Fraud, Waste, and Abuse Prevention Controls

Prevention is the most effective and efficient way to minimize fraud,  waste, and abuse in any federal program, including disaster assistance,  and is also a key element described in the Standards for Internal Control in  the Federal Government. The most crucial element of fraud prevention is  to substantially diminish the opportunity for fraudulent access into the  system through front end controls. Figure 2 displays how preventive  controls fit within a larger fraud, waste, and abuse prevention program.
Fraud prevention can be achieved by requiring that registrants provide  information in a uniform format, and validating that information against  external sources. In the current environment, agencies have at their  disposal a large number of data sources that they can use to validate the  identity and address of registrants. However, our work related to FEMA’s  management of the IHP program for hurricanes Katrina and Rita found  that their limited use of a third-party validation process left room for  substantial fraud. Effective fraud prevention controls require that agencies  enter into data-sharing arrangements with organizations to perform  validation. System edit checks are also key to identifying and rejecting  fraudulent registrations before payments are disbursed. In addition, an  effective fraud prevention system is not complete without adequate fraud  awareness training of all personnel involved in the distribution of relief.  Finally, any new systems or processes need to be field tested to ensure  that the system is working properly prior to implementation.

		Data Validation

Prior to a disaster registrant gaining access to relief payments, key  registrant information must be validated. For this program, data such as  names, social security numbers (SSN), primary residences, citizenship  status, and any other information which determines eligibility must be  validated upfront, prior to agencies accepting the registration, or at least  prior to disbursements being made. Obtaining releases from registrants  which allow an agency to validate data with other sources such as social  security records, tax records, and other information is an important step  that can facilitate effective validation of data.
Depending on the turnaround time needed for a payment, agencies can  chose to validate records with federal government databases, or validate  information with third-party contractors who can confirm key information  with publicly available data from credit reports and other sources almost  instantaneously. When using these third-party sources it is also important  to at least periodically authenticate the data within the program with the  source of the information such as Social Security Administration (SSA) or  Internal Revenue Service (IRS) records. Regardless of the sources used, all  key data concerning a registration has to be validated to minimize the risks  to acceptable levels prior to the registrant being accepted in the program.  For example, because FEMA lacked basic identity validation controls, they  accepted thousands of IHP registrations from registrants who provided  social security numbers that had never been issued or belonged to  deceased individuals. In addition, because FEMA failed to validate  damaged address information, we found thousands of dollars were paid to  individuals for bogus damaged addresses.
For data to be properly validated, it should be recorded in a uniform  format. Once key data elements relating to disaster relief eligibility are  determined, our work has shown that it is important to record the  information in a format that will facilitate data validation with external  sources. Otherwise, agencies may be faced with thousands or tens of  thousands of registrations being rejected or placed in a manual review  status because data was not recorded accurately. This is also particularly  important when recording names, identity information, and addresses in  order to prevent registrants from getting multiple payments by changing  the spelling of their address or name. For example, data collected by  hotels providing lodging that was paid for by FEMA did not record  occupant’s SSN or FEMA registration ID numbers. Thus, there were no  common data elements that could be used to ensure people already  staying at FEMA paid hotels did not also improperly receive rental  assistance.
Within the federal government, many organizations such as SSA, United  States Postal Service (USPS), and IRS maintain information on disaster  assisted registrants. These are all data sources that we have used in prior  forensic work to identify fraudulent and improper payments. However,  proactive actions are necessary on the part of agencies responsible for  providing disaster assistance to enter into data-sharing agreements with  organizations that own the data. Agreements have to be in place prior to  any disaster occurring for agencies to take advantage of data-validation  sources. Also for tax information, consent must be requested from the  registrant at the time of registration.
Finally, whenever possible, registration data and specific loss claims  should be validated by a physical inspection of the disaster damage prior  to payment. In some cases, as with the massive destruction caused by  Hurricane Katrina, physical inspections in a timely manner are not  possible, and therefore acceptance of data must be done through  electronic verification. However, within the FEMA IHP program we found  significant fraud related to expedited assistance payments that were made  prior to any physical inspection being performed. In the cases we found,  many fraudulent registrations could have been identified and rejected if  inspections were performed because they would have seen that properties  did not even exist, as we found when performing our own inspections. For  example, FEMA failed to perform physical inspections on our undercover  registrations, which used completely bogus property addresses and vacant  lots. Had a physical inspection been performed, FEMA could have  identified the fraudulent information and denied the expedited and rental  assistance payments.

		System Edit Controls

Disaster relief programs must also have a network of system pre-payment  edit checks in place to ensure that obviously false or duplicate information  is not used to receive disaster relief payments. System edit checks can be  performed before or after a registration is accepted into the system, but to  be an effective preventive control, they must be performed prior to the  distribution of a payment. Edit checks should include items such as  ensuring that the same SSN was not used on multiple registrations, or that  the registrant provides a verifiable physical address for which the disaster  damaged is based on. In the case of FEMA’s IHP program, we found the  lack of effective system edit checks allowed numerous individuals to  fraudulently register numerous times and receive multiple payments using  the same name, social security number, or address. In one case, the lack of  controls allowed an individual to register eight times using the same name  and SSN and receive multiple disaster assistance payments. In addition,  accepting applications with obviously inaccurate data exposed FEMA to  the risk that disbursements would be made based on obviously false data.  For example, we found during our work that FEMA paid millions of  dollars in IHP payments to individuals who used a Post Office Box as their  damaged physical address in order to receive assistance. In those cases  system edits should have identified the Post Office Box as an invalid  physical address and forced the applicant to provide a valid street address  for the damage property in order to be considered for disaster assistance.
Results of our work also showed that agencies must follow through and  accurately implement—and not short-change—existing system edit checks  to provide assurance that the program is protected. We found in the  course of our work that FEMA had designed controls that may have  prevented some fraudulent payments. However, our work also indicated  that these controls were circumvented, for example, when FEMA designed  scripts to override system edit checks that had identified registrations as  potential duplicates, in an effort to disburse funds as quickly as possible.  Adhering to existing control procedures is therefore also crucial when  maintaining effective fraud prevention.

		Fraud Training and Field Testing

Beyond the uniform recording and validation of data, other controls,  including a well-trained work force that is aware of the potential for fraud,  can help prevent fraud. Personnel involved in a disaster program,  including government employees and call center and inspection  contractors, should receive training about the potential for fraud within  the program and the likely types of fraud they could encounter. Fraud  awareness training with frontline personnel is crucial because they are  part of the first line of defense and therefore play a key role in fraud  prevention. If the personnel accepting registrations and performing  physical inspections of properties and documents are aware of fraud  indicators and suspicious activities, they will help to identify potentially  fraudulent activity as soon as it occurs. Where possible, incentives can be  provided to contractors not just to process registrations and claims  quickly, but also to prevent fraud.
In addition, when implementing any new controls, it is important to field  test all systems prior to putting them in place. As stated in a recent  testimony on the IHP program, FEMA acknowledged that they had  instituted several new processes that had not been tested. Weaknesses in  these new processes, including the lack of validation controls over key  data elements, resulted in our findings of approximately $1 billion dollars  in potential fraud in the IHP program. On top of reducing the risk of  untested controls allowing substantial fraud, field-testing also helps to  ensure that new controls do not improperly deny benefits to valid  registrants. A safety net for those registrants who are wrongly denied  disaster relief due to preventive controls should always be in place to  ensure they receive assistance. This process should include staff who are  adequately trained to expeditiously handle exceptions.

	Detection and Monitoring

Even with effective preventive controls, there is substantial residual risk  that fraudulent registrants are likely to gain access to a disaster relief  program and begin to receive payments. Therefore, after a registrant has  successfully passed through upfront controls and begun to receive  payments, our work at FEMA illustrated that agencies must continue their  efforts to monitor the execution of the disaster relief program. Detection  and monitoring efforts are addressed in the Standards for Internal Control  in the Federal Government and include such activities as data-mining  registrations, which have received payments, ensuring accountability over  funds and monitoring how the disaster assistance is being spent, and  establishing mechanisms to identify the existence of fraud. Figure 3  provides a perspective on how these controls fit into an overall fraud  prevention program.
Data-mining of registration data within the program should be done to  look for suspicious information after payments have been made. Along  with data-mining efforts, proper accountability controls over the  distribution of funds and the monitoring of fund usage is key to obtaining  reasonable assurance that relief payments are being used to mitigate the  effects of a disaster. Also, setting up hotlines to identify potential frauds is  an important activity that should be in place when distributing disaster  funds. Finally, any lessons learned from detection and monitoring efforts  should be used to improve preventive controls to reduce the risk for fraud,  waste, and abuse in the future.
Despite effective preventive controls, there is still risk for fraud, waste,  and abuse within disaster programs once payments are made. Therefore, it  is important that program managers continuously data mine registrations  for suspicious activity. A robust data-mining program can include many  different efforts. Examples of fraud indicators include but are not limited  to searching for anomalies like those found at FEMA, including multiple  payments sent to the same address or bank account. Abnormalities such  as numerous residents in a damaged apartment building all relocating to  the same location may also suggest fraud. Comparing recipient data  against other government assistance programs such as databases  containing information on Red Cross or FEMA paid for hotel rooms can  help to identify duplication of benefits between programs. However, due  to the difficulties of collecting overpayments, system edit checks that  occur prior to payments being made are preferable to data-mining after  payments have occurred.
The data-mining we performed on FEMA’s IHP program showed how  important constant monitoring and detection can be. We searched for and  found examples where the same individual received several rental  assistance checks from FEMA while at the same time residing in a hotel  room paid for by FEMA. We also found instances where multiple family  members from the same household registered numerous times and  received duplicate payments. Using external databases of federal and state  prisoners, we found instances where prisoners had fraudulently registered  for and received disaster relief payments while incarcerated. As shown by  our examples, data-mining efforts should be done in a manner that uses  creative solutions to search for potential fraud using all available data  sources. To the extent that data-mining identifies systematic fraud, that  intelligence should be fed back into the fraud prevention process and  system edits so that for future disasters the fraud is detected before money  is disbursed.

		Accountability and Proper Use of Relief Payments

When part of the disaster assistance comes in the form of cash or a cash  equivalent such as a debit card, our work at FEMA shows that it is crucial  for agencies to maintain strict accountability over who has received the  assistance. This can be achieved by obtaining signatures of release from an  agency official and, if appropriate, from the issuing bank official, along  with a signature of acceptance from the relief recipient. Agencies should  also be able to link each distribution of cash to a specific applicant. In the  case of FEMA and their distribution of debit cards, adequate  accountability was not maintained, resulting in more than $1 million worth  of debit cards being distributed without a record of who received them.
In addition, depending on the type of assistance provided and the means in  which the assistance was distributed, it can be important for an agency to  monitor the usage of disaster relief funds. Our review of FEMA’s IHP  program found that almost all money was distributed via check or EFT,  which did not allow us to review whether the money was spent on  disaster-related needs. A small amount, approximately $80 million, of IHP  money was distributed via debit cards, which allowed us to see whether  funds were being used appropriately. In this case, the vast majority of  debit card money was still withdrawn as cash, but the remaining amount  appeared to have been used for disaster-related needs. However, we did  find a small number of purchases for nondisaster items such as football  tickets, alcohol, massage parlor services, and adult videos. By monitoring  these types of uses and contacting and possibly penalizing those who  misuse funds, agencies may be able to ensure that disaster funds are used  to help mitigate losses and not for inappropriate items.

		Fraud Hotlines

To detect existing fraud and prevent new cases in the future, agencies  should also set up mechanisms to identify and investigate existing cases.  The use of hotlines where individuals can anonymously call and report  potential fraud can provide valuable investigation leads. The Department  of Homeland Security (DHS) Office of Inspector General set up one such  hotline specifically dedicated to fraud related to hurricanes Katrina and  Rita. Similar hotlines are useful within any disaster relief program to help  identify any fraudulent activity not caught by controls. In conjunction with  fraud identified through data-mining or hotline tips, agencies should have  in place teams ready to investigate leads, not only for future prosecution,  but also to provide suggestions for how the fraud can be prevented in the  future.

	Investigations and Prosecution of Offenders

The final aspect of a program designed to reduce fraud in a disaster  assistance program is the investigation and aggressive prosecution of  individuals who have fraudulently received disaster assistance. Suspicious  cases identified through preventive, detective, and monitoring controls,  along with hotline tips, should be referred to investigators for further  review. In the course of our work performed on IHP fraud for hurricanes  Katrina and Rita, we identified tens of thousands of potentially fraudulent  registrations. We have already referred thousands of those cases to FEMA  and the Katrina Fraud Task force for further investigation and expect to  refer others for additional investigation and possible prosecution. While  the criminal investigative process is general a lengthy process, we are  aware that several individuals that we referred have already been indicted.  This included one individual indicted for fraudulently obtaining over  $25,000 from FEMA based on bogus registrations. Figure 4 displays how  investigations and prosecutions fit into an overall fraud prevention  program.
While investigations and prosecution can be the most visible means to deal  with fraudsters, they are also the most costly and should not be used in  place of other more effective controls. Instead, agencies need to focus on  prevention before money is spent. Still, by successfully prosecuting  fraudsters, agencies can deter others who are thinking of taking advantage  of disaster programs. In the end, investigations and prosecutions are a  necessary part of an overall fraud prevention and deterrence program, but  should be a last resort when all other controls have failed. In addition,  knowledge from these investigations and prosecutions should be fed back  into the fraud prevention process to better handle future disasters and  enhance existing fraud prevention and detection programs.

	Concluding Comments

Managers of federal disaster assistance programs face a dual challenge— delivering aid as quickly as possible while at the same time ensuring that  relief payments go only to those who are truly in need. To meet this dual  challenge, managers must recognize that fraud prevention and the rapid  distribution of assistance are not conflicting mandates; instead, both can  be accomplished if effective controls are in place and operating as  intended. Of the controls discussed today, fraud prevention controls are  the most useful and cost-effective means of reducing the loss of money  due to fraud, because payments, once out the door, have proven extremely  difficult to recover. Implementing an effective system of fraud prevention  controls including upfront controls, post payment detection and  monitoring, and prosecuting those who have exploited control weaknesses  are crucial to building the American taxpayer’s confidence that federal  disaster assistance is given to those in need.
Mr. Chairman and members of the Committee, this concludes my  statement. I would be pleased to answer any questions that you or other  members of the Committee have at this time.

	Contacts and Acknowledgements

For further information about this testimony please contact Gregory Kutz  at (202) 512-7455 or kutz@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this testimony.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.

Summary:
Why GAO Did This Study

Federal agencies spend billions of dollars annually to aid victims of natural and other disasters and acts of terrorism. Managers of federal disaster assistance programs face a dual challenge--delivering aid as quickly as possible while at the same time ensuring that relief payments go only to those who are truly in need. Due to the very nature of the government's need to quickly provide assistance to disaster victims, federal disaster relief programs are vulnerable to significant risk of improper payments and fraudulent activities. On February 13, 2006, and on June 14, 2006, GAO testified concerning extensive fraud, waste, and abuse in the Individuals and Household Program (IHP), a component of the Federal Emergency Management Agency's (FEMA) disaster assistance programs. GAO identified significant internal control weaknesses that resulted in FEMA making tens of thousands of Expedited Assistance payments that were based on bogus registration data. GAO also found numerous other internal control failures in FEMA's IHP disaster assistance program, resulting in an estimate that FEMA made $600 million to $1.4 billion in improper and potentially fraudulent payments to registrants. The purpose of this testimony is to establish a framework for preventing, detecting, and prosecuting disaster assistance fraud.

What GAO Found

Recent GAO audits have illustrated the importance of an effective fraud, waste, and abuse prevention system in federal disaster assistance programs. GAO's Standards for Internal Control in the Federal Government provide a framework for internal control that can be used to minimize fraudulent, wasteful, and abusive activity regardless of whether dealing with the effects of natural disasters like hurricanes Katrina and Rita, or coping with the destruction left by the terrorist attacks of September 11, 2001. A well-designed fraud prevention system should consist of three crucial elements: (1) upfront preventive controls, (2) detection and monitoring, and (3) investigations and prosecutions. Upfront preventive controls can help screen out the majority of fraud, and are the most effective and efficient means to minimize fraud, waste, and abuse. Detection and monitoring, and aggressive prosecution of individuals committing fraud, while also crucial elements of an effective system, are less effective and generally cost more. Audit work has long confirmed that upfront preventive controls are most effective when they require validation of data provided by disaster registrants against other government or third-party sources, and physical inspections when possible. Preventive controls should also include procedures designed to identify problem registrants prior to payments. Training personnel on fraud awareness and potential fraud schemes is also an integral component in preventive controls. Collectively, these preventive controls can help improve program integrity and safeguard tax dollars. An effective fraud deterrence program must also include resources to continually monitor and detect potential fraud, and aggressively investigate and prosecute individuals who received assistance fraudulently. Monitoring and detection include data-mining for suspicious registrations and payment usage, and setting up fraud hotlines. Finally, program integrity is enhanced by investigating and prosecuting individuals who take advantage of program weaknesses. However, the high costs of prosecutions highlight our conclusion that upfront preventive controls are most effective in preventing fraud, and that lessons learned from detection and prosecutions should be used to improve preventive controls.