In a report published July 23, 2026, GAO said the programs represented nearly 90% of federal obligations among qualifying state-administered programs. The review included major public programs such as Medicaid, the Supplemental Nutrition Assistance Program, commonly known as SNAP, and disaster assistance.

The report does not say that $1.2 trillion was lost or improperly spent. It also does not provide one nationwide estimate of confirmed fraud across the 20 programs. Instead, GAO examined where fraud risks may arise, how programs are controlled and what oversight practices could help federal agencies and Congress better protect public funds.

What GAO reviewed

GAO used data from USAspending.gov to select the programs for review. The selected programs were federally funded but administered by states or other government entities, placing significant responsibility for distribution and oversight outside Washington.

The review drew on federal laws and regulations, federal agency documents, inspector-general reports, state audit reports and fraud cases adjudicated through the Justice Department. GAO used those materials to assess fraud risks, identify recurring risk factors and examine leading practices for internal controls.

That approach gives the report a cross-program view rather than focusing on a single agency or state. It also places programs with very different purposes in the same oversight framework: health coverage through Medicaid, food assistance through SNAP and aid connected to disasters.

Why the findings matter

Federal dollars often reach residents through programs that are operated, in whole or in part, by states and other government entities. The report therefore highlights a practical accountability question: how federal agencies can make sure money is protected after it moves beyond direct federal administration.

For the public, the programs reviewed touch health care, food assistance and disaster response. GAO’s findings do not announce a change to eligibility, benefits or access in any of those programs. Rather, they describe risks and controls that can affect how agencies and administrators verify payments, detect suspicious activity and respond to potential misuse.

The scale of the programs is central to the report. The estimated $1.2 trillion was the amount directed to the selected programs in fiscal year 2025, not an estimate of fraud. Because those programs accounted for nearly 90% of relevant federal obligations, GAO’s assessment provides Congress and federal agencies with a broad picture of oversight practices across a large share of state-administered federal spending.

What happens next

GAO’s report identifies roles for Congress and federal agencies in improving oversight. It also sets out fraud-risk factors and leading practices that can be used when assessing controls across the programs.

The report itself does not establish a single implementation deadline in the material released with the source packet, and it does not announce a new enforcement action against a particular state or program. The next known step is therefore institutional: Congress and the responsible federal agencies can use the assessment, along with federal and state audit work, to evaluate whether existing safeguards address the risks GAO describes.

The Council of the Inspectors General on Integrity and Efficiency’s federal reports directory also provides access to contemporaneous inspector-general audits and evaluations. Those records offer additional oversight context, but GAO’s July 23 report is the source of the cross-program findings and the $1.2 trillion estimate.

GAO’s analysis is based on work completed from November 2024 through June 2026, and it concludes that neither program has a comprehensive fraud-risk assessment that GAO says is needed for stronger, ongoing program integrity.

What GAO says was measured: large FY 2025 improper-payment estimates

GAO reports that for fiscal year 2025:

• VA Community Care: $608 million in estimated improper payments (2.4% of program outlays).
• Medicare Advantage: $23.7 billion in estimated improper payments (6.1% of program outlays).

GAO and CMS also emphasize an important distinction: improper-payment measurement identifies payments that do not meet program requirements, and it is not the same thing as proving fraud in every case.

Key finding #1: VA Community Care’s fraud-risk work still isn’t comprehensive

GAO says VA has taken steps to identify and assess fraud risks. But GAO concludes those efforts do not include key elements needed for a comprehensive fraud-risk assessment “for the program,” leaving the Community Care program vulnerable to fraud.

Key finding #2: CMS Medicare Advantage controls haven’t caught up—especially for RADV

GAO reports that CMS developed and implemented processes to identify and assess root causes of improper payments in Medicare Advantage, but it says several integrity components have not worked effectively:

• Improper-payment rate: GAO says CMS’s estimated improper payment rate has not decreased and has remained steady.
• Corrective action plans: GAO says they are not sufficiently detailed and do not adequately monitor progress.
• RADV audits: GAO says CMS does not have a detailed plan for expediting Risk Adjustment Data Validation (RADV) audits, which GAO describes as CMS’s primary corrective action for identifying and recovering improper payments. GAO also points to a RADV backlog contributing to significant recovery delays.
• Fraud-risk assessment: GAO says CMS has not conducted a comprehensive fraud-risk assessment for the Medicare Advantage program.

What GAO recommends next (and what “Open” means here)

GAO’s recommendations target the specific gaps it identified rather than declaring either program “fixed.”

• VA recommendation (Recommendation 1): GAO recommends a comprehensive fraud risk assessment for the Community Care program aligned with GAO’s Fraud Risk Framework. GAO says VA concurred. GAO lists this recommendation as Open.
• CMS recommendations (Recommendations 2 and 3): GAO recommends (1) a detailed, documented plan for expediting RADV audits—including cost estimates, planned completion dates, and metrics—and (2) a comprehensive fraud risk assessment for Medicare Advantage aligned with the Fraud Risk Framework. GAO says CMS neither agreed nor disagreed, and GAO lists these recommendations as Open.

Bottom line for beneficiaries and taxpayers

GAO’s report is not an allegation that every improper payment is fraud. Instead, GAO’s core message is governance-focused: without comprehensive fraud-risk assessments and fully monitored corrective actions, agencies may miss or under-prioritize the fraud risks most likely to drive improper payments.

For beneficiaries, the practical concern is payment accuracy and program integrity. For taxpayers, the issue is whether federal oversight can convert known weaknesses into measurable improvements—especially around RADV audit acceleration for Medicare Advantage.

Sources

• GAO report (GAO-26-107946): published July 21, 2026
• CMS Fact Sheet: FY 2025 Improper Payments (Medicare Part C / Medicare Advantage)