GAO finds fraud-risk assessment missing for five of the 20 largest state-administered federal programs