# Presentation: 944288

## Effective Fraud Prevention and Security Controls 

**DOD Internal Control Managers’ Conference **
**December 17, 2008**
**Gregory D. Kutz, Managing Director, FSI**

## Discussion Agenda	

- FSI’s Mission: Who Are We and What Do We Do?
- Effective Fraud Prevention Controls
- Effective Security Controls
- Video:  Examples of FSI’s Work
- Case Study Discussion
- Questions

## FSI’s Mission Who We Are

- FSI is on GAO’s first line of defense against fraud, waste, and abuse in the federal government.
- Formed in May 2005, our mission is to
- provide Congress with high quality forensic audits and investigations of fraud, waste, and abuse; evaluations of security vulnerabilities; and other requested investigative services; and
- monitor and manage fraud, waste, and abuse tips received through the FraudNet hotline.

## FSI’s Mission Who We Are

- FSI addresses
- fiscal challenges facing our nation,
- organizational and individual ethics,
- stewardship over government resources,
- the overall control environment and “tone at the top” at federal agencies, and
- issues related to homeland and national security.

## FSI’s Mission What We Do

- To accomplish our goals, FSI
- systematically tests the design and effectiveness of federal systems, processes, or controls;
- uses innovative and proactive methodologies;
- develops practical solutions (recommendations or matters for consideration by Congress) for problems that we identify; and
- as appropriate, refers criminal matters or other cases identified to the Department of Justice, federal agency Inspectors General, or other relevant officials (e.g., state governments)

## FSI’s MissionWhat We Do

- FSI has three lines of business:
- forensic audits,
- security and vulnerability assessments, and
- special investigations.
- FSI also relies on FraudNet resources to detect and investigate allegations of fraud, waste, and abuse.
- FSI staffing complement includes auditors and analysts with forensic audit experience, criminal investigators (federal agents), a procurement fraud specialist, and others.

## Effective Fraud Prevention Controls

- Internal controls are intended to provide reasonable assurance, not absolute assurance.
- Tone at the top and supportive culture are critical to success.
- Effective internal control systems include elements of
- human capital,
- policies and processes, and
- automated and integrated systems.
- Management efforts should be focused on prevention
- controls in place **before** money is disbursed.
- Data mining is an effective tool for both auditors and management.

## Fraud Prevention Program Model

## Effective Security Controls

- Standards for security are different than the “reasonable assurance” for fraud prevention.
- Effective security controls combine elements of:
- People who are properly trained
- Technology that is capable of countering the threat, and
- Processes that make best use of people and technology.
- Red team or covert tests are an effective tool for both investigators and management.
- Tone at the top is critical to success.

## Video:  Examples of FSI’s Work

- Video highlights of press and congressional hearing coverage of FSI work

## FSI Case Studies

**Fraud, Waste, and Abuse**
- Katrina/Rita individual assistance
- >$1 billion in fraud or improper payments
- Over 22,000 referrals to Fraud Task Force
- Government contractors with tax debt
- Improper premium class travel
- Government purchase cards
- Transit benefit fraud
- Waste at Indian Health Services
- HUBZone program fraud

## FSI Case Studies

**National and Homeland Security**
- Airport security
- Border security
- Nuclear licenses
- Sales of sensitive military property
**Other**
- Residential treatment programs
- Genetic test kits sold to consumers
- Drug testing

## Key FSI Work FEMA Disaster Assistance Payments

- Source: GAO.

- FSI used FEMA data to compare prison information with address information supplied by disaster victims
- FSI identified prisoners who fraudulently received disaster assistance payments from FEMA

## Key FSI Work FEMA Disaster Assistance Payments

- Source: GAO.

- Posing as victims of Hurricane Katrina, FSI obtained disaster assistance payments from FEMA
- In one case, this vacant lot was given to FEMA as the address of our bogus victim

## Key FSI Work  Waste Related to Purchase Cards

- Sources: CBP, FBI.

- FSI identified wasteful purchases made using DHS purchase cards, including this warehouse full of unused meals-ready-to-eat (MREs)

## Key FSI Work Expensive Items Owned by Tax Cheats

- Source: GAO.

- FSI matched IRS unpaid tax information with data on federal contractors, nonprofits, health care providers, etc.
- FSI found thousands of individuals and companies benefit from federal funding or have special status but do not pay their taxes

## Key FSI Work DOD Sales of Sensitive Military Property

- Source: GAO.

- FSI found that DOD was selling or giving away sensitive parts, such as F-14 components, through its excess property system
- In response to this work, Congress passed legislation prohibiting DOD from selling F-14 parts to the public

## Key FSI Work Waste at the Indian Health Services

- Source: GAO.

- In response to a FraudNet hotline tip, FSI investigated property management controls at the Indian Health Services
- FSI found a broken control environment, including wasteful purchases such as the unused widescreen monitor in the photo

## Key FSI Work Border Security and Other Covert Tests

- Source: GAO.

- FSI maintains an in-house counterfeiting operation to create fake IDs for use in undercover tests
- Agents used this bogus license to enter the United States at northern and southern border crossings, showing that border controls are inadequate

## Key FSI Work Nuclear Sting Operation

- Source: GAO.

- After creating a bogus company, FSI agents successfully obtained a license to purchase devices containing nuclear materials
- FSI then used commercial graphics software to alter the license and obtain commitments to ship numerous devices

## Key FSI Work Drug Testing (Undercover Photo)

- Source: GAO.

- Undercover agents tested controls at independent drug testing facilities across the country to see whether DOT protocols were being followed
- FSI found numerous problems, including the availability of chemicals that were improperly stored near testing areas

## Summary of Key Points

- Management should focus its efforts on fraud prevention controls, and these controls should periodically be reassessed.
- Effective fraud prevention and security controls include elements of people, processes, and technology.
- Forensic audits are an effective tool to proactively identify fraud, waste, and abuse.
- Red team exercises are an effective management tool.
- Tone at the top is critical to success.
- There are significant benefits to establishing and maintaining an integrated team of auditors and investigators.

## Question and Answer Period

- Questions?