The Government Accountability Office's High-Risk List stood at 38 areas as of its February 25, 2025 update (report GAO-25-107743), with one addition: federal disaster assistance, elevated after GAO's years of pandemic-relief and emergency-management findings. The list — updated every two years at the start of a new Congress, with testimony before the House Oversight Committee accompanying each release — is the government's own inventory of programs vulnerable to waste, fraud, abuse, and mismanagement, and GAO credits it with hundreds of billions in financial benefits since 1990: 54 areas have ever been listed, 29 removed after meeting the criteria.
What gets an area listed, and delisted
GAO applies five criteria: leadership commitment, agency capacity, an action plan, monitoring, and demonstrated progress. Listing follows failed performance against them — not scandal, but persistent inability to show movement. Removal requires meeting all five, which is why entries persist for decades: the 2025 list still carries long-tenured residents including the Department of Defense's business systems modernization, interagency contracting, and the Indian Health Service, which GAO noted has met one removal criterion. The list's mid-cycle reality is that between updates, movement shows up in GAO's program-specific reports — each high-risk area generates a stream of recommendations tracked publicly, and the recommendation-implementation rate is the live indicator.
Why disaster assistance made the list
The 2025 addition formalized a decade of findings. GAO's pandemic-relief work documented tens of billions in improper payments across emergency programs, and its disaster-response reviews — from hurricane recovery to wildfire programs — repeatedly found the same pattern: emergency speed displaces controls, and the controls are never fully rebuilt. The Federal Emergency Management Agency's grant programs, the disaster loan programs, and the interagency recovery architecture all drew recommendations in GAO's prior reports; the high-risk designation consolidates that pressure into one accountable entry with criteria GAO can score in 2027.
How to use the list
Three practical uses. As an oversight index: each entry's GAO report page carries its recommendation inventory — open, closed, implemented — which congressional staff and journalists use to check agency claims of progress. As a budget lens: high-risk areas correlate with the programs where GAO's annual reports identify tens of billions in unaddressed savings, the basis of the agency's save-billions testimony. And as a procurement signal: several entries concern acquisition and IT, so vendors and contract officers operate inside listed areas with heightened audit probability — a fact of life in defense business-systems work for over a decade.
What the 2027 update will test
The next update, at the start of the new Congress in early 2027, will test whether the executive-branch reorganizations of 2025-26 — consolidation, workforce reductions, and the realignment of digital-service functions — moved any criteria on any entry. GAO's framework is indifferent to org charts: leadership commitment means named owners, capacity means staff and systems present, progress means measured results. The list will answer in 2027 whether the machinery changed or only the letterhead.
FAQ
What is the GAO High-Risk List?
A biennial inventory of federal programs and operations vulnerable to waste, fraud, abuse, and mismanagement — 38 areas as of the February 2025 update, with 54 ever listed and 29 removed since 1990.
What was added in 2025?
Federal disaster assistance, following GAO findings on pandemic-relief improper payments and recurring disaster-recovery management problems.
How does an area get off the list?
By meeting all five GAO criteria — leadership commitment, capacity, action plan, monitoring, and demonstrated progress — verified in the biennial update.
For more context, read Continuing Resolutions: How Stopgap Funding Actually Works.
For more context, read Bid Protests: How the 100-Day Clock Actually Works.
For more context, read Federal Permitting: The Backlog Now Has an Owner and a Clock.