Government Accountability Office (GAO) publishes one of the most closely watched documents in federal oversight:the High-Risk List. It names programs and operations that GAO considers “seriously vulnerable to fraud, waste, abuse, and mismanagement, or in need of transformation.” As of February 2025, 38 areas appear on the list — from Medicare and Medicaid improper payments to Department of Defense weapons programs, from cybersecurity to federal disaster assistance. The list does not accuse every program on it of wrongdoing. It identifies elevated risk — and that distinction is the key to reading it correctly. Here is what the list covers, how it works, what has improved, what risks remain, and how citizens can track it themselves.

Key Takeaways

GAO’s High-Risk List, updated atthe start of each new Congress, identified 38 areas of federal operations as”seriously vulnerable to fraud, waste, abuse, and mismanagement, or in need of transformation” as of February 2025(GAO-25-107743,Feb.25,2025).>

A listing is a risk designation, not a finding of wrongdoing. Being named high risk means a program needs heightened oversight;evidence of actual fraud, waste, or mismanagement comes from investigations, audits, and court records, not from the list itself.>

Since fiscal year 2003,agencies have reported about $2.8 trillion in cumulative estimated improper payments, including more than $150 billion in each of the last seven years(GAO-25-107743).For fiscal year2024,about $161.5 billion was reported(GAO-25-107552),down from just under $236 billion the prior year, per PaymentAccuracy. gov.>

Between the 2023 and 2025 updates,10 areas improved, and 3 regressed;GAO added one new area—improving the delivery of federal disaster assistance—and efforts across the list produced about $84 billion in financial benefits;lifetime benefits total nearly $759 billion(GAO. gov).>

The monitoring tools are public:GAO’s list, and reports, PaymentAccuracy. gov, agency inspectors general, congressional hearings, and USAspending. gov spending data.>

What Makes a Government Program High Risk?

A program earns a place on the High-Risk List when it exhibits serious vulnerabilities to fraud, waste, abuse, or mismanagement—or when it is in need of fundamental transformation. Common drivers include:weak internal controls—inadequate checks on how money is obligated, spent, and accounted for;outdated information technology that cannot reliably track payments, or performance;fragmented responsibilities across multiple agencies;insufficient staffing, or skills gaps;and persistent, documented weaknesses that resisted earlier fixes. GAO notes that 20 of the 38 areas on the 2025 list are there, in part, because of skills gaps or an inadequate number of staff—a workforce problem that cuts across dozens of programs

The stakes are high, and that is part of the definition. As described in a February 2025 House Oversight, and Government Reform Committee hearing on the list, listed areas generally present either a financial risk of losing at least $1 billion in taxpayer dollars, or a risk to public health or safety, essential services, national security, privacy, economic growth, or citizens’ rights. Equally important is what the designation does not mean. GAO does not claim that every program on the list has committed fraud. A listing is a forward-looking warning—a risk flag, not a guilty verdict. Complacency, and false alarm, both distort what the list actually says.

How the U. S. Government Identifies High-Risk Areas

The High-Risk program dates to 1990,when GAO began reporting on government operations especially vulnerable to waste, fraud, abuse, and mismanagement. Since then, GAO has generally updated the list atthe start of each new Congress—roughly every two years. The 2023 edition listed 37 areas;the 2025 edition lists 38. In the February 2025 update, GAO reported progress in ten areas, regression in three(DOD Weapon Systems Acquisition, Improving IT Acquisitions, and Management, and Managing Federal Real Property),and no removals, while most other areas maintained their status, or were rated for the first time.

Identification is cumulative, and evidence-based. GAO analysts examine years of audits, agency financial statements, improper-payment data, contracting records, and prior recommendations, looking for structural weaknesses—repeated audit findings, cost overruns, fragmented authority, weak controls—rather than isolated mistakes. An area can be designated for the first time long after problems are documented, as happened in2025 with the unemployment insurance system, the federal prison system, and HHS leadership of public health emergencies. Newly added that cycle was improving the delivery of federal disaster assistance, after rising disaster costs, and strain on the Federal Emergency Management Agency(FEMA) highlighted the need for timely, well-coordinated assistance to survivors.

Once designated, GAO rates whether each area progressed, regressed, or maintained its status. Where legislation, or coordinated multi-agency action will be needed, GAO flags that explicitly—footnotes across much of the current list. Removal is possible, but demanding. In its March 2022 guide,”High-Risk Series: Key Practices to Successfully Address High-Risk Areas, and Remove Them from the List”(GAO-22-105184),GAO describes the five criteria:leadership commitment, capacity, an action plan, monitoring, and demonstrated progress. Only when an area satisfies all five does GAO consider removing it—making the process transparent, and credible.

The Role of the Government Accountability Office

The GAO is the investigative arm of Congress—a legislative branch agency whose auditors, analysts, lawyers, and investigators examine how the federal government spends taxpayer money, and whether its programs achieve their purposes. It is nonpartisan by design, and its products—reports, testimonies, legal opinions, andthe High-Risk List—exist to inform congressional oversight. It does not prosecute fraud, run programs, or collect taxes. Its power is the power of evidence, and attention—reports that cannot be ignored, recommendations that are tracked, and sustained focus until problems get fixed

The results have been substantial. GAO reports that high-risk-related efforts have totaled nearly$759 billion in financial benefits—about$40 billion per year—by helping agencies fix problems rather than merely flagging them. Between the 2023 and 2025 updates, progress produced approximately$84 billion. GAO’s annual duplication reports reinforce this:its 2025 Annual Report pointed to opportunities for an additional$100 billion or more in future financial benefits(GAO-25-107604,May 13,2025). And its recommendation tracking shows how hard change is:of the 1,881 recommendations GAO made since2010 in IT acquisitions, and management,463 remained open as of January 2025. Congress matters because it holds hearings, demands corrective action plans, writes fixes into law, and conditions appropriations. That is how a list of 38″high-risk”areas becomes machinery for producing change—slowly, but measurably.

Fraud Risk

Fraud is intentional deception or misrepresentation for gain, whether by insiders, contractors, recipients, or outsiders who exploit weak controls. It must be distinguished from error, waste, and mismanagement, because each needs a different remedy. Fraud requires proving intent. GAO’s High-Risk List does not allege fraud by listing a program. It identifies programs whose characteristics—high payment volumes, complex eligibility rules, insufficient verification, weak monitoring—make them vulnerable to fraud, and to other problems. Listing means elevated risk;,it does not mean wrongdoing has been established.

Many areas on the 2025 list carry elevated fraud risk in exactly that sense. GAO notes that the high-risk areas include programs representing about80 percent of the total government-wide reported improper-payment estimate, including Medicare, Medicaid, the unemployment insurance system, andthe Earned Income Tax Credit. The unemployment insurance system, rated for the first timein2025,illustrates why:large flows of money, complex eligibility rules, and claims historically paid before all verification was complete—structurally, the conditions under which fraudulent claims slip through when controls falter. Emergency loan programs for small businesses—added after the COVID-19 pandemic, and marked improved in2025—drew scrutiny because rushed, high-volume relief programs proved attractive targets for fraudulent applications. The new federal disaster assistance area likewise raised concern about survivor-assistance processes—processes that, when they fail, can leave disaster relief vulnerable to improper claims, and to delays that hurt legitimate victims.

It is equally important to say what is not established. Pending investigations, indictments, court records, and settled cases—not a program’s presence on a watch list—are what prove fraud in specific instances. For that level of detail, Americans should look to agency inspectors general, andthe Department of Justice. GAO’s designation says the risk warrants controls;,it does not, by itself, establish that fraud occurred.

Waste and Inefficiency

Waste means spending that produces little or no value—money spent unnecessarily, duplicatively, or on resultsthat never materialize. It usually involves no deception;,its often the product of poor planning, outdated systems, or misaligned incentives. Much of the High-Risk List documents waste rather than wrongdoing. DOD Weapon Systems Acquisition—one of the three areas that regressed in2025—exemplifies this. Weapons programs are massive, and decades-long, and GAO has long documented cost overruns, schedule slips, and performance shortfalls across defense acquisition. Companion areas—DOD Contract Management, and DOD Business Systems Modernization—remain listed, reflecting difficulty in buying major systems affordably, and on time. When weapons programs cost more, and arrive later than planned, the gap is waste—not theft, but resources consumed without the intended capability.

Information technology is another chronic source of inefficiency. Improving IT Acquisitions, and Management—also flagged as regressed—tracks federal IT projects that have repeatedly failed to deliver on time, and budget. Managing Federal Real Property—the third area to regress—concerns vast, underutilized federal real estate that agencies continue to pay to maintain, and repair. These areas need better planning, modern systems, and sustained leadership. Waste is also structural:GAO’s annual fragmentation, overlap, and duplication reports identify programs that duplicate one another’s work. Duplicative programs can cost tens of billions when left unaddressed. This kind of waste rarely makes headlines because there is no villain;,but it is the loss most likely to show up in taxes paid, and services degraded.

Mismanagement

Mismanagement is the failure of stewardship:weak administration, unreliable financial information, poor planning, and oversight gaps. It is broader than waste, and often underlies it. A program can be mismanaged without anyone stealing a dollar—andthe damage can still be enormous. DOD Financial Management, on the list since the1990s, exemplifies this:the department has long been unable to produce financial statements that pass audit, a weakness that obscures where hundreds of billions of dollars go. Strengthening Management of the Federal Prison System, rated for the first timein2025,reflects concerns about staffing, safety, and oversight of a system under intense operational pressure. HHS Leadership, and Coordination of Public Health Emergencies—also rated for the first time—centers on whether HHS can coordinate a coherent public health response, a question sharpened bythe COVID-19 pandemic. USPS Financial Viability reflects the Postal Service’s long-running structural losses, andthe risk that it cannot sustain operations. Managing Risks, and Improving VA Health Care addresses whether veterans receive timely, safe, quality care.

Human capital—the people side of management—cuts across the entire list. Twenty of the 38 high-risk areas are listed, in part, because of skills gaps or insufficient staffing. When agencies cannot hire, train, and retain people with the right skills—cybersecurity, acquisition, financial management, medical care—therisk of mismanagement rises across every program they run. The list thus functions partly as a workforce warning:many of the government’s hardest problems are, at bottom, leadership, and capacity problems.

Improper Payments

Improper payments are the largest quantified category of financial leakage, thefederal government, and GAO has tracked them for two decades. An improper payment, under the Payment Integrity Information Act of2019(PIIA),is one that should not have been made, or that was made in an incorrect amount, under statutory, contractual, administrative, or other legally applicable requirements(31 U. S. C. Section 3351(4)). Practically, this includes duplicate payments, payments to ineligible recipients, payments for ineligible goods or services, payments for goods or services never received, and underpayments as well as overpayments. Not all improper payments involve fraud—many are honest errors driven by incomplete data, outdated records, or complex rules—but every improper dollar is money that could have funded services, or reduced the deficit. That is why GAO treats controlling them as central to program integrity

The scale is staggering. Since fiscal year 2003,agencies have reported about$2.8 trillion in cumulative estimated improper payments, including more than$150 billion in each of the last seven years. For fiscal year2024,about$161.5 billion was reported(GAO-25-107552),down from just under$236 billion the prior year—a government-wide rate of about3.97 percent, the lowest since2014,androughly half the FY2021 rate, when improper payments surged amid emergency COVID-19 relief spending—per data on PaymentAccuracy. gov. GAO cautions, however, that these figures are estimates, and do not represent a full accounting, because some agencies have not reported estimates for every program as required. The true total is likely higher

Where does the money concentrate? GAO notes that the high-risk areas include programs representing about80 percent of the total reported improper-payment estimate—led by Medicare, Medicaid, the Earned Income Tax Credit, andthe unemployment insurance system. Both”Medicare Program, and Improper Payments”and”Strengthening Medicaid Program Integrity”appear on the 2025 list. Under PIIA, agencies must identify risk-susceptible programs, estimate improper payments, take corrective action, andreport publicly—with OMB guidance through Circular A-123,Appendix C. Root causes, federal data show, frequently trace to data problems:inability to verify eligibility, outdated records, difficulty sharing information across programs, and payments made before verification could occur. Improper payments are not synonymous with fraud—most are errors—buttheir dollar concentration is why they dominate any honest accounting of federal program risk. The remedies—better data, better verification, and, where fraud is found, enforcement—are spread across agencies, OMB, inspectors general, andCongress

Programs Requiring Stronger Oversight

The current list—38 areas as of February 2025—spans defense, health care, homeland security, financial management, IT, disaster response, and more. A representative slice shows the range—keeping in mind that a listing indicates vulnerability, andthe need for attention:,not proven misconduct:

Improving the Delivery of Federal Disaster Assistance—newly added in2025,after rising disaster costs, and strain on FEMA, highlighted the need for timely assistance to survivors, and reduced fragmentation across federal disaster efforts
Unemployment Insurance System,Strengthening Management of the Federal Prison System,and HHS Leadership, and Coordination of Public Health Emergencies—all rated for the first timein2025,covering eligibility verification, prison staffing, and safety, and public health coordination
Medicare Program, and Improper Payments,Strengthening Medicaid Program Integrity,and Enforcement of Tax Laws—improper-payment, and collection exposures of major benefit, and revenue programs
Defense, and contracting—DOD Weapon Systems Acquisition, DOD Contract Management, DOD Financial Management, DOD Business Systems Modernization, and DOD’s Approach to Business Transformation
Technology, and property—Improving IT Acquisitions, and Management, Managing Federal Real Property, and Strengthening Department of Homeland Security IT, and Financial Management Functions
Service, and enterprise areas—Managing Risks, and Improving VA Health Care, VA Acquisition Management, USPS Financial Viability, National Flood Insurance Program, Resolving the Federal Role in Housing Finance, Improving Federal Oversight of Food Safety, and Strategic Human Capital Management, among others
Security areas—Ensuring the Cybersecurity of the Nation, Protecting Technologies Critical to U. S. National Security, andthe Government-wide Personnel Security Clearance Process

The authoritative, complete enumeration—with designation years, and current ratings—is on GAO’s High-Risk List web page, backed bythe 2025 report(GAO-25-107743). Any claim about a listed program should carry that publication year:”appears on GAO’s High-Risk List(as of February 2025)”—not as a finding of misconduct, which would require far more specific evidence

What Has Improved?

The high-risk process produces real, documented progress, and GAO tracks it explicitly. Between the 2023 and 2025 updates, ten areas improved, including DOD Contract Management, DOD Business Systems Modernization, DOD’s Approach to Business Transformation, Emergency Loans for Small Businesses, the Government-wide Personnel Security Clearance Process, national efforts against drug misuse, the National Flood Insurance Program, housing finance, the U. S. government’s environmental liability, and USPS Financial Viability. Those improvements—with other actions—produced about$84 billion in financial benefits over the two years, per GAO. Lifetime benefits from high-risk efforts total nearly$759 billion—about$40 billion per year

Removal is the strongest evidence of success—and removals do happen, though slowly:

DOD Supply Chain Management—added1990,removed2019,after DOD improved inventory management, asset visibility, and materiel distribution;progress contributed nearly$3.7 billion in savings(GAO-22-105184;GAO-23-106203).
Mitigating Gaps in Weather Satellite Data—removed2019(GAO-23-106203)..
DOD Support Infrastructure Management—removed2021,afterthe department reduced excess infrastructure, and improved property management(GAO-23-106203)..
2020 Decennial Census—removed2023,following successful completion of the count(GAO-23-106203)..
Pension Benefit Guaranty Corporation Insurance Programs—removed2023,after satisfying the removal criteria(GAO-23-106203)..

The pattern, GAO’s”Key Practices”research found, is consistent:areas get fixed when congressional action, top leadership commitment, andactive monitoring combine. The playbook is public—GAO published it so agencies, andthe public, could follow it

What Risks Remain?

For all the progress, the list is long, andthe risks are durable. As of February 2025,38 areas remained, and none was removed between the 2023,and2025 updates. Three regressed:DOD Weapon Systems Acquisition, Improving IT Acquisitions, and Management, and Managing Federal Real Property. Most others—25,per GAO—maintained their status. GAO emphasizes that agencies must still address thousands of open recommendations, and some fixes require legislation. Continued congressional oversight, GAO says, is essential to save costs, and improve program management

Several structural risks look likely to persist. Improper payments:even afterthe2024 improvement, agencies still reported over$160 billion in a single year, andthe cumulative total approaches$2.8 trillion—andthe reporting gap means the true total is higher. Human capital:20 of38 areas are listed, in part, because of skills gaps, or insufficient staffing. Information technology:aging, fragmented systems continue to drive cost overruns, and delays. Disaster programs:the new disaster assistance area reflects a risk—costlier, more frequent disasters—that is likely to grow. Financial management:reporting weaknesses obscure where money goes, and impede accountability

Beyond those patterns, specifics of what happens next—which areas improve, regress, or come off the list—are not independently verified as of this writing;thenext scheduled update arrives atthe start of the next Congress. What is verifiable today is the list itself, GAO’s published assessments, and its recommendation status. The risk that remains is less about discovering what is wrong, and more about sustaining the attention needed to fix it

How Americans Can Monitor High-Risk Programs

The machinery of federal oversight is public, andordinary citizens can watch it operate. Here are the most direct routes:

Read the list. GAO’s High-Risk List page(gao. gov/high-risk-list)shows every current area, links to the full2025 report, and when each area was designated. Check whether an area”progressed,””regressed,”or”maintained”status, and whether legislation, or coordination, will be needed
Read the underlying reports. Each update comes with a full High-Risk Series report, and GAO publishes individual assessments, and recommendation status. Searching gao. gov for a topic like Medicare improper payments shows what remains open
Track improper payments. PaymentAccuracy. gov publishes annual agency-reported estimates, including program-level totals, rates, and root causes
Read agency inspectors general. Each major agency’s OIG publishes audits, investigation summaries, and fraud alerts. OIGs—not the list—are where concrete findings of fraud, waste, and abuse, in specific cases, are documented
Watch Congress. House, and Senate oversight committees hold public hearings on the list, and on individual areas. Hearings are webcast, and archived
Follow the money. USAspending. gov publishes contract, grant, loan, and other award data. Paired with GAO’s analyses, it turns the list into queryable records
Learn the broader context. Understanding how federal spending works—where tax dollars go, how contracts areawarded, and what red flags look like—makes the list more useful. See our guide towhere U. S. taxpayer money goes,our explainer onfraud, waste, and abuse in the U. S. government,and our breakdown ofhow U. S. government contracts work—spending, oversight, and red flags.
Ask your representatives. A specific question—”What is being done about open GAO recommendations on Medicare improper payments?”—is the kind of inquiry congressional oversight was built to answer. No credential is required;the harder task is sustaining attention

Frequently Asked Questions

Q:What exactly is the GAO High-Risk List?

A: A list, updated roughly every two years atthe start of each new Congress, of federal programs, and operations that GAO identifies as”seriously vulnerable to fraud, waste, abuse, and mismanagement, or in need of transformation.” As of February 2025,it includes 38 areas(GAO-25-107743).It has been published since1990

Q:Does appearing on the list mean a program committed fraud?

A: No. The designation flags serious risk, andthe need for corrective action;,it does not assert that fraud, waste, or mismanagement has occurred. Proof comes from investigations, audits, indictments, and court records—not from the listing itself

Q:How often is the list updated, and what changed in the latest edition?

A: GAO updates it atthe start of each new Congress, typically every two years. In February 2025,GAO added one new area(improving the delivery of federal disaster assistance),rated several areas for the first time, reported progress in ten, and regression in three, and about$84 billion in financial benefits sincethe2023 update

Q:Which programs account for the most improper payments?

A: Medicare, Medicaid, the Earned Income Tax Credit, andthe unemployment insurance system have long led reported totals. GAO notes thatthe high-risk areas include programs representing about80 percent of the total government-wide reported estimate. For fiscal year2024,agencies reported about$161.5 billion government-wide(GAO-25-107552).

Q:Have programs ever been removed from the list?

A: Yes, but only after satisfying five criteria:leadership commitment, capacity, an action plan, monitoring, and demonstrated progress. Examples include DOD Supply Chain Management(2019),Mitigating Gapsin Weather Satellite Data(2019),DOD Support Infrastructure Management(2021),the2020 Decennial Census, and PBGC Insurance Programs(both2023),per GAO(GAO-23-106203).

Q:Where can I see the current list, and track future updates?

A: GAO publishes the full list, report, and designation history at gao. gov/high-risk-list. Annual improper-payment data is at PaymentAccuracy. gov. Future updates arrive with each new Congress’s high-risk report

Sources

U. S. Government Accountability Office,”High Risk List”(current list;38 areas as of February 2025):https://www. gao. gov/high-risk-list
U. S. Government Accountability Office, High-Risk Series: Heightened Attention Could Save Billions More, and Improve Government Efficiency, and Effectiveness, GAO-25-107743(Feb.25,2025):https://www. gao. gov/products/gao-25-107743
U. S. Government Accountability Office, Improper Payments: Agency Reporting of Payment Integrity Information, GAO-25-107552(Jan.23,2025):https://www. gao. gov/products/gao-25-107552
U. S. Government Accountability Office, High-Risk Series: Key Practices to Successfully Address High-Risk Areas, and Remove Them from the List, GAO-22-105184(Mar.3,2022):https://www. gao. gov/products/gao-22-105184
U. S. Government Accountability Office, High-Risk Series(2023 update, GAO-23-106203(Apr.20,2023):https://www. gao. gov/products/gao-23-106203
U. S. Government Accountability Office, press release,”GAO Urges Attention to 2025 ‘High Risk List’ to Save Billions, and Improve Government Efficiency, and Effectiveness,”(Feb.25,2025):https://www. gao. gov/press-release/gao-urges-attention-2025-high-risk-list-save-billions-improve-government-efficiency-effectiveness
U. S. Government Accountability Office,2025 Annual Report: Opportunities to Reduce Fragmentation, Overlap, and Duplication, and Achieve an Additional One Hundred Billion Dollars or More in Future Financial Benefits, GAO-25-107604(May 13,2025):https://www. gao. gov/products/gao-25-107604
U. S. Department of the Treasury / Office of Management, and Budget / Department of Justice, PaymentAccuracy. gov—annual improper-payment estimates:https://www. paymentaccuracy. gov/
U. S. House Committee on Oversight, and Government Reform, hearing on the Government Accountability Office’s 2025 High Risk List(Feb.25,2025):https://www. congress. gov/119/chrg/CHRG-119hhrg58998/CHRG-119hhrg58998.pdf

Recommended internal links on RED TARGET TIPIKOR: