Syria Humanitarian Assistance: Some Risks of Providing Aid inside Syria Assessed, but U.S. Agencies Could Improve Fraud Oversight
Published: 2016-07-14T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The conflict in Syria has created a complex humanitarian challenge, with an estimated 13.5 million people inside Syria in need of assistance. In response, the United States has provided more than $5 billion since 2011 in humanitarian assistance, with about half supporting those inside Syria. Without an embassy in Syria, State and USAID oversee assistance remotely from neighboring countries.
In this report GAO examines humanitarian assistance provided by State, USAID, and their implementing partners to people inside Syria, including (1) factors affecting delivery of such assistance; (2) the extent to which State, USAID, and their partners have assessed risks to the programs; and (3) implementation of controls to mitigate identified risks and ensure appropriate financial oversight of humanitarian assistance. GAO selected a nongeneralizable sample of 12 funding instruments involving 9 implementing partners and analyzed the partners' risk assessments and control activities, interviewed relevant officials, and conducted fieldwork in Jordan, where several implementing partners are based.
section_title: What GAO Found
paragraphs: Delivery of U.S. humanitarian assistance to people inside Syria is complicated by three factors including a dangerous operating environment, access constraints, and remote management of programs. Active conflict creates a dangerous environment characterized by attacks on aid facilities and workers, and humanitarian organizations face difficulties accessing those in need. Additionally, U.S. agency officials must manage programs in Syria remotely, increasing risks to the program, including opportunities for fraud. Despite these challenges, according to the U.S. Agency for International Development (USAID), U.S. humanitarian assistance has reached 4 million people inside Syria per month.
The Department of State (State), USAID, and their implementing partners have assessed some types of risk to their programs inside Syria, but most partners have not assessed the risk of fraud. Of the 9 implementing partners in GAO's sample of funding instruments, most assessed risks related to safety and security, but only 4 of 9 assessed fraud risks. Such an assessment is important as USAID's Office of Inspector General (OIG) has uncovered multiple instances of fraud affecting U.S. programs delivering humanitarian assistance to Syria. In May 2016, USAID OIG reported that 1 of its active fraud investigations resulted in the suspension of 14 entities and individuals. Given the challenging environment in Syria, fraud risk assessments could help U.S. agencies better identify and address risks to help ensure aid reaches those in need.
Partners have implemented controls to mitigate certain risks, but U.S. agencies could improve financial oversight. For example, almost all partners in our sample have controls to mitigate safety risks and some use technology to monitor the transport of goods. Additionally, U.S. agencies have taken steps to oversee activities in Syria, such as quarterly meetings with partners and spot checks of partner warehouses. Further, in October 2015, USAID hired a third party monitor to improve oversight of its activities and help verify progress of its programs. However, the monitors' training curriculum lacks modules on identifying fraud risks. Without such training, monitors may overlook potential fraud risks and miss opportunities to collect data that could help USAID improve its financial oversight.
section_title: What GAO Recommends
paragraphs: To provide more complete information to assist oversight activities, State and USAID should require their implementing partners to conduct fraud risk assessments. In addition, USAID should ensure its field monitors are trained to identify potential fraud risks and collect information on them. State and USAID concurred with GAO's recommendations.

section_title: Letter
paragraphs: The conflict in Syria has created a complex humanitarian challenge. In  May 2016, the United Nations (UN) reported that 13.5 million people  inside Syria have been affected by the conflict and are in need of  humanitarian assistance, such as food, shelter, and medicine. Since the  start of the conflict in March 2011, the United States, through the  Department of State (State) and the U.S. Agency for International  Development (USAID), has provided over $5 billion in humanitarian  assistance, about half of which has been provided for assistance to  people inside Syria. The United States is the largest international donor of  humanitarian assistance for those affected by the Syrian conflict.
We were asked to review U.S. efforts to provide humanitarian assistance  to individuals affected by the crisis in Syria. In this report we examine  humanitarian assistance provided by State, USAID, and their  implementing partners to people inside Syria, including (1) factors  affecting delivery of such assistance; (2) the extent to which State,  USAID, and their partners have assessed risks to the programs; and (3)  implementation of controls to mitigate identified risks and ensure  appropriate financial oversight of humanitarian assistance projects.
To identify factors affecting delivery of humanitarian assistance, we  reviewed UN reports and conducted interviews with officials from State,  USAID, and their implementing partners. We conducted a content  analysis of monthly United Nations Secretary General reports on the  humanitarian situation in Syria to categorize and summarize observations  contained in the reports. We also interviewed cognizant officials. To  determine the extent to which State, USAID, and their partners have  assessed risks to the programs, and to evaluate implementation of  controls to mitigate risks and ensure appropriate financial oversight of  assistance, we selected a nongeneralizable sample of 12 of 52 fiscal year  2015 State and USAID funding instruments from 9 different  implementing partners. Using these funding instruments, as well as the  Standards for Internal Control in the Federal Government and the  Committee of Sponsoring Organizations of the Treadway Commission  (COSO) Internal Control-Integrated Framework, we analyzed relevant  documents related to risk assessment and control activities, including  policies, procedures, and manuals. We also requested and reviewed risk  assessments related to delivery of assistance to people inside Syria. We  interviewed officials from State and USAID in Washington, DC, and  officials from State and implementing partner organizations in Geneva,  Switzerland. In addition, we met with officials from State, USAID, and  implementing partner organizations in Amman, Jordan; and conducted  telephone interviews with officials from USAID and implementing partner  organizations in Ankara and Antakya, Turkey, to discuss their policies and  practices regarding risk assessment and control activities. We also  conducted site visits to warehouses in Jordan maintained by two of the  implementing partners.
We conducted this performance audit from July 2015 to July 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: Estimated Numbers of People in Need within Syria
paragraphs: The ongoing conflict in Syria has created a serious humanitarian  challenge. Syrians, as well as Palestinian and Iraqi refugees residing in  Syria, have become increasingly vulnerable due to high levels of violence  and insecurity, causing many to experience multiple displacements. As of  May 2016, the UN reported that more than 4.8 million Syrians had fled the  country and registered as refugees, 6.5 million people were internally  displaced, and 13.5 million people inside Syria were in need of  humanitarian assistance. In addition, millions of people inside Syria  remain trapped in besieged and other hard-to-reach areas of the country  where delivery of humanitarian assistance, including food, is rare or  nonexistent. According to the UN, the number of people in need of  humanitarian assistance inside Syria has risen steadily since 2012, as  shown in figure 1.
section_title: Funding for and Types of Humanitarian Assistance Provided
paragraphs: U.S. funding obligated in support of humanitarian assistance for people  affected by the conflict in Syria began in fiscal year 2012 and totaled just  over $5 billion, as of February 2016, as shown in figure 2.
Approximately half of obligated funding for humanitarian assistance for  people affected by the Syrian conflict from fiscal year 2012 through fiscal  year 2015 was provided to people inside Syria, while the other half was  provided to support the more than 4.8 million people who have fled as  refugees to neighboring countries.
The U.S. agencies and offices providing humanitarian assistance to  people affected by the Syrian conflict include USAID’s Office of U.S.  Foreign Disaster Assistance (OFDA) and Office of Food for Peace (FFP),  and State’s Bureau of Population, Refugees, and Migration (PRM). From  fiscal year 2012 through fiscal year 2015, USAID has obligated a majority  of funding toward the response inside Syria—$1.7 billion for assistance  inside Syria, and $694 million for assistance in the region. State has  focused more on assistance to Syrian refugees in the region, providing  $1.6 billion for refugees in the region and $547 million for assistance to  people inside Syria, as reflected in figure 3.
The United States and the international community provide funding for a  range of humanitarian assistance inside Syria. In general, food, shelter,  nonfood items, health and nutrition, and water, sanitation and hygiene are  among the main types of humanitarian assistance provided inside the  country, reflecting the most acute needs. According to USAID, as of  February 2016, U.S. government assistance was reaching 4 million  people inside Syria per month. Figure 4 illustrates the relative amounts of  the main types of assistance provided.
Inside Syria, USAID provides funds to UN organizations and also works  through nongovernmental organizations (NGO), while State works  through three main partners—two UN organizations and one public  international organization. Humanitarian assistance provided by the  United States in response to the conflict in Syria is part of a broader  international response. Since 2013, the United States has consistently led  global funding efforts. For instance, the United States provided more than  a quarter of the total international funding for the 2015 Syria humanitarian  response. Figure 5 shows the top ten international donors to this effort in  2015.
section_title: Humanitarian Assistance Operations
paragraphs: In February 2012, the U.S. embassy in Syria suspended operations  because of concerns over staff safety due to escalating violence. Since  then, the U.S. government has coordinated Syria-related activities— including nonlethal assistance, political transition assistance, and  provision of humanitarian assistance—remotely from locations in Jordan  and Turkey through two interagency teams. The Southern Syria  Assistance Platform, based in the U.S. embassy in Jordan, and the Syria  Transition Assistance Response Team, based in the U.S. embassy and 3  other locations in Turkey, coordinate between themselves and with other  State and USAID representatives, U.S. embassies, the Department of  Defense, the governments of Jordan and Turkey, and other regional and  international entities. Along with the Southern Syria Assistance Platform  and the Syria Transition Assistance Response Team, State officials and  USAID Disaster Assistance Response Teams manage humanitarian  programs for Syria in partnership with UN agencies, international NGOs,  and national organizations.
Humanitarian assistance operations on the ground inside Syria are  heavily influenced by the ongoing conflict, which began in March 2011  when demonstrations turned into protests against the government of  Bashar al-Assad. Over the past 5 years, the conflict has grown more  complex as the number of participating armed actors has proliferated;  they now include the Syrian government, non-state opposition groups, the  Islamic State of Iraq and Syria (ISIS), and the al-Nusrah Front. In  addition, a number of other countries, including Russia, Saudi Arabia, and  Iran, have strategic interests in Syria and have been directly or indirectly  involved in the conflict. In February 2016, the United States and Russia  brokered a cessation of hostilities, excluding ISIS and the al-Nusrah  Front. According to the UN, the reduction in violence following the  cessation of hostilities agreement allowed for increased humanitarian  assistance deliveries to hard-to-reach and besieged locations in Syria  during the months of March and April 2016. However, according to State  and USAID, persistent armed conflict and aerial attacks, including attacks  on medical facilities, continue to negatively affect millions of Syrians, and  the UN reports that the resumption of active conflict in several  governorates has hindered the effective delivery of humanitarian  assistance as well as people’s access to essential services.
State’s and USAID’s implementing partners contend with the multitude of  actors as well as shifting conflict lines. In general, implementing partners  operating out of neighboring countries, mainly Jordan and Turkey, cross  the border into Syria to deliver assistance into opposition controlled  areas. UN and international organizations operating from Damascus  largely remain within Syrian government controlled areas, but may also  utilize cross-line deliveries—traveling from the Syrian government  controlled area through checkpoints into opposition controlled areas.  According to USAID, its NGO implementing partners rarely utilize cross- line deliveries. Figure 6 shows this complex operating environment.
section_title: Financial Oversight
paragraphs: Financial oversight in humanitarian assistance programs includes  managing program funds to ensure they are spent in accordance with  funding instruments by, among other things, assessing financial risks and  implementing controls to mitigate those risks, including controls to prevent  fraud and losses due to theft and diversion. Standards for Internal Control  in the Federal Government provides the overall framework for  establishing and maintaining internal control in the federal programs. In   addition, the Committee of Sponsoring Organizations of the Treadway  Commission (COSO) has issued an internal control framework that,  according to COSO, has gained broad acceptance and is widely used  around the world. Both frameworks include the five components of  internal control: control environment, risk assessment, control activities,  information and communication, and monitoring. Internal control generally  serves as a first line of defense in safeguarding assets, such as food and  nonfood items. In implementing internal control standards, management  is responsible for developing the detailed policies, procedures, and  practices to fit the entity’s operations and to ensure they are built into and  are an integral part of operations.
section_title: Three Factors Complicate the Delivery of Humanitarian Assistance to People inside Syria
paragraphs: Effective delivery of U.S. humanitarian assistance to people inside Syria  is complicated by three related factors—a dangerous operating  environment, access issues, and remote management of programs.  These factors can hinder the delivery of humanitarian assistance and,  because U.S. agency officials must manage programs from outside of  Syria, create challenges for financial oversight, such as increasing the  opportunity for fraud and diversion.
subsections: section_title: The Deterioration of the Security Environment Hinders Effective Delivery of Humanitarian Assistance
paragraphs: The increasingly violent and widespread Syrian conflict has hindered  effective delivery of humanitarian assistance. Based on our analysis of  monthly UN Secretary General (UNSG) reports on the situation inside  Syria, as well as interviews with officials providing assistance to Syria  based both inside and outside of the country, humanitarian assistance is  routinely prevented or delayed from reaching its intended target due to  shifting conflict lines, attacks on aid facilities and workers, an inability to  access besieged areas, and other factors related to active conflict.
The years of conflict have led to shifting areas of control as armed groups  claim and lose territory. In late May 2015, for example, after ISIS took  over the city of Palmyra, it reportedly seized the Syrian Arab Red  Crescent warehouse, which contained food assistance for 35,000 people  and hygiene kits for 15,000. According to USAID officials, this  represented the largest loss USAID has experienced delivering aid inside  Syria. In addition, the proliferation of armed actors has made the conflict  extremely complex. According to one NGO based in Amman and  operating in Syria, conflict lines in southern Syria that had been stable for  a number of years began shifting rapidly in February 2016 due to Russian  air strikes.
All UNSG reports from 2014 and 2015 include descriptions of  indiscriminate aerial bombardment by government forces and  indiscriminate shelling by armed opposition groups. Implementing partner  officials based in Damascus, Syria, told us that they are constantly  reaching out to contacts to determine the safety of planned delivery  routes.
Humanitarian workers inside Syria must work within the insecure  operating environment, affecting their ability to carry out their mission and  placing their lives at risk. In addition, aid facilities are often indirectly  impacted or directly targeted, leading to widespread damage. According  to the UN reports, there are frequent instances of gunfire, car bombs,  barrel bombs, rocket strikes, and mortar attacks near aid facilities; direct  attacks on medical facilities and personnel; missing or detained  humanitarian workers; and injury or death of humanitarian workers. In one  instance, an air strike hit the Syrian Arab Red Crescent offices in Idlib,  destroying ambulances and vehicles. The UN reported that, as a result,  the capacity of the Red Crescent to provide first aid services in the city  was curtailed. Medical facilities have also been attacked (see figure 7).  Physicians for Human Rights reported that as of November 2015, there  had been 336 attacks on 240 separate medical facilities and 697 medical  personnel killed inside Syria. In addition, as of the April 2016 UNSG  Report, a total of 87 humanitarian workers have been killed in Syria in the  conflict. This includes 17 staff members of the UN, 53 staff members and  volunteers of the Syrian Arab Red Crescent, 8 volunteers and staff  members of the Palestinian Red Crescent Society, and 9 staff members  of international NGOs.
section_title: Humanitarian Organizations Face Difficulties Accessing Those in Need
paragraphs: Administrative procedures put in place by the Syrian government have  delayed or limited the delivery of humanitarian assistance, according to  UNSG reports. These reports detail multiple instances of unanswered  requests for approvals of convoys, denial or removal of medical supplies  from convoys, difficulty obtaining visas for humanitarian staff, and  restrictions on international and national NGOs’ ability to operate.  According to the UNSG reports, international NGOs face restrictions,  limiting their ability to partner with national humanitarian organizations,  open suboffices, conduct missions, join interagency convoys, and  undertake independent needs assessments. One organization told us that  the Syrian government has effectively prohibited it from undertaking more  permanent activities for displaced persons inside Syria, such as  renovating and repairing community centers and other buildings.  Furthermore, in early 2016 State reported that since the beginning of  2015, the Syrian government had received 113 requests from the UN to  deliver humanitarian aid, of which 13 had been approved and  implemented.
As of May 2016, the UNSG reported that 4.6 million people inside Syria  are located in hard-to-reach areas and more than 500,000 of those  remain besieged by ISIS, the government of Syria, or non-State armed  opposition groups. Parties to the conflict heavily restrict or deny  humanitarian access to besieged areas, and people risk infectious  disease, malnutrition, poor sanitation, and lack of medical care. For  example, in early 2016, the UN estimated that the lives of roughly 42,000  people remained besieged by government forces in the towns of Madaya  and Buqayn, where, according to the UN, deaths from diseases  associated with malnutrition had been reported. Furthermore, the UN  reported that in 2015, only 10 percent of all requests for UN inter-agency  convoys to hard-to-reach and besieged areas were approved and  delivered. In addition, according to implementing partner officials based in  Damascus, even when these convoys were approved, the officials  participating in delivering the assistance were sometimes subjected to  hours-long delays, stretching into the middle of the night.
State’s and USAID’s implementing partners also told us that they rarely  operate inside ISIS controlled areas because they cannot ensure that  they will be able to operate within the humanitarian principles of humanity,  impartiality, neutrality, and operational independence. The UNSG reports  contain multiple instances of ISIS blocking humanitarian and commercial  access into and through areas under its control. For example, in  November 2015, the UN reported that ISIS controlled and blocked  humanitarian access to a stretch of highway leading to the western parts  of Aleppo city. As a result, the UN was unable to deliver assistance to  over 220,000 people.
section_title: Remote Management Creates Challenges for Financial Oversight of Humanitarian Assistance Delivered inside Syria
paragraphs: Due to restrictions, USAID and State staff manage the delivery of  humanitarian assistance in Syria remotely from neighboring countries.  The U.S. government closed its embassy in Damascus in 2012 due to  security conditions and the safety of personnel, among other factors.  According to State and USAID officials, the inability to access Syria limits  the visibility that staff have over the provision of humanitarian assistance,  including program monitoring and financial oversight. USAID officials  noted, for instance, that unlike humanitarian responses conducted in  other countries, including those in conflict situations like Afghanistan or  Iraq, USAID staff are unable to visit project sites in Syria and speak with  program beneficiaries. USAID officials also acknowledged several gaps in  their monitoring system due to remote management, such as verifying  progress, obtaining comprehensive monitoring data on individual  activities, and assessing the quality of monitoring data reported to USAID.
In the absence of direct program monitoring, USAID and State officials  noted that they utilize information provided by implementing partners to  help ensure effective delivery of assistance and to help their financial  oversight, including mitigating risks such as fraud, theft, diversion, and  loss. However, USAID officials in the region explained to us that while  partners provide data and information, their inability to consistently  access project sites—due to factors such as ongoing fighting, bombing  raids, and border closures—limited the extent to which partners could  obtain and verify progress. Similarly, staff from several USAID-funded  implementing partners told us they were unable to access project sites in  southern Syria, and relied on volunteers or paid NGO and subawardee  staff to operate, monitor, and disseminate information on project status.
Past audit work has shown challenges to such an approach, including  cases of partners not fully implementing monitoring practices, resulting in  limited project accountability. Further, USAID Office of Inspector General  (OIG) has reported that assistance projects implemented in developing  countries are at significant risk of fraud, waste, and abuse, and further  noted that those risks are multiplied when projects unfold during a  disaster or military contingency. Specifically, the USAID OIG has noted  that aid organizations providing life-saving assistance in Syria and the  surrounding region face an extremely high-risk environment, and that the  absence of adequate internal controls, among other challenges, can  jeopardize the integrity of these relief efforts and deny critical aid to those  in need.
section_title: U.S. Agencies Do Not Require Comprehensive Risk Assessments from Implementing Partners and Most Partners Have Not Assessed Risks of Fraud
paragraphs: State and USAID do not require implementing partners to conduct  comprehensive risk assessments for humanitarian assistance delivered to  people inside Syria, and while most partners assessed safety and  security risks associated with such programs, most did not assess  financial risks, such as the risk of fraud. In the absence of such a  requirement, USAID drafts memoranda highlighting potential risks for  material support to terrorist groups and identifies the mitigation strategies  implementing partners will use to reduce those risks. In addition, State  asks its implementing partners to have internal control policies in place  and report information on certain risks. U.S. humanitarian assistance  programs in Syria have experienced instances of fraud, and without such  formal assessments, implementing partners may not have all information  needed to design appropriate controls to mitigate such risks. Moreover,  U.S. agency officials charged with overseeing these programs may not  have visibility into areas of risk, such as fraud and loss due to theft and  diversion.
subsections: section_title: U.S. Agencies Do Not Require Comprehensive Risk Assessments for Humanitarian Assistance to People inside Syria
paragraphs: Neither USAID nor State requires implementing partners to conduct  comprehensive risk assessments for humanitarian assistance to people  inside Syria. Risk assessment involves comprehensively identifying risks  associated with achieving program objectives; analyzing those risks to  determine their significance, likelihood of occurrence, and impact; and  determining actions or controls to mitigate the risk. GAO’s Standards for  Internal Control in the Federal Government and COSO’s internal control  framework both state that entities should comprehensively identify risks at  both the entity-wide and activity levels.
While USAID requires implementing partners operating humanitarian  assistance programs to people inside Syria to assess certain types of  risk, it does not require these partners to create and maintain a  comprehensive risk assessment for all relevant risks—which in this  context could include theft and diversion; fraud; safety; security; program  governance; and implementing partner capacity risks. USAID’s Office of  Food for Peace (FFP) and Office of U.S. Foreign Disaster Assistance  (OFDA) require some implementing partners to create a Safety and  Security Plan, which addresses security threats and vulnerabilities related  to program locations and provides information such as contingency  planning and risk mitigation measures. Moreover, in response to a GAO  recommendation, FFP updated its program guidance in March 2015 to  state that partners applying to conduct cash transfer and voucher-based  food assistance programs should include in their applications an  assessment of the risk of fraud or diversion. According to USAID, this  represents a requirement that cash transfer and voucher-based food  assistance programs conduct a fraud risk assessment, although it does  not apply to all types of food assistance or to assistance provided through  OFDA. In the absence of a requirement for all implementing partners to  conduct comprehensive risk assessments, USAID noted that it works  closely with partners to ensure accountability and to ensure that  assistance is reaching beneficiaries. For instance, according to USAID,  while USAID does not have Syria-specific policies and guidance  regarding risk assessments related to fraud, it has noted fraud risks in its  Syria program related to the procurement process and partners have  worked to address them. Relatedly, USAID officials noted that USAID has  also implemented a process for documenting risks associated with  programs in Syria through drafting memoranda highlighting potential risks  for material support to terrorist groups and identifying the mitigation  strategies implementing partners will use to reduce those risks.
State’s humanitarian assistance to people inside Syria is funded through  voluntary contributions to public international organizations, and neither  the funding instruments for these contributions nor State’s Federal  Assistance Policy Directive require the implementing partner to conduct  comprehensive risk assessments specifically related to the assistance.  While there is not a requirement, according to State, it has established  framework agreements with its implementing partners emphasizing the  commitment of the partner to internal controls, including risk  management. For example, State officials noted that the framework  agreement for one of its implementing partners is updated every two  years and tracks the progress of the organization’s efforts to develop  enterprise risk management. According to State, the basis of State’s  funding arrangements is that partner organizations should follow their  own internal requirements for risk assessments, not only for State funding  but for all contributions. However, the voluntary contribution agreements  between State and these implementing partners do not reference the  framework agreements or require comprehensive risk assessments.  Moreover, acknowledging the need for additional information from  partners operating in Syria, State has agreements with its implementing  partners, called enhanced monitoring plans, asking implementing  partners to regularly provide information on current conditions, including  assessments of the risks of diversion and harm to staff. While collecting  additional information on certain risks, the enhanced monitoring plans do  not require implementing partners to conduct comprehensive risk  assessments.
section_title: Most Implementing Partners Have Identified and Assessed Safety and Security Risks to Effective Aid Delivery inside Syria, But Most Have Not Assessed Risk of Fraud
paragraphs: All of the implementing partners in our sample have policies, procedures,  or guidance related to conducting risk assessment for their programs to  provide humanitarian assistance into Syria, including safety and security  checklists, risk registers, and other tools for conducting various types of  risk assessments. Nearly all of implementing partners in our sample  (seven of nine) have policies, procedures or guidance specifically aimed  at assessing risks of fraud, such as antifraud policies, procurement  manuals, and risk assessment procedures for subawards.
Similarly, most of the implementing partners have conducted formal risk  assessments for at least one type of risk, and several maintain risk  registers that assess a wide variety of risks. For example, one  implementing partner maintains a risk register that is updated on a  quarterly basis and contains an analysis of ten categories of risk, such as  funding, program governance, and logistics. Another partner based in  Damascus has a risk register which, according to the partner, assesses  28 different risks. As shown in table 1, most implementing partners have  conducted risk assessments for staff safety risks (seven of nine) or  security risks (eight of nine). However, few implementing partners have  conducted risk assessments for the risk of fraud (four of nine), or for the  risk of loss due to theft or diversion (four of nine). According to GAO’s A  Framework for Managing Fraud Risks in Federal Programs,  effective  fraud risk management involves fully considering the specific fraud risks  the agency or program faces, analyzing the potential likelihood and  impact of fraud schemes, and prioritizing fraud risks. In addition, risk  assessment is essential for ensuring that partners design appropriate and  effective control activities. Control activities to mitigate the risk of fraud  should be directly connected to the fraud risk assessments, and over  time, managers may adjust the control activities if they determine that  controls are not effectively designed or implemented to reduce the  likelihood or impact of an inherent fraud risk to a tolerable risk level.
Although most of the implementing partners in our sample did not conduct  assessments of the risk of fraud, there are elevated risks for fraud in U.S.  funded humanitarian assistance projects for people inside Syria. For  instance, in the second half of fiscal year 2015, the USAID OIG received  47 complaints reporting waste, fraud, and abuse in USAID programs  related to the crises in Syria and Iraq. According to officials at the USAID  OIG, they have four ongoing investigations of allegations of fraud and  mismanagement related to programs for delivering humanitarian  assistance to people inside Syria. Two of the investigations involve  allegations of procurement fraud, bribery, and product substitution in  USAID funded humanitarian cross-border programs related to  procurements of non-food items. One of the investigations found that the  subawardee of the implementing partner failed to distribute nonfood items  in southern Syria, instead subcontracting the distribution to another  organization, but nevertheless billed USAID for the full cost of the project.  Additionally, the subawardee was reliant on one individual to facilitate the  transfer of materials and salaries, and this individual was involved in the  alteration and falsification of records related to the distribution of the  nonfood items. According to the USAID OIG, senior leadership at the  subawardee was aware of these facts. Further, in May 2016, USAID  OIG reported the identification of bid-rigging and multiple bribery and  kickback schemes related to contracts to deliver humanitarian aid in  Syria, investigations of which resulted in the suspension of 14 entities and  individuals involved with aid programs from Turkey. Without documented  risk assessments, implementing partners may not have all of the  information needed to design appropriate controls to mitigate fraud risks,  and State and USAID may not have visibility into areas of risk, such as  fraud and loss due to theft and diversion.
section_title: Partners Have Implemented Controls for Delivering Humanitarian Assistance inside Syria, but U.S. Agencies Could Improve Oversight
paragraphs: Implementing partners in our sample have developed and implemented  controls over their programs delivering humanitarian assistance to people  inside Syria. Despite these controls, the inability of some partners to  consistently access areas in Syria and directly monitor programs has  created challenges for oversight. To help address these issues, U.S.  agencies have taken some steps to oversee partner programs;  nevertheless, opportunities to assess and mitigate the potential impact of  fraud risks remain.
subsections: section_title: Partners Have Developed and Implemented Controls to Mitigate Risks
paragraphs: Implementing partners in our sample have developed and implemented  controls over their programs that deliver humanitarian assistance to  people inside Syria. For those partners that had conducted risk  assessments, these controls generally responded to risks they had  identified. See table 2.
We found that partners in our sample had implemented controls to  account for safety and security risks to their personnel and beneficiaries  receiving assistance in Syria. For example, some implementing partners  identified aerial targeting of humanitarian aid workers and beneficiaries at  distribution points as a major vulnerability, and implemented controls to  mitigate this risk, such as distributing goods to beneficiaries on overcast  days and making door to door deliveries of aid packages. Another partner  with field sites in Damascus identified the risk of ambush as a  vulnerability and provided its drivers with instructions on taking evasive  actions and fleeing to safety.
Partners in our sample had also implemented controls to mitigate risks of  fraud and loss within their operations; however, the majority of these  efforts were not informed by a risk assessment. Four of the nine partners  in our sample conducted cross-border delivery operations from  neighboring countries such as Turkey or Jordan and, therefore, procured  goods in the host country or the region and warehoused them prior to  transport into Syria. Officials from two implementing partners we  interviewed in Amman stated that they conducted spot checks of  assistance packages in warehouses to confirm the quantity of the  contents and ensure that the quality of the items complied with the terms  of the contract. According to another implementing partner, officials from  its organization visit the vendor warehouses before signing contracts to  verify that U.S. government commodity safety and quality assurance  guidelines are met. In addition, partners used documentation such as  packing slips and waybills to verify the contents of shipments. Once  parcels arrived at warehouses in Syria, partners we interviewed stated  that staff used technology, such as geotagged photographs, to document  the arrival and contents of the shipment. Nonetheless, these partners  stated that the lack of visibility over the assistance while in transit in Syria,  and managing the projects remotely from Jordan, were risks to their  operations and therefore required mitigating actions. Furthermore,  partners we interviewed that relied on transporters to deliver assistance  within Syria mitigated the risk of loss—including loss due to theft by the  Syrian Army or armed opposition groups at checkpoints—by shifting  liability to the transporter and only paying for parcels that were delivered  to the intended destinations. According to one of the partners, the shift of  liability to the transporter has limited the instances of diversion, although  we did not confirm this.
Partners also implemented controls to mitigate fraud risks during the  distribution process. For example, partners developed criteria for  identifying and selecting eligible beneficiaries, and compiled this  information into beneficiary lists to assist the process. Examples of people  meeting selection criteria included internally displaced people, people  with disabilities, and female heads of household. In addition, partners  mentioned working with local councils to develop beneficiary lists.  Officials at a partner organization we interviewed stated that during the  distribution process, staff crosschecked the names of beneficiaries on the  list with identification provided by the beneficiary, and then relayed that  information to the partner’s field office in Jordan for verification. Officials  added that this method for verifying beneficiaries was an ongoing  process, as the lists sometimes changed due to the movement of people.
Two implementing partners that we visited in Jordan, who delivered food  and medical supplies, among other types of assistance in southern Syria,  provide examples of the types of controls implemented.
Emergency food items. By 2015, USAID had awarded roughly $50  million to an international NGO to deliver emergency food items to  beneficiaries in southern Syria. We visited the organization’s  warehouse and observed officials randomly select parcels for  inspection to verify the quantity and quality of the contents.
Medical supplies. In fiscal year 2015, USAID awarded about $16  million through a cooperative agreement to an international NGO to  deliver medical supplies and equipment in southern Syria to support  health-related infrastructure, such as clinics, among other types of aid  and services. In Jordan, we visited their warehouse where supplies  were received, checked for quality, affixed with quick response (QR)  codes, and packaged, as shown in figure 8.
section_title: U.S. Agencies Have Taken Steps to Oversee Partner Programs but Could Strengthen Fraud Oversight Steps Taken to Oversee Partner Programs
paragraphs: State and USAID have taken steps to oversee partner programs  delivering humanitarian assistance inside Syria. State officials noted that  State conducts a variety of oversight activities. For instance, State  officials in the region conduct quarterly meetings with partners and collect  information on programmatic objectives and on partner programs. State  also has enhanced monitoring plans in place with its implementing  partners to augment quarterly reporting with information on risks of  diversion of assistance. State officials also told us that they ask partners  to notify them upon discovering incidents of diversion. For example, one  implementing partner provided frequent updates to State on losses it  sustained from its transporters until the issue was resolved.
Similarly, USAID officials provided information on several measures taken  to oversee programs implemented by partners. For example, USAID  officials we spoke with in Washington explained that officials screen  proposals from prospective partners to identify those that have  appropriate measures to mitigate risks and operate in a hazardous  environment such as Syria. They added that USAID officials in the region  maintain regular contact with partners, attend monthly meetings with  them, conduct random spot checks of aid packages at warehouse  facilities, and coordinate activities among partners to reduce or eliminate  duplication or overlap of assistance. USAID officials in the region also  receive quarterly reports from partners to monitor progress before  submitting them to USAID headquarters for additional review. USAID also  noted that it has implemented an informal biweekly reporting system for  all partners to provide reports notifying USAID of any challenges or  potential risks facing the partner in the preceding two weeks. According to  USAID officials in Washington, USAID officials in the region are the  immediate officials to oversee programs and detect incidents of fraud;  and, USAID officials in the region explained that the USAID OIG has  conducted fraud awareness training for officials in the region to improve  their ability to detect fraud, such as product substitution, when they  conduct spot checks of aid packages at warehouse facilities. Further, in  October 2015, USAID’s OFDA hired a third party monitoring organization  to review its projects in Syria. By February 2016, field monitors had  conducted site visits and submitted monitoring reports to USAID,  providing information on the status of projects and including major  concerns that field monitors identified.
subsections: section_title: Fraud Oversight Could Be Strengthened
paragraphs: Based on our analysis, USAID’s third party monitoring contract and  supporting documentation contain guidelines for verifying the progress of  activities in Syria; however, they do not clearly instruct field monitors to  identify potential fraud risks as they conduct site assessments of projects  in Syria. Furthermore, the monitoring plan and site visit templates do not  contain specific guidance on how to recognize fraud, and field monitors  have not received the USAID OIG fraud awareness training, according to  USAID officials. Leading practices in fraud risk management suggest  evaluating outcomes using a risk-based approach and adapting activities  to improve fraud risk management. This includes conducting risk-based  monitoring and evaluation of fraud risk management activities with a  focus on outcome measurement, and using the results to improve  prevention, detection, and response.
The monitoring plan associated with the contract contains guidelines for  field monitors to document their assessment of the project at the  completion of a site visit. However, it lacks specific guidelines to identify  potential fraud risks during site visits. For example, the guidelines in the  monitoring plan instruct field monitors to use color-coded indicators, one  of which states that issues at a project site require immediate attention  and action, such as highly significant implementation problems, fraud,  diversion, or other highly concerning findings. While fraud is mentioned  with the indicator, it is presented as one of several examples of highly  concerning findings to document, and could potentially be overlooked by  the field monitor. Additionally, the templates created by the third party  monitoring organization to document site visits instruct monitors to verify  the presence or absence of supplies, and the quality of them, among  other instructions. For example, templates we reviewed related to water  and sanitation projects instructed field monitors to verify that water was  delivered to a location, and that water quality tests had been conducted,  when applicable, among other things. However, the template lacks  specific indicators to alert field monitors to collect information on and  identify potential fraud. Furthermore, the monitoring plan contains a  training curriculum for field monitors, which has several objectives  designed to familiarize them with the protocols, procedures, and  instruments used for data collection and reporting. For example, training  categories in the curriculum include basic monitoring and verification  vocabulary, sampling of records and other secondary data, and color  coding issues of concern. However, the curriculum lacks specific courses  for recognizing potential or actual instances of fraud that may occur on  site. Additionally, USAID officials told us that the field monitors supporting  the third party monitoring contract had not received fraud awareness  training from USAID OIG, which has been provided to other implementing  partners with which USAID works to provide humanitarian assistance to  people in Syria. Given the opportunity for fraud that exists in humanitarian  assistance programs, as well as the ongoing USAID OIG investigations,  without instructions to specifically collect data on fraud and training to  identify it, USAID may be missing an opportunity to assist in its activities  to mitigate fraud risks and design appropriate controls.
section_title: Conclusions
paragraphs: The ongoing conflict in Syria has created a complex humanitarian  emergency. As the largest donor, the United States has taken a leading  role in providing humanitarian assistance to alleviate the suffering of  individuals inside Syria who are affected by the conflict and delivers  assistance to millions per month. Given the significant challenges of  providing humanitarian assistance in a conflict zone, as well as State and  USAID’s inability to directly monitor programs inside Syria, the importance  of financial oversight—which includes conducting risk assessments to  identify, analyze, and respond to risks and implementing appropriate  controls—is elevated. Despite the fact that fraud has been detected in  these assistance programs, most of the partners in our sample did not  assess fraud risks. Further, while USAID’s third party monitoring contract  provides a mechanism to gather additional information about its programs  in Syria, providing clearer instructions to collect data on and training to  recognize fraud risks may better assist USAID in its efforts to mitigate  fraud. In the absence of such activities, fraudulent practices may go  unnoticed or take longer to detect. In addition, State and USAID may not  have visibility into areas of risk needed to effectively oversee programs  and provide reasonable assurance that humanitarian assistance funding  is being used for its intended purpose—to assist individuals in desperate  need inside Syria.
section_title: Recommendations for Executive Action
paragraphs: To improve the financial oversight of U.S. programs to provide  humanitarian assistance to people inside Syria, we recommend that the  USAID Administrator take the following four actions:
Update guidance to require non-governmental organizations to  conduct risk assessments addressing the risk of fraud.
Use risk assessments submitted by implementing partners to inform  USAID oversight activities, for example, using information from  assessments to ensure that control activities for programs are  designed to mitigate identified risks.
Ensure that field monitors in Syria are trained on assessing and  identifying potential fraud risks.
Instruct the third party monitoring organization monitoring OFDA  programs in Syria to modify the site visit forms to include specific  guidance for documenting incidents of potential fraud.
To ensure that State has a comprehensive understanding of the risks  facing its implementing partners providing humanitarian assistance to  people inside Syria, we recommend that the Secretary of State take the  following action:  Include in its voluntary contribution agreements with implementing  partners a requirement that the partner conduct risk assessments  addressing the risk of fraud.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to State and the USAID for review and  comment. State and USAID provided written comments that are  reproduced in appendix II and appendix III. State and USAID also  provided technical comments, which we incorporated as appropriate.
In its written comments on our report, State concurred with our  recommendation. State noted risk assessment initiatives that it has in  place with its implementing partners, and indicated that it would include  provisions in future voluntary contribution agreements with its  implementing partners that refer to risk assessment requirements,  including fraud.
USAID also concurred with our recommendations, noting it has  developed checklists to address fraud mitigation and will soon update its  guidance to require its implementing partners to submit fraud mitigation  plans to USAID. Related to our recommendation to provide training to  field monitors, USAID noted that its third party monitoring in Syria is not  intended to serve an auditing function or investigate allegations of fraud,  but noted that USAID could work with the third party monitor to ensure  that its field monitors are trained in methods to identify fraud risks. We  agree that the field monitors do not audit the program, but they provide a  crucial on the ground presence in areas unavailable to U.S. government  employees. Based on USAID’s comments, we clarified the language of  this recommendation.
We are sending copies of this report to appropriate congressional  committees, the Secretary of State, the Administrator of USAID, and other  interested parties. In addition, the report will be available at no charge on  the GAO website at http://www.gao.gov.
If you or your staffs should have any questions about this report, please  contact me at (202) 512-9601 or melitot@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix IV.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: You asked us to review U.S. efforts to provide humanitarian assistance to  individuals affected by the conflict in Syria. In this report we examine  humanitarian assistance provided by the Department of State (State), the  U.S. Agency for International Development (USAID), and implementing  partners to people inside Syria, including (1) factors affecting delivery of  such assistance; (2) the extent to which State, USAID, and their partners  have assessed risks to the programs; and (3) implementation of controls  to mitigate identified risks and ensure appropriate financial oversight of  humanitarian assistance projects.
To identify factors affecting delivery of humanitarian assistance, we  conducted a content analysis of all monthly United Nations Secretary  General (UNSG) reports on the humanitarian situation in Syria from  March 2014, when the reports began, through December 2015, to  categorize and summarize observations contained in the reports. The  reports, which are submitted to the Security Council pursuant to  Resolution 2139 (2014), provide information on the humanitarian situation  in Syria and on the implementation of the key elements of Resolution  2139, including the extent to which the parties to the conflict are allowing  humanitarian relief organizations to access people in need inside the  country. We also conducted interviews with officials from State  (Population, Refugees, and Migration), and USAID (the Office of U.S.  Foreign Disaster Assistance and Food for Peace), in Washington, D.C.;  and we interviewed USAID and implementing partner officials based in  Antakya and Ankara, Turkey. In addition, we traveled to Geneva,  Switzerland, and Amman, Jordan to interview officials from State, USAID,  and implementing partner organizations.
To determine the extent to which State, USAID, and their partners have  assessed risks to the programs, we selected a nongeneralizable sample  of 12 fiscal year 2015 State and USAID funding instruments, out of a total  of 52 funding instruments, from 9 different implementing partners.  Specifically, we obtained a list of all funding instruments from State and  USAID based on the following criteria: (1) The funding instrument was  awarded by State’s Bureau of Population, Refugees and Migration, or  USAID’s Office of U.S. Foreign Disaster Assistance or Office of Food for  Peace; (2) the funding instruments were obligated in fiscal year 2015; and  (3) the implementing partner was based in Syria or a neighboring country  from which cross-border operations into Syria were conducted. While the  results of our review of funding instruments cannot be generalized to the  entire list, they present a mix of instrument dollar values, implementing  partners and their locations, and types of humanitarian assistance. Using  these funding instruments, as well as the Standards for Internal Control in  the Federal Government and the Committee of Sponsoring  Organizations of the Treadway Commission (COSO) internal control  framework, we analyzed relevant documents from each of the  organizations related to risk assessment, including policies, procedures,  and manuals. We also requested and reviewed risk assessments related  to delivery of assistance to people inside Syria. We interviewed State and  USAID officials in Washington, DC; and officials from State and  implementing partner organizations in Geneva, Switzerland. We also met  with officials from State, USAID, and implementing partner organizations  in Amman, Jordan; and conducted telephone interviews with officials in  Antakya and Ankara, Turkey, to discuss their policies and practices  regarding risk assessments.
To evaluate implementation of controls to mitigate risks and ensure  appropriate financial oversight of assistance, we used our  nongeneralizable sample of 12 fiscal year 2015 State and USAID funding  instruments, as well as the Standards for Internal Control in the Federal  Government and the COSO internal control framework, to analyze  relevant documents from each of the organizations related to control  activities, including policies, procedures, and manuals. To determine the  extent to which U.S. agencies are overseeing the activities of  implementing partners, we interviewed officials from State and USAID in  Washington, D.C. and Amman, Jordan. We also reviewed USAID’s  contract with the third party monitoring organization, and supporting  documentation, such as the monitoring plan, site visit template, and a  complete monitoring report for February 2016. We interviewed officials  from State, and USAID in Washington, DC, and officials from State and  implementing partner organizations in Geneva, Switzerland. In addition,  we met with officials from State, USAID, and implementing partner  organizations in Amman, Jordan; and conducted telephone interviews  with officials from USAID and implementing partner organizations in  Ankara and Antakya, Turkey, to discuss their policies and practices  regarding control activities. We also conducted site visits to warehouses  in Jordan maintained by two of the implementing partners.
We conducted this performance audit from July 2015 to July 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Department of State
section_title: Appendix III: Comments from the U.S. Agency for International Development
subsections: section_title: GAO Comments
paragraphs: 1.  Related to our recommendation to provide training to field monitors,  USAID noted that its third party monitoring in Syria is not intended to  serve an auditing function or investigate allegations of fraud, but noted  that USAID could work with the third party monitor to ensure that its  field monitors are trained in methods to identify fraud risks. We agree  that the field monitors do not audit the program, but they provide a  crucial on the ground presence in areas unavailable to U.S.  government employees. Based on USAID’s comments, we clarified  the language of this recommendation.
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact:
section_title: Staff Acknowledgments:
paragraphs: In addition to the contact named above, Elizabeth Repko (Assistant  Director), Jennifer Young, Justine Lazaro, Cristina Norland, Kyerion  Printup, Karen Deans, Kimberly McGatlin, Diane Morris, Justin Fisher,  and Alex Welsh made key contributions to this report.