Department of Homeland Security 

Office of Inspector General 

Improvements to Internal Controls for 


FEMA's Individuals and Households 


Program Registration Process 


(Redacted)
 

Notice: This report remains the property of the DHS Office of Inspector General (DHS OIG) at all times and, as 

such, is not to be publicly disclosed without the express permission of the DHS OIG. Requests for copies of this 

report should be immediately forwarded to the DHS Office of Counsel to the Inspector General to ensure 

compliance with all applicable disclosure laws. 

OIG-09-110 September 2009 

 

 

 

 

 

 

 

 

 

 

 

 

Table of Contents/Abbreviations 

Executive Summary.............................................................................................................1 

Background..........................................................................................................................2 

Results of Review ................................................................................................................4 

 Improvements in Controls Since 2005 Gulf Coast Hurricanes.......................................4 

 Challenges Remain .........................................................................................................7 

 Major Disaster Business Plan .......................................................................................10 

 Conclusions...................................................................................................................11 

 Recommendations.........................................................................................................12 

 Management Comments and OIG Analysis .................................................................13 

Appendices 

Appendix A: Purpose, Scope and Methodology ..........................................................14 

Appendix B: Management Comments to the Draft Report ..........................................15 

Appendix C: Major Contributors to this Report ...........................................................18 

Appendix D: Report Distribution..................................................................................19 

Abbreviations 

DHS Department of Homeland Security 

EFT Electronic Funds Transfer 

FEMA Federal Emergency Management Agency 

GAO Government Accountability Office 

IHP Individuals and Households Program
 

NEMIS National Emergency Management Information System 

OIG Office of Inspector General 

SSA Social Security Administration 

SSN Social Security Number 
OIG 

Department of Homeland Security 

Office of Inspector General 

Executive Summary 

The Federal Emergency Management Agency (FEMA) has made 

significant improvements to the Individuals and Households 

Program (IHP) disaster assistance registration approval process, 

but more could be done to better utilize the additional information 

FEMA is obtaining from outside sources. For the 2008 disasters 

we examined, FEMA has been obtaining information to validate 

assertions concerning (1) identity, (2) occupancy, and (3) 

ownership made by all IHP registrants. FEMA also established a 

standard policy that will authorize IHP payments only after an 

inspector meets with the IHP registrant, inspects the damaged 

property, reviews documentation provided by the registrant, and 

provides a report to FEMA. 

Inspecting a property prior to issuing disaster assistance is 

fundamentally a sound control procedure; however, the process 

could be improved if FEMA provided inspectors with information 

on the results of the identity, occupancy, and/or ownership validity 

checks before they meet with the registrant and conduct the 

physical inspection. 

In major disasters such as the 2005 hurricanes Katrina and Rita, 

FEMA did not have the time to interview all IHP registrants and 

inspect the damaged property prior to providing disaster assistance. 

FEMA's decision to authorize payments without conducting 

interviews and inspections made the IHP program vulnerable to 

making payments on duplicate and potentially fraudulent 

registrations

 Finally, FEMA needs an 

approved business plan that clearly articulates the steps it will take 

to quickly and accurately provide disaster assistance payments, in 

situations where inspecting all properties before issuing disaster 

assistance is not practical. 

Improvements to Internal Controls for FEMA's Individuals 

and Households Program Registration Process 

Page 1 
 

Background 

Immediately after the President declares a disaster, affected 

individuals are able to apply for individual assistance from the 

Individuals and Households Program (IHP) in person, by calling a 

toll-free telephone number, or through the Internet. Registrants 

provide FEMA a variety of information on the registration, 

including: name, social security number (SSN), damaged address 

and telephone number, current address and telephone number, 

insurance information, total household income, bank routing and 

account information, and a description of losses incurred because 

of the disaster. 

By applying for IHP assistance, individuals are potentially eligible 

for the following types of disaster-related assistance: temporary 

housing (rent and lodging), home repair, home replacement, 

personal property repair or replacement, transportation repair or 

replacement, medical and dental expenses, funeral and burial costs, 

moving and storage expenses, and other related needs such as 

generators and the cost of flood insurance. 

FEMA administers IHP disaster assistance through the National 

Emergency Management Information System (NEMIS), and 

contracts with a third-party contractor to attempt to validate 

identity, occupancy, ownership, and other information provided by 

registrants during the registration process. In addition, FEMA can 

use edit checks in NEMIS to identify duplicate registrations and to 

prevent duplicate payments to registrants who have provided 

invalid and/or fraudulent information when registering for 

assistance. The contractor validates information provided by 

registrants by comparing the registrant's name with the SSN, the 

name with the address, and other pieces of information provided. 

Once FEMA accepts a registration, it requests a physical 

inspection of the registration address to be performed by a FEMA 

contractor. 1 To perform a physical inspection, an inspector meets 

with a registrant and reviews documentation to validate (1) the 

registrant's identity, (2) the registrant's occupancy of the damaged 

address, and (3) if applicable, the registrant's ownership of the 

damaged address. To validate the registrant's identity, occupancy, 

and/or ownership, the inspector is required to view physical 

documentation provided by the registrant, such as a driver's 

1

 Two contractors, Alltech and PaRR, are currently assigned to perform all disaster-related inspections for 

FEMA. Independent subcontractors, hired by the contractors, perform the physical inspections. 

Improvements to Internal Controls for FEMA's Individuals 

and Households Program Registration Process 

Page 2 
license, merchant's statement or utility bills substantiating a 

registrant's identity and occupancy of the damaged address. 

To validate ownership of a damaged address, the inspector reviews 

mortgage documents, tax assessment records, or homeowner's 

insurance documents. Once the inspector views a registrant's 

documentation, he or she inspects the address to determine what 

physical damage, if any, was sustained during the disaster. The 

inspector then records the validation of a registrant's 

documentation and the damage incurred due to the disaster on a 

FEMA-provided computer. The inspector subsequently uploads 

this data to NEMIS, and FEMA determines the type and amount of 

assistance that the registrant is eligible to receive.

On August 29, 2005, Hurricane Katrina struck several Gulf Coast 

states, including Alabama, Mississippi, and Louisiana, as a 

Category 3 hurricane. On September 24, 2005, Hurricane Rita, 

another Category 3 hurricane, struck Louisiana and Texas. These 

hurricanes caused catastrophic damage to the Gulf Coast. As part 

of the IHP program, about 2.5 million individuals applied for 

disaster assistance, and FEMA authorized about 1.5 million of 

these applicants as eligible for IHP disaster assistance. Because of 

the high volume of IHP registrations, FEMA turned off many of its 

system controls in order to process registrations in a timely 

manner. However, a subsequent Government Accountability 

Office (GAO) audit estimated that FEMA made between $600 

million and $1.4 billion in payments to potentially fraudulent 

registrations because effective controls were not in place. 

Between March and June 2008, heavy rains in Midwestern states 

caused multiple rivers to overflow and flood. States affected by 

the flooding include Illinois, Indiana, Iowa, Michigan, Minnesota, 

Missouri, and Wisconsin. The President declared disasters in these 

states, resulting in more than 100,000 registrants applying for IHP 

disaster assistance and FEMA paying more than 60,000 registrants 

for IHP disaster assistance as of October 14, 2008. In August and 

September 2008, hurricanes Gustav and Ike hit the Gulf Coast 

states of Louisiana and Texas. The President declared disasters for 

these two hurricanes, resulting in more than 1.2 million individuals 

applying for federal assistance. As of March 13, 2009, FEMA had 

authorized 200,000 individuals to receive IHP assistance for 

hurricanes Gustav and Ike. 

Improvements to Internal Controls for FEMA's Individuals 

and Households Program Registration Process 

Page 3
Results of Review 

The results of our analysis of FEMA data from hurricanes Katrina and 

Rita in 2005 and data from more recent disasters shows substantial 

improvements in internal controls, resulting in far fewer instances of 

payments being made to registrations with duplicate and invalid key data. 

However, FEMA is not fully using its validity checks for key registration 

data, and payments have been made to thousands of registrations that have 

failed key checks for identity, occupancy, and/or ownership. FEMA does 

have compensating controls in place to help ensure that registrations 

failing data checks have identity, occupancy, and/or ownership validated 

prior to a payment being issued, such as requiring a physical inspection of 

a damaged property and a registrant's documentation. However, failed 

checks do indicate registrations that are at a higher risk of being 

fraudulent, and should be scrutinized more thoroughly in the event FEMA 

cannot conduct inspections in a timely manner. Further, the results of 

these checks are not being passed to inspectors so that they can validate or 

overturn the claims after viewing registrant-submitted documentation 

during a physical inspection of the damaged property. Finally, FEMA 

needs a business plan that will guide decision-making and expedite 

disaster payments to valid registrants in the event of a major disaster 

where it is unable to conduct a physical inspection of damaged properties. 

Improvements in Controls Since 2005 Gulf Coast Hurricanes 

Our analysis of FEMA IHP payment data for hurricanes Katrina and Rita 

and selected 2008 disasters showed that the number of duplicate, 

improper, and potentially fraudulent registrations receiving payment has 

been substantially reduced. FEMA officials acknowledged control 

breakdowns occurring subsequent to the 2005 Gulf Coast hurricanes, and 

said they were not preventable due to the size of the disasters, the 

magnitude of exception reports generated by the system, the shortage of 

management personnel to manually review registrations, and the need to 

turn off some controls in order to process assistance payments in a timely 

manner. FEMA has claimed that the weak control environment in 2005 

was exceptional and that the control environment is much better for 

smaller disasters. The stronger control environment in smaller disasters is 

due in large part to FEMA's ability to implement a 100% inspection 

policy, where all registrations eligible for payment are inspected and a 

FEMA contractor interviews a representative of the registrant before 

authorizing payment. 

To demonstrate the weaknesses in the controls for hurricanes Katrina and 

Rita payments, we analyzed FEMA IHP data for the 1.5 million registrants 

receiving payments to identify duplicate and potentially fraudulent data 

Improvements to Internal Controls for FEMA's Individuals 

and Households Program Registration Process 

Page 4
 

 

contained in the registration databases for the 2005 Gulf Coast hurricanes. 

Specifically, FEMA made duplicate, improper, and potentially fraudulent 

IHP payments to registrations based on the following information: 

• Invalid SSNs (based on the Social Security Administration's 

(SSA) guidance on invalid SSN number strings) 

• Multiple registrations with the same SSNs 

• Post Office boxes that were listed as the disaster-damaged 

addresses 

• Multiple registrations with the same bank routing numbers and 

account numbers 

• Multiple registrations with the same disaster-damaged 

addresses and current addresses.2

Office of Inspector General (OIG) audits, as well as other oversight audits 

performed by GAO, identified serious internal control failures that 

occurred as part of FEMA's disaster assistance program after hurricanes 

Katrina and Rita. As a result of audit work, registrations identified as 

potentially fraudulent were referred to investigators for further 

investigation and, where applicable, for prosecution. 

To test for changes in FEMA's internal control environment since 2005, 

we requested that FEMA provide databases of registrations and payments 

for the 2005 Gulf Coast hurricanes, the 2008 Midwest floods, and the 

2008 Gustav and Ike hurricanes. We then tested the registration and 

payment data for the current disasters to determine if FEMA was making 

the same types of problematic payments made after the 2005 Gulf Coast 

hurricanes. Our analysis of the 2008 disaster registration and payment 

data showed that FEMA made virtually no payments to registrants with 

invalid or duplicate SSNs and made far fewer payments to registrants who 

had provided other duplicate information for the 2008 disasters. The 

results of the tests for the 2005 Gulf Coast hurricanes, the 2008 Midwest 

floods, and the 2008 Gustav and Ike hurricanes are shown in table 1. 

2

 We were unable to provide a list of SSNs accepted by FEMA from registrants to the Social Security 

Administration to be run against the SSA database of valid SSNs. 

Improvements to Internal Controls for FEMA's Individuals 

and Households Program Registration Process 

Page 5
 

Table 1. Comparison of Fraud Prevention Tests Conducted on the 2005 

Gulf Coast Hurricanes and the 2008 Midwest Floods and Hurricanes 

Gustav and Ike Payments 

Gulf Coast 

Hurricanes 

Midwest 

Floods1

Hurricane 

Gustav2

Hurricane 

Ike2

Total registrations 2.6 million 107,000 441,000 788,000

Total registrations 

receiving payment 

1.5 million 62,000 70,000 130,000

Duplicate damaged 

addresses 

380,000 1,700 4,400 10,100

Duplicate damaged 

and current addresses 

111,000 600 3,100 5,200

Invalid SSNs 700 6 2 11

Duplicate SSNs 33,000 2 21 16

Post Office Boxes 2,200 4 4 14

Duplicate Electronic 

Funds Transfer (EFT) 

accounts 

23,000 14 46 136

1

Data based on FEMA registration and payment data as of October 14, 2008. 2

Data based on FEMA registration and payment data as of March 13, 2009. 

The results of our data analysis for the 2005 Gulf Coast hurricanes showed 

that FEMA paid more than 100,000 registrations based on potentially 

fraudulent information. Specifically, out of about 1.5 million registrations 

receiving FEMA payments, more than 30,000 had invalid or duplicate 

SSNs, more than 20,000 had duplicate American Bankers Association 

bank routing numbers and bank account numbers, and more than 100,000 

had duplicate damaged and current household addresses. FEMA paid 

hundreds of millions of dollars to these duplicate, improper or potentially 

fraudulent 2005 Gulf Coast hurricane registrations. In addition, the tests 

identified the same types of internal control weaknesses and the kinds of 

potential cases that OIG and GAO had previously reported. According to 

FEMA officials, during the 2005 Gulf Coast hurricanes, FEMA turned off 

some internal controls in order to process disaster assistance payments in a 

timely manner, leading to internal control problems and payments based 

on invalid and duplicate registrations. 

In contrast, far fewer payments were issued based on duplicate or invalid 

information for selected 2008 disasters. The data indicate that FEMA had 

a strong control environment in place during the Midwest flood disasters 

and hurricanes Gustav and Ike in 2008. For example, the same tests used 

to identify control weaknesses in the 2005 Gulf Coast hurricanes revealed 

no registrants with invalid or duplicate SSNs being paid as part of the 

Midwest floods or hurricanes Gustav and Ike. In addition, far fewer 

Improvements to Internal Controls for FEMA's Individuals 

and Households Program Registration Process 

Page 6
registrants were paid based on duplicate addresses and banking data in 

2008 disasters when compared to the 2005 hurricanes. Registrants paid 

based on duplicate addresses are less risky than those that are paid based 

on other duplicate data because there are numerous reasons two valid 

registrants could share an address and still each receive payments. For 

example, two roommates would each be eligible to apply for and receive 

personal property reimbursement. 

Two key changes have led to an improved IHP control environment. First, 

FEMA has increased the number and scope of protective measures taken 

to ensure that registrations based on duplicate and invalid information do 

not become eligible for assistance payments. For the 2005 Gulf Coast 

hurricanes, FEMA used a contractor to provide limited validity reviews of 

its online registrations. However, not all key data elements were validated 

by the contractor, telephone registrations were not initially subject to any 

validity reviews, and detailed test results were not passed to FEMA for 

review. FEMA has improved its data review process considerably since 

2005. FEMA now passes all its registrations to the contractor for review, 

whether submitted online or by telephone. In addition, FEMA now 

requires the contractor to review more key data elements than in 2005. 

Currently, the contractor conducts multiple tests to establish the validity of 

a registrant's identity. In addition, the contractor performs reviews to 

determine whether the registrant was a valid occupant and/or owner of the 

damaged address. These upgrades to FEMA's contract provide a greater 

assurance that key registration information is valid, compared with the 

limited validity checks in place at the time of the 2005 Gulf Coast 

hurricanes. 

In addition, since 2005, FEMA has operated under a 100% inspection and 

interview environment. This means that prior to making a payment on any 

IHP registration, a FEMA contractor meets in person with the registrant 

and inspects the damaged property to determine what assistance, if any, 

the registrant is entitled to receive. This allows FEMA, in addition to 

validity tests performed by the contractor, to have its inspectors perform

an additional onsite review of documentation provided by a registrant to 

show that the registrant resides in and/or owns and occupies the address 

claimed on the disaster assistance registration. 

Challenges Remain

When compared with the 2005 Gulf Coast hurricanes, improved upfront 

testing of key registration data elements, as well as a 100% inspection 

environment, have allowed FEMA to make significant improvements in its 

ability to identify and prevent payments to registrations based on duplicate 

or invalid data. However, challenges remain that could result in FEMA 

Improvements to Internal Controls for FEMA's Individuals 

and Households Program Registration Process 

Page 7
making payments to improper or potentially fraudulent registrants and 

could hinder FEMA's ability to make timely payments to valid registrants 

in the event of a major disaster. 

A significant number of registrations that fail one or more validity tests are 

receiving disaster assistance payments, according to data from the 2008 

Midwest floods and hurricanes Gustav and Ike. While registrations failing 

data validity checks are not necessarily invalid, those registrations are at a 

higher risk of being fraudulent due to the lack of evidence substantiating 

key registration data. In addition, while FEMA makes a preliminary 

assessment of the validity of a registrant's identity, occupancy, and 

ownership of the damaged property based on upfront computer checks, 

FEMA does not provide inspectors with the results of that assessment 

prior to a physical inspection. Inspectors can overrule the preliminary 

assessment during a physical inspection based on viewing physical 

documentation received from a registrant, but the failure to provide them

with these results leaves FEMA more vulnerable to registrants providing 

fraudulent documentation at the time of inspection. 

Payments to Registrations Failing Identity, Occupancy, and 

Ownership

Our data analysis shows a significant number of FEMA disaster assistance 

payments being made to registrations that failed one or more of the 

identity, occupancy and ownership validity tests. Specifically, for the 

2008 Midwest floods and hurricanes Gustav and Ike, roughly 50% of 

registrants receiving disaster assistance payments had failed one or more 

tests designed to validate identity, address, and occupancy and/or 

ownership of a damaged address at the time of the disaster. There are 

reasons why a valid registrant may fail one or more validity checks for key 

registration data. For example, an apartment resident who is on a lease but 

does not pay utility bills for the apartment may not be linked to the address 

through public records. In that case, the registrant may fail the occupancy 

validity check despite being a valid resident of the address. While validity 

check failures do not necessarily mean a registration is invalid, 

registrations that fail one or more of the validity tests are inherently more 

likely to contain false or inaccurate information and thus have a higher 

risk of resulting in payments based on fraudulent or improper registrant 

information. Specific results of our data analysis are shown in Table 2. 

Improvements to Internal Controls for FEMA's Individuals 

and Households Program Registration Process 

Page S
 

Table 2. Midwest Floods, Hurricane Gustav, and Hurricane Ike 

registrants failing identity, occupancy and/or ownership tests and 

receiving payments 

Midwest 

Floods1

Hurricane 

Gustav2

Hurricane 

Ike2

Total registrations 107,000 441,000 788,000

Total registrations 

receiving payment 

62,000 70,000 130,000

Registrations failing 

one or more validity 

test 

25,000 43,000 69,000

Failures by type:

Identity 890 1,100 4,000

Address 7,800 14,300 25,400

Occupancy 8,900 17,000 36,200

Ownership 15,700 28,000 33,100 1Data based on FEMA registration and payment data as of October 14, 2008. 2

Data based on FEMA registration and payment data as of March 13, 2009. 

Inspectors Not Provided with Identity, Occupancy and Ownership 

Validity Test Results

Despite the prevalence of registrants who fail identity, occupancy, and/or 

ownership tests eventually receiving payment after a physical inspection, 

FEMA does not provide the results of these validity tests to the inspectors 

who will inspect the damaged property. As a result, inspectors are not 

able to evaluate registrations with invalid or suspect data with a higher 

level of scrutiny than they would give to a registration that has passed all 

key validity tests. 

In addition, inspectors are not required to independently validate 

documentation provided to them by disaster registrants to confirm identity,

occupancy, and/or ownership. For example, if an inspector looks at a 

driver's license to establish a registrant's identity and/or occupancy, the 

inspector is not required to record the driver's license number or 

determine that the driver's license is valid with the State's Department of 

Motor Vehicles. In another example, if a registrant provides an inspector 

with a lease to show proof of occupancy, the inspector is not required to 

confirm lease information with neighbors, the leasing office, or the postal 

carrier to determine if additional evidence validates the lease. While 

additional scrutiny is perhaps unnecessary if a registrant has already 

passed all validity tests, the inspector's role could be expanded to include 

verifying registration data for registrations that failed one or more validity 

tests with third parties. 

Improvements to Internal Controls for FEMA's Individuals 

and Households Program Registration Process 

Page 9
Problems Exist in Occupancy Validation Checks

FEMA uses occupancy validation checks to make a preliminary 

determination of whether an applicant occupied a damaged address at the 

time of a disaster. 

To validate a registrant's occupancy of a damaged address at the time of 

the disaster, FEMA uses a contractor to check the registrant's key personal 

information against available public records. However, while our tests 

confirmed the effectiveness of the contractor's ability to identify name and 

SSN mismatches, 

Inspectors are 

required to validate occupancy during a physical inspection (such as by 

examining a driver's license or utility bill) before any IHP payments are 

authorized. 

Ma�or �isaster Business Plan

FEMA needs a business plan that could be implemented in the event of a 

major disaster (on the scale of hurricanes Katrina or Rita). FEMA needs 

to have a well thought-out business plan that could be adopted in the event 

of a major disaster if it is not practical to provide disaster assistance only 

after the damaged property has been inspected. Without a business plan to 

analyze the risk associated with different types of registrations, FEMA 

may deny timely assistance to registrants who have their identity, 

occupancy, and, if applicable, ownership confirmed by a third party. 

Historically, a backlog of registrants needing payments has caused FEMA 

to turn off its controls, making the process more vulnerable to fraud, 

waste, and abuse. 

Improvements to Internal Controls for FEMA's Individuals 

and Households Program Registration Process 

Page 10
In 2005, the magnitude of damage caused by hurricanes Katrina and Rita 

prevented FEMA from performing inspections of all damaged addresses 

claimed on disaster assistance registrations. Since 2005, FEMA has 

operated under a 100% inspection environment for all disasters, meaning 

that it performs a physical inspection of a damaged address to determine 

eligibility before any payments are issued. 

Although FEMA expects to perform physical inspections of damaged 

addresses, it does not have a documented business plan in place to 

facilitate disaster assistance payments if a major disaster does not allow 

for timely 100% inspections. Further, FEMA does not assign risk values 

to disaster registrations based on the result of identity, occupancy, and 

ownership tests, nor does FEMA assign higher risk values to registrations 

that fail one or more key control tests. Based on its current policy, FEMA 

would face a tough decision if a disaster did not allow 100% of damaged 

addresses to be inspected in a timely manner. FEMA would have to either 

deny assistance to all registrants who had not received inspections and risk 

denying assistance to valid registrants, or decide how to distribute 

assistance to registrants who had not been inspected. Without a wellvetted business plan in place to withhold assistance from suspect 

registrants and to distribute initial assistance to registrants who pass all 

validity tests, FEMA may deny assistance to valid registrants or make 

payments to registrants who submit false and potentially fraudulent 

information. Conversely, FEMA would be forced to make spur-of-themoment payment decisions without adequately addressing the pros and 

cons of its decisions. 

Conclusions 

Our interviews and data analysis show that FEMA has improved its IHP 

program performance since 2005 because of increased controls through 

validity checks with a third-party contractor, and also being able to operate 

under a 100% inspection environment. However, FEMA still faces 

additional challenges in the registration and inspection process that make 

the IHP system vulnerable to paying improper and potentially fraudulent 

registrations. Specifically: 

•

Improvements to Internal Controls for FEMA's Individuals 

and Households Program Registration Process 

Page 11
•
 

Further, FEMA does not have a business plan in place, based on a riskbased analysis of registration data, which would help FEMA decide how 

to give out immediate assistance if a major disaster does not allow 100% 

inspections to be performed in a timely manner. Without a business plan 

in place, FEMA will risk either dropping its control procedures and giving 

out immediate assistance to registrants who have failed key validity tests, 

or keeping its current control procedures and denying immediate 

assistance to registrants who pass all key validity tests but are unable to 

have their damaged address inspected. A risk-based plan would allow 

FEMA to provide immediate assistance to low-risk registrants who pass 

all key validity tests while delaying assistance to more risky registrants 

who fail one or more key validity tests until data inconsistencies can be 

resolved. 

Recommendations 

We recommend that the Administrator, Federal Emergency 

Management Agency: 

Recommendation #1: 

Recommendation #2: Require inspectors to more closely 

examine the evidence that registrants provide overruling identity, 

occupancy, and ownership validity test failures. 

Recommendation #3: Systematically record driver's license 

numbers in NEMIS. 

Recommendation #4: Design procedures to validate the 

authenticity of identity, occupancy, and/or ownership information 

provided by disaster assistance registrants (at least on a sampling 

basis). 

Recommendation #5: 

Improvements to Internal Controls for FEMA's Individuals 

and Households Program Registration Process 

Page 12
Recommendation #6: Develop policy and standard operating 

procedures for expediting IHP assistance when traditional FEMA 

inspection is not feasible or may be delayed for a significant period 

of time that (1) seek to maximize identity, occupancy and 

ownership validation; and (2) define and document risk-based 

solutions for expediting assistance. 

Management Comments and OIG Analysis 

We obtained written comments from the Acting Director, Office of 

Policy and Program Analysis. We have included a copy of the 

comments in Appendix B. The Acting Director, Office of Policy 

and Program Analysis concurred with all six recommendations 

with the exception that FEMA requires additional time to review 

the effectiveness and feasibility of recommendation �3. 

Improvements to Internal Controls for FEMA's Individuals 

and Households Program Registration Process 

Page 13
 

 

Appendix A 

Purpose, Scope, and Methodology

The objectives of our work were to determine (1) whether FEMA 

has instituted changes to respond to recommendations issued by 

the OIG3

 and the GAO4 designed to prevent fraud, waste, and 

abuse in the IHP disaster assistance program observed after 

hurricanes Katrina and Rita, and (2) the extent to which IHP 

remains vulnerable to fraud, waste, and abuse. 

To determine whether FEMA has instituted changes designed to 

prevent the types of fraud and abuse that occurred after the 2005 

Gulf Coast hurricanes, we interviewed FEMA officials to 

determine the changes that FEMA has made to strengthen its 

control environment. We also analyzed databases from the 2005 

Gulf Coast hurricanes, the 2008 Midwest floods, and the 2008 

Gustav and Ike hurricanes to determine the extent to which the 

types of duplicate, improper and potentially fraudulent 

registrations that resulted in payments in hurricanes Katrina and 

Rita existed in the 2008 disasters. Finally, to determine the extent 

to which FEMA's IHP program remains vulnerable to fraud, waste 

and abuse, we analyzed new data to determine if additional 

improvements could be implemented in FEMA's current internal 

control environment. 

Our work was conducted under the authority of the Inspector 

General Act of 1978, as amended, and according to generally 

accepted government auditing standards and President's Council 

on Integrity and Efficiency investigative standards. Audit 

fieldwork was conducted from March through November 2008, in 

the Washington, DC, area and at the Virginia National Processing 

Service Center. 

3 Expedited Assistance Overpayments, GC-HQ-06-06, dated November 1, 2005.
 4 Hurricanes Katrina and Rita Disaster Relief Continued Findings of Fraud, Waste, and Abuse, GAO-07-

300, dated March 2007. 

Improvements to Internal Controls for FEMA's Individuals 

and Households Program Registration Process 

Page 14
Appendix B 

Management Comments to the �raft Report 

Improvements to Internal Controls for FEMA's Individuals 

and Households Program Registration Process 

Page 15
Appendix B 

Management Comments to the �raft Report 

Improvements to Internal Controls for FEMA's Individuals 

and Households Program Registration Process 

Page 16
Appendix B 

Management Comments to the �raft Report 

Improvements to Internal Controls for FEMA's Individuals 

and Households Program Registration Process 

Page 17
 

Appendix C 

Ma�or Contributors to this Report

Gina Smith, Director 

John Ryan, Director 

John Kelly, Director 

Scott Wrightson, Forensics Specialist 

Improvements to Internal Controls for FEMA's Individuals 

and Households Program Registration Process 

Page 1S
 

 

Appendix �

Report �istribution

�epartment of Homeland Security

Secretary 

Deputy Secretary 

Chief of Staff for Operations 

Chief of Staff for Policy 

Deputy Chiefs of Staff 

General Counsel 

Executive Secretary 

Director, GAO/OIG Liaison Office 

Assistant Secretary for Office of Policy

Assistant Secretary for Office of Public Affairs

Assistant Secretary for Office of Legislative Affairs 

FEMA Assistant Administrator, Disaster Assistance Directorate 

FEMA Audit Liaison (Project Code 09-109-EMO) 

Office of Management and Budget

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress

Congressional Oversight and Appropriations Committees, as 

appropriate 

Improvements to Internal Controls for FEMA's Individuals 

and Households Program Registration Process 

Page 19
ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4100, 

fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig. 

OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 

misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 

Attention: Office of Investigations - Hotline, 

245 Murray Drive, SW, Building 410, 

Washington, DC 20528. 

The OIG seeks to protect the identity of each writer and caller.