GAO's High-Risk List Has Named Some of the Same Programs Since 1990

Suppose you hung a to-do list on your refrigerator in 1990. Suppose that every two years since, a trusted friend had come to your kitchen, checked the list and told you honestly which items were still undone. And suppose that three decades later, some of the same items were still at the top. You would not conclude that the friend needed to visit more often. You would conclude that the way you were trying to do those jobs did not work.

That is the Government Accountability Office's High-Risk List. It is a to-do list for the federal government, published by its own auditor, and some of its entries have been there longer than many of the people now working on them have been alive.

What the list is

The Government Accountability Office, or GAO, is the legislative branch's auditor and investigator. It works for Congress, not the President, and it is headed by the Comptroller General of the United States, who is appointed by the President, with Senate consent, from candidates recommended by a congressional commission and serves a single term of fifteen years. That long, single term is designed to keep the office independent of whoever holds power.

In 1990, GAO began publishing a list of federal programs and operations it considered high risk, meaning especially vulnerable to fraud, waste, abuse or mismanagement. The list is meant to focus the attention of Congress and the agencies on the areas where the dollars and the problems were largest. The list has been published ever since.

Over time, GAO widened the definition. An area can be put on the list not only because of vulnerability to waste and fraud but also because it needs a broad transformation to address economy, efficiency or effectiveness. That broader definition brought in problems of whole-of-government scale, such as how the government manages its information security or its workforce.

How GAO picks and removes areas

I want to describe this carefully, because the process is more disciplined than the headlines suggest.

Adding. GAO considers a range of factors: the size of the program's budget, the seriousness of the risk to the public, whether the problem threatens the agency's mission and whether the area has a record of failed or weak management. GAO's own staff, who audit the government for a living, weigh those factors.

Removing. GAO has set out criteria for getting off the list, and there are five of them. In summary, an area must show a demonstrated leadership commitment at the top, the capacity (people and resources) to address the problem, a corrective action plan, a way of monitoring progress and demonstrated progress in actually fixing the problem. Meeting all five is the standard. Some areas have met it and come off the list, and GAO has said when that has happened. Partial progress is recognized, and an area can be narrowed rather than removed when part of the problem is solved and part is not.

When. GAO updates the list every two years, at the start of each new Congress. The timing is deliberate. A new Congress is organizing its committees and its agenda, and the report is meant to tell it where to look.

You can find the current edition by searching for "GAO High-Risk List" on GAO's website. It gives, for each area, what is wrong, what has been done, what remains and what GAO thinks Congress and the agency should do. Read the entry before you read anyone's summary of it.

The long-running entries

Some areas have been on the list for decades. I will name the ones I am sure about, and I would encourage you to verify each against GAO's latest edition.

Medicare. The Medicare program has been on the list since it was first published in 1990. GAO's concerns have centered on the program's size, its complexity and its vulnerability to improper payments. The program is the largest single payer of health care in the country, and the sums involved are large enough that a small percentage error is a very large number of dollars.

Department of Defense weapon systems acquisition. GAO says it added this area in 1990, and it remains on the list. It concerns how the Pentagon buys the things it needs: ships, planes, missiles. Cost growth and schedule slips recur. Supply chain management, how the Pentagon tracks spare parts and inventory, was also a 1990 entry, though GAO's history table indicates it came off the list in 2019, which shows that areas can come off.

Department of Defense financial management. This area has been on the list since 1995. For years the Department could not produce financial statements that an auditor could verify. GAO's 2025 update says the Department is the only major federal agency that has never received a clean opinion on its financial statements, though the Marine Corps recently received one. The department has said that it is working through the findings and that the audit process itself has driven improvements. That is a fair statement of its position, and it remains true that after thirty years on the list, the department cannot yet tell the taxpayer, to the satisfaction of its own auditors, where all the money went.

Enforcement of tax laws. GAO's 2025 update estimates a $606 billion net tax gap for tax year 2022.

Medicaid. Medicaid was added in 2003, and has remained, for reasons similar to Medicare's: size, complexity, improper payments and uneven oversight of a program that states administer with federal money.

There are many newer entries, including information security, designated in 1997, and the management of federal real property, designated in 2003. The 2025 update lists 38 areas. If you want the whole list, you will find it on GAO's site. What matters for my argument is the pattern: the same names, edition after edition.

The strongest objection

The fairest argument against my reading of the list is worth stating in full.

It goes like this. The high-risk list is a list of the largest, hardest problems in the government, and large hard problems stay hard. A program such as Medicare spends hundreds of billions of dollars on tens of millions of people, and perfection is impossible at that scale. Progress is real even where the program remains on the list: GAO itself says that areas have been narrowed and that several have come off. The fact that an area is on the list for thirty years is partly a sign that GAO's standard is demanding, which is what we want from an auditor. Meanwhile the list has done what it was meant to do: it has focused attention, led to reforms and saved the government a great deal of money. And the answer to a persistent problem is, in many cases, more oversight and more resources for the agency, not abandoning a program that millions of people rely on.

That is a good argument, and I will answer it point by point.

The numbered answer

1. The list is a diagnosis, and a long diagnosis implies a design problem. If a patient is told every two years for thirty years that the same condition persists, the doctor does not say "come back more often." He says the treatment is wrong. When a program has been listed for decades despite hearings, reports, new laws and leaders who promised to fix it, the right inference is that the structure produces the problem.
2. Scale is a reason for caution, not an excuse. I agree that a program of that size cannot be perfect. But scale is a choice. Congress chose to put the largest health care payer in the country under a single federal program with centralized payment rules. Others choose differently, and the cost is that every failure is multiplied. A modest program can be fixed. A vast one resists.
3. "More oversight" has been tried, repeatedly. The list itself is oversight. So are the Inspectors General, the improper payment reports, the congressional hearings and the annual audits. A system that has had thirty years of oversight and still has the same entries needs more than another dose.
4. The incentives are the issue. A program's administrators are rewarded for delivering benefits and punished for denying them, and nobody is rewarded for spending less. In Medicare, payment is made to providers who bill, and the program must pay promptly under statutory deadlines. The government's own auditors flag that this design makes controls hard. When the incentive is to pay, the effort to check is a cost that no one is paid to bear.
5. Therefore the response is reform of structure. That means: put a program's cost where someone feels it, give recipients and payers a stake in accuracy, simplify the rules so that errors are fewer, set an end date after which Congress must vote to continue, and replace the pay-then-chase model with front-end verification. Spending more on audit is not wrong. It is not enough.

I would add a point about respect. Nothing here is a charge against the auditors, the program staff or the beneficiaries. GAO's work is among the most valuable things the federal government produces, and a good part of the list's value is that it gives reformers a respectable source. The people who work at the Defense Department's finance offices are, for the most part, trying to solve a problem that was handed to them. My charge is against the design.

Why chronic presence is itself a finding

There is a deeper reason that I think a conservative should press. When an area has been on the list for decades, that fact is evidence, in the ordinary sense, about the capacity of the existing structure to correct itself. A system that can correct itself will show some areas coming off the list over time, because the feedback works. A system that does not will show the same names.

Compare the way a private firm behaves. A company that finds its auditors repeating the same material weakness for years faces consequences: investors lose confidence, managers are replaced, the board intervenes, the share price falls. The feedback loop is brutal and quick. A federal program that is on the list for thirty years faces no such pressure, because it has no competitor and no shareholders, and the budget is appropriated by a Congress that likes the program. In a market, a persistent failure is punished. In a bureaucracy, it is merely reported.

This is not a partisan point. Both parties have held the White House and Congress through the life of the list. The fact that the same entries appear under both is the point.

Measured against the Founding

The Constitution anticipated that a government would need to be watched, and gave the job first to the legislature. Article I gives Congress the power of the purse and requires a regular statement and account of public money. Federalist 51 put the principle for all time: "In framing a government which is to be administered by men over men, the great difficulty lies in this: you must first enable the government to control the governed; and in the next place oblige it to control itself."

GAO is one of the ways Congress obliges the government to control itself. But a list is a report, and a report does not execute itself. The Constitution gave Congress the tools to act on what the auditor finds: to appropriate, to condition, to end. A Congress that reads the High-Risk List every two years and leaves the same entries in place has chosen not to use them. The fault, in that case, belongs less to the agency than to the legislators who receive the report and decide, in effect, to leave it on the refrigerator.

Madison's Federalist 62 added a related worry that laws should not be so voluminous or so unstable that the people cannot understand them. A program whose rules are so intricate that its own administrators cannot keep it clean is an instance of the thing he feared.

What to do with the list

A citizen has a few practical options.

• Read the entry for a program you care about. It is a few pages and it is written to be read.
• Look for what has changed since the last edition. GAO notes progress and slippage.
• Follow the recommendations. GAO tracks its recommendations and reports how many have been implemented. A recommendation that remains open for years is a question to put to a member of Congress.
• Ask your representative to read it, too. Many of the committees that oversee the agencies have staff who read it closely. A constituent's letter helps put an item on a hearing agenda.

For companion reading, see Washington Admits It Sends Billions to the Wrong People, by Law Every Year for the government's reports on improper payments, How to Read an Inspector General Report and Use It to Hold an Agency to Account for the Inspector General system, and Every Agency Should Have to Justify Its Existence Again, the Texas Sunset Way for a reform that would force each agency to justify itself on a schedule.

The case in brief

1. GAO has published its High-Risk List since 1990, updates it every two years at the start of each new Congress, and removes an area only when it meets five criteria: leadership commitment, capacity, an action plan, monitoring and demonstrated progress.
2. Medicare and Defense Department weapon systems acquisition have been on the list since 1990, Defense financial management since 1995 and Medicaid since 2003.
3. The strongest objection, that big programs are hard and progress is real, is fair, but it cannot explain thirty years of the same entries.
4. Chronic presence on the list is evidence that the structure of the program, including its incentives, is the problem.
5. The remedy is structural reform, with costs placed where someone feels them, rules simplified, verification in front, and an end date that forces Congress to vote.

What you can do: Visit GAO's website, open the High-Risk List, read the entry for Medicare or for one other program you pay for, and send the entry's title to your representative through My Representatives with a request that the committee with jurisdiction hold a hearing on it.