Immigrant Investor Program: Progress Made to Detect and Prevent Fraud, but Additional Actions Could Further Agency Efforts
Published: 2016-09-13T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Congress created the EB-5 visa category to promote job creation and capital investment by immigrant investors in exchange for lawful permanent residency and a path to citizenship. Participants must invest either $500,000 or $1 million in a business that is to create at least 10 jobs. Upon meeting program requirements, immigrant investors are eligible for conditional status to live and work in the United States and can apply to remove the conditional basis of lawful permanent residency after 2 years. In August 2015, GAO reported on weaknesses in certain USCIS fraud mitigation activities, and made two related recommendations.
GAO was asked to review actions taken by USCIS to address fraud risks in the EB-5 program since its August 2015 report. This report examines the extent to which USCIS (1) has taken steps to enhance its fraud detection and mitigation efforts; and (2) has incorporated selected leading fraud risk management practices into its efforts. GAO reviewed relevant program documentation and information; selected and reviewed a random, nongeneralizable sample of immigrant investor petitions and regional-center applications submitted between fiscal years 2010 and 2014; and compared USCIS's actions against GAO's Fraud Risk Framework.
section_title: What GAO Found
paragraphs: The Department of Homeland Security's U.S. Citizenship and Immigration Services (USCIS) has recently taken steps intended to enhance fraud detection and mitigation activities for the Employment-Based Fifth Preference Immigrant Investor Program (EB-5 Program) and address previous GAO recommendations.
This includes actions such as conducting and planning additional risk assessments to gather additional information on potential fraud risks to the program. For example, USCIS is leveraging overseas staff to investigate potential fraud associated with unlawful sources of immigrant investor funds and is conducting a site visit pilot to help assess the potential risks of fraud among EB-5 program investments. USCIS is also taking steps to collect more information about EB-5 program investments and immigrant investors through new, revised forms and expanding its use of background checks, among other things, to help improve its ability to identify specific incidence of fraud. However, fraud mitigation in the EB-5 Program is hindered by a reliance on voluminous paper files, which limit the agency's ability to collect and analyze program information. In its review of a nongeneralizable selection of files associated with EB-5 program regional centers and immigrant investors, GAO found that identifying fraud indicators is extremely challenging. For example, many of these files were several thousand pages long and would take significant time to review. According to USCIS documentation, the program anticipates receiving approximately 14 million pages of supporting documentation from its regional-center applicants and immigrant investor petitioners annually. Recognizing these limitations, USCIS has taken preliminary steps to study digitizing and analyzing the paper files submitted by petitioners and applicants to the program, which could help USCIS better identify fraud indicators in the program; however, these efforts are in the early stages.
USCIS has incorporated selected leading fraud risk management practices into its efforts but could take additional actions to help guide and document its efforts. GAO's Fraud Risk Framework is a set of leading practices that can serve as a guide for program managers to use when developing efforts to combat fraud in a strategic, risk-based manner. USCIS's actions align with two key components of the Fraud Risk Framework: (1) commit to combating fraud by creating an organizational culture and structure conducive to fraud risk management such as by providing specialized fraud awareness training; and (2) assess risks by planning and completing regular fraud risk assessments. However, USCIS has not developed a fraud risk profile, an overarching document that guides its fraud management efforts, as called for in the Fraud Risk Framework. Instead, USCIS's risk assessments, spanning multiple years, were developed as separate documents and reports, and there is not a unifying document that consolidates and systematically prioritizes these findings. Without a fraud risk profile, USCIS may not be well positioned to identify and prioritize fraud risks in the EB-5 Program, ensure the appropriate controls are in place to mitigate fraud risks, and implement other Fraud Risk Framework components.
section_title: What GAO Recommends
paragraphs: GAO recommends that USCIS develop a fraud risk profile that aligns with leading practices identified in GAO's Fraud Risk Framework. The Department of Homeland Security concurred with GAO's recommendation.

section_title: Letter
paragraphs: As part of the Immigration Act of 1990, Congress created an employment- based immigrant visa category to promote job creation and encourage  capital investment in the United States by foreign investors in exchange  for lawful permanent residency and a potential path to citizenship. This  category, commonly referred to as Employment-Based Fifth Preference  (EB-5), is for employment creation by qualified immigrants seeking to  enter the United States to engage in a new commercial enterprise. Upon  meeting certain EB-5 Program requirements—including investing $1  million (or $500,000 in targeted employment areas) in a new commercial  enterprise that will result in the creation of at least 10 full-time jobs— immigrant investors and their eligible dependents may receive 2-year  conditional lawful permanent resident status to live and work in the United  States. Within the 90-day period prior to the second anniversary of the  date on which an immigrant investor obtained conditional status, he or  she can apply to remove the conditional basis of his or her lawful  permanent resident status.
Within the Department of Homeland Security’s (DHS) U.S. Citizenship  and Immigration Services (USCIS), the Immigrant Investor Program  Office (IPO), administers the EB-5 Program. The office adjudicates  applications and petitions while striving to ensure that program  participants, including immigrant investors and principals operating U.S.  regional centers, comply with program requirements. USCIS also has a  Fraud Detection and National Security (FDNS) unit charged with  preventing, detecting, and responding to allegations of fraud in the  program.
In August 2015, we issued a report on fraud risks and the measurement  of economic benefits for the EB-5 program. With respect to fraud risks,  we found that USCIS had identified some unique fraud risks including  uncertainties in verifying that the funds invested were obtained lawfully  and various investment-related schemes to defraud investors, which are  generally not present in other types of immigration programs. We also  found that USCIS had taken steps to improve fraud prevention and  detection such as creating an organizational structure conducive to fraud  risk management and establishing a dedicated entity to design and  oversee its fraud risk management activities. However, we found that  limitations in USCIS’s information collection and use hampered its ability  to detect and mitigate fraud risks. We therefore recommended, among  other things, that USCIS plan and conduct regular future fraud risk  assessments of the EB-5 Program, and develop a strategy to expand  information collection, including considering the increased use of  interviews as well as requiring the additional reporting of information by  those seeking to participate or actively participating in the program. DHS  concurred with both of these recommendations and, as will be discussed  later in this report, has taken steps to conduct additional risk assessments  and to collect additional information such as through revised petition and  application forms.
Following the issuance of our August 2015 report, you asked us to  conduct additional work evaluating fraud-detection efforts in the program  and steps taken by USCIS to manage these risks. This report addresses  the extent to which USCIS (1) has taken steps to enhance its fraud- detection efforts and (2) has incorporated selected leading fraud risk  management practices into its efforts.
To determine the extent to which USCIS has taken steps to enhance its  fraud-detection efforts, we met with officials with USCIS’s IPO and FDNS,  and reviewed relevant documentation, such as risk assessments and  policies and procedures guiding these efforts. We reviewed actions taken  by USCIS to improve fraud-detection efforts since our August 2015  report, including those steps taken to respond to our recommendations.  To gather additional information and context, and to understand how  immigrant investor petitions and regional-center applications can be used  for identifying indications of fraud, we conducted a targeted file review of  immigrant investor petitions and regional-center applications adjudicated  by USCIS. Specifically for the immigrant investors, we identified and  reviewed a random, nongeneralizable sample of 10 petitions based on a  universe of those that had been denied removal of the conditional basis of  their lawful permanent resident status from fiscal years 2010 through  2014. For the regional centers, we identified and reviewed a random,  nongeneralizable sample of 10 applications based on a universe of  regional centers that were currently identified as having some  adjudication issues, including some with known incidences of fraud. For  each file review, we reviewed the completed forms and supporting  evidence provided by the applicants or petitioners, as well as associated  records of USCIS’s adjudication.
To determine the extent to which USCIS has incorporated selected  leading fraud risk management practices into its efforts, we compared  USCIS’s practices to those identified in GAO’s A Framework for  Managing Fraud Risks in Federal Programs (Fraud Risk Framework).  Issued in July 2015, GAO’s Fraud Risk Framework is a comprehensive  set of leading practices that serves as a guide for program managers to  use when developing efforts to combat fraud in a strategic, risk-based  manner. The framework describes leading practices for (1) establishing  an organizational structure and culture that are conducive to fraud risk  management; (2) assessing the likelihood and effect of fraud risks; (3)  developing, documenting, and communicating an antifraud strategy,  focusing on preventive control activities; and (4) collecting and analyzing  data from reporting mechanisms and instances of detected fraud for real- time monitoring of fraud trends, and use the results of monitoring,  evaluations, and investigations to improve fraud prevention, detection,  and response. On June 30, 2016, the Fraud Reduction and Data  Analytics Act of 2015 was enacted. Among other things, the act requires  that the Office of Management and Budget, in consultation with the  Comptroller General of the United States, establish guidelines for  agencies to establish financial and administrative controls to identify and  assess fraud risks and design and implement control activities in order to  prevent, detect, and respond to fraud. The act also requires that these  guidelines be established within 90 days of enactment and that they  incorporate leading practices identified in the Fraud Risk Framework. We  met with agency officials from FDNS and IPO and reviewed documents  including policies and procedures, and assessed how USCIS was  following selected components we outline for managing fraud risks. We  compared activities at USCIS to two of the four components of the Fraud  Risk Framework, specifically whether the organization was committing to  combating fraud by creating an organizational culture and structure  conducive to fraud risk management, and whether the organization was  planning regular fraud risk assessments and assessing risks to determine  a fraud risk profile (components 1 and 2 of the Fraud Risk Framework).  We limited our review to these two components, because the Fraud Risk  Framework was recently issued by GAO and because USCIS would need  to address these first two components before it would be able to address  the remaining two components.
We conducted this performance audit from November 2015 to September  2016 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: EB-5 Program
paragraphs: Under the EB-5 Program Regional Center model, first enacted as a pilot  program in 1992 and reauthorized numerous times since, a certain  number of the EB-5 visas are set aside annually for immigrant investors  investing within economic units called regional centers, which are  established to promote economic growth. Most recently, the EB-5  Program Regional Center model was extended until September 30,  2016. Immigrant investors can choose to invest on their own or with  others directly in a business, or they may use a regional center to pool  their investment with those of other immigrant investors and other foreign  and U.S. investors to develop larger projects owned and managed by  others. Immigrant investors must demonstrate that their investment in a  new commercial enterprise will result in the creation or, in the case of a  troubled business, preservation or creation (or some combination of the  two), of at least 10 full-time positions for qualifying employees. In recent  years, the EB-5 Program has increased in popularity as a viable source of  low-interest funding for major real estate development projects, such as  the Barclays Center—a multipurpose indoor arena in Brooklyn, New  York—and the Marriott Convention Center Hotel in Washington, D.C.
Individuals seeking to establish a regional center under the EB-5 Program  must submit an initial application and supporting documentation as well  as an update for each fiscal year (or as otherwise requested by USCIS)  showing that the regional center continues to meet the program  requirements to maintain its regional-center designation. Prospective  regional-center principals apply to the program by submitting Form I-924,  Application for Regional Center under the Immigrant Investor Pilot  Program. On this form, applicants are to provide a proposal, supported by  economically or statistically valid forecasting tools, that describes, among  other things, how the regional center (1) focuses on a geographic area of  the United States; (2) will promote economic growth through increased  export sales and improved regional productivity, job creation, and  increased domestic capital investment; and (3) will create jobs directly or  indirectly. Applicants must also include a detailed statement regarding the  amount and source of capital committed to the regional center, as well as  a description of the promotional efforts they have taken and planned.  Once a regional center has been approved to participate in the program,  a designated representative of the regional center must file a Form  I-924A, Supplement to Form I-924, for each fiscal year, to provide USCIS  with updated information demonstrating that the regional center continues  to promote economic growth, improved regional productivity, job creation,  or increased domestic capital investment within its approved geographic  area. USCIS is to issue a notice of intent to terminate the participation of  a regional center if the center fails to submit the required information or  upon a determination that the regional center no longer serves the  purpose of promoting economic growth.
As shown in figure 1, prospective immigrant investors seeking to  participate in the EB-5 Program must complete three forms and provide  supporting documentation as appropriate. Supporting documentation is  assessed to ensure that the prospective immigrant investors have met (1)  the terms of participation for the program, (2) criteria for lawful admission  for permanent residence on a conditional basis, and (3) requirements of  the program to have the conditional basis of his or her lawful permanent  resident status removed. As of August 2016, USCIS had approved  approximately 851 regional centers spread across 48 states, the District  of Columbia, and four U.S. territories; and had terminated the  participation of 61 regional centers for not filing a Form I-924A or not  promoting economic growth.
section_title: Fraud Risk Framework
paragraphs: The Fraud Risk Framework identifies leading practices for agencies to  manage fraud risks. It includes control activities that help agencies  prevent, detect, and respond to fraud risks as well as structures and  environmental factors that influence or help managers achieve their  objectives to mitigate fraud risks. The framework consists of four  components for effectively managing fraud risks: commit, assess, design  and implement, and evaluate and adapt (see fig. 2). Leading practices for  each of these components include the following:  (1)  commit: create an organizational culture to combat fraud at all  levels of the agency, and designate an entity within the program  office to lead fraud risk management activities;  (2)  assess: assess the likelihood and impact of fraud risks, determine  risk tolerance, examine the suitability of existing controls, and  prioritize residual risks;  (3)  design and implement: develop, document, and communicate an  antifraud strategy, focusing on preventive control activities; and  (4)  evaluate and adapt: collect and analyze data from reporting  mechanisms and instances of detected fraud for real-time  monitoring of fraud trends, and use the results of monitoring,  evaluations, and investigations to improve fraud prevention,  detection, and response.
section_title: USCIS Continues to Take Steps to Improve Fraud Detection, and Planned Efforts to Digitize Files Could Enhance Its Ability to Detect and Prevent Fraud
paragraphs: Since August 2015, USCIS has continued to take steps intended to  enhance its fraud-detection activities. This includes conducting and  planning risk assessments to gather additional information on potential  fraud risks to the program. USCIS is also taking steps to collect more  applicant and petitioner information through a random site visit pilot and  expanding its use of background checks, among other things, to help  improve its ability to identify specific incidence of fraud. Further, USCIS  has taken preliminary steps to digitize and analyze the paper files  submitted by petitioners and applicants to the program. However, the EB- 5 Program is hampered by a reliance on voluminous paper files, and  failing to carry through with these planned efforts could limit USCIS’s  ability to improve fraud risk management.
subsections: section_title: USCIS Is Conducting Risk Assessments of the EB-5 Program and Plans Future Assessments
paragraphs: USCIS is currently conducting multiple risk assessments to help assess  fraud risks to the program and has plans for future assessments. DHS  concurred with our August 2015 recommendation that USCIS plan and  conduct regular fraud risk assessments of the EB-5 Program in the  future. In January 2016 and April 2016, USCIS officials updated us  about their ongoing actions to conduct and plan risk assessments for the  program. These assessments include a current study of potential fraud  associated with certain immigrant investors’ source of funds, a random  site visit pilot that is planned for completion later this year, and a planned  study of all national-security concerns associated with the program:
Source-of-funds study: FDNS is leveraging overseas staff to attempt  to identify potential sources of fraud stemming from immigrant  investors’ false statements regarding their source of funds to provide  their investment in the program.
Site-visit pilot: According to agency officials’ statements and  documentation we reviewed, FDNS is designing and implementing a  plan to conduct random site visits. According to agency officials, the  visits will also serve to improve their assessment of fraud risks, and,  according to documentation, will be random, in-person, and  unannounced, and are intended to, among other things, provide  enhanced integrity of the EB-5 program by increasing compliance with  statutory and regulatory requirements, as well as deterring regional  center and investor fraud. According to agency officials and agency  documentation, a total of 50 site visits in four different states are  planned. An agency official stated that the first site visits began in  August 2016. Another official stated that they anticipate conducting  additional site visits on both a continual and as-needed basis.
National-security concerns: In April 2016, FDNS officials stated that  they also planned to conduct a risk assessment of all previously  identified national-security concerns for the program but did not have  final details to provide at the time of our review.
Based on past and current risk assessments, a senior FDNS official  stated that the most frequent incidents of fraud in the program were  associated with securities fraud, whereby immigrant investors were  defrauded by unscrupulous regional-center principals and their  associates. The official’s comments are consistent with our August 2015  findings that over half of ongoing investigations associated with the  program related to securities fraud. In our report we also noted that the  EB-5 program faced unique fraud risks compared to other immigration  programs that included uncertainties in verifying that the funds invested  were obtained lawfully and various investment-related schemes to  defraud investors. For example, we reported that in one instance, a  couple created a regional center and solicited immigrant investors with  promises of investing in a local energy company. Instead of investing in  that project, the couple used investor funds to, among other things, buy  cars for themselves and regional-center employees, and invest in a  financially troubled restaurant.
section_title: USCIS Is Taking Additional Steps to Improve Its Fraud-Detection Capabilities
paragraphs: Along with its risk assessments, since August 2015, USCIS has  continued to take steps to improve its ability to identify potential instances  of fraud. USCIS is taking various steps to capture and utilize additional  information from its immigrant investor and regional-center program  participants and is obtaining additional resources to aid its oversight.  These actions were taken in part as a response to our August 2015  recommendation for USCIS to develop a strategy to expand information  collection to strengthen fraud prevention, detection, and mitigation  capabilities. According to USCIS officials, the EB-5 program has issued  updated petition and application forms for public comment and anticipates  publishing the revised forms in final in fiscal year 2017. These updated  forms would help capture additional information about petitioners and  applicants that could be used to potentially identify fraud. Along with  capturing additional self-reported information from petitioners and  applicants, USCIS officials stated that they are exploring increased use of  Financial Crimes Enforcement Network (FinCEN) checks to identify  potential fraudulent actors in the program, especially for regional-center  applicants. Moreover, USCIS is exploring the potential use of a new  process to allow interviews of immigrant investor petitioners seeking the  removal of their conditional status at the I-829 stage, according to agency  officials and documentation. According to agency documentation, this  effort is in part a response to our August 2015 report, which  recommended that USCIS develop a strategy to expand information  collection such as considering the increased use of interviews at the I-829  phase. If implemented, the interviews will be conducted by  knowledgeable USCIS officials based in Washington, D.C. As of August  2016, the officials stated that a limited number of pilot interviews had  already taken place, and, as a result of these and additional pilot  interviews, USCIS plans to refine and develop a comprehensive interview  strategy. Further, to help the EB-5 program improve oversight, USCIS  officials stated that they are working to improve their ability to track and  report data related to EB-5 investments and job creation through the  planned development of a case-management system. In August 2016,  USCIS officials reported that a preliminary scoping meeting had been  held and that project completion was tentatively planned for some time in  fiscal year 2017.
USCIS is also taking steps to obtain additional resources for program  oversight. For example, FDNS has increased its number of authorized  positions from 21 to 25 full-time equivalent staff and has added student  intern positions and administrative support. According to agency officials  and documentation, USCIS’s IPO has also created a specialized group  focused primarily on regulatory compliance of existing regional centers to  help ensure that the centers continue to serve their purpose of promoting  economic growth. Among other things, the compliance unit is expected to  help coordinate referrals, such as potential fraud referrals, to FDNS and  house an audit function, which anticipates conducting its first audit  activities later in 2016. Officials expect that the audits will be conducted  on-site at regional centers and that they will include a review of the  centers’ compliance with applicable laws and regulations. Most recently,  USCIS has also issued proposed changes for public comment to increase  the filing fees for immigrant investors and regional-center applicants  either seeking to participate or currently participating in the program.  Specifically, USCIS has proposed more than doubling the initial Form  I-526 filing fee from $1,500 to $3,675, nearly tripling the I-924 regional- center designation or amendment fee from $6,230 to $17,795, and adding  a new I-924A annual filing fee of $3,035. These new fees are designed to  allow USCIS to fully recover the costs of the services it provides and also  aid its efforts in administering the program including fraud-identification  efforts. For example, the proposed rule requests increased fees to  conduct additional oversight work such as through site visits. Moreover,  USCIS officials stated that they are also developing standard operating  procedures for adjudication staff for each immigrant investor form, which  the agency plans to finalize by the end of calendar year 2016 or the first  quarter of fiscal year 2017. These new procedures could help standardize  and improve USCIS’s adjudication processes, which could improve the  ability of its staff to detect potential instances of fraud.
section_title: Reliance on Paper Files Continues to Hinder USCIS’s Ability to Mitigate Fraud in EB-5, and Planned Digitization Efforts Have Not Yet Been Implemented
paragraphs: We found in August 2015 that USCIS is unable to comprehensively  identify and address fraud trends across the program because of its  reliance on paper-based documentation and because it faces certain  limitations with using available data and with collecting additional data on  EB-5 immigrant investors or investments. Agency officials noted that the  state of information within the program precluded certain fraud-detection  and analysis efforts such as the development of an automated risk- weighting system to prioritize petitions and applications at higher risk of  fraud. These issues continue to exist. Based on our review of 20  applications and petitions, we similarly determined that identifying fraud  indicators in these petitions and applications is extremely challenging.  These challenges exist in part because many of the files were several  thousand pages long and would take significant time to review. According  to USCIS documentation, the program anticipates receiving around  14,000 petitions and applications a year, and the average submission is  approximately 1,000 pages in length, for a cumulative total of about 14  million pages that, based on current capabilities, would need to be  reviewed manually. According to agency documentation, the average  review time for an EB-5 filing can range from 5.5 hours for an I-829  removal of conditions petition to 40 hours for an I-924 application for a  new regional center.
We also found in August 2015 that USCIS planned to collect and maintain  more readily available data on EB-5 Program petitioners and applicants  through the deployment of electronic forms in its new system, the USCIS  Electronic Immigration System (ELIS). However, according to agency  officials, they do not anticipate capturing supporting information provided  as evidence in the petitions and applications in USCIS ELIS in the near  term. According to an FDNS official, this supporting information can be  an important source of potential fraud indicators as it contains details  such as business plans associated with the investment.
Recognizing the limitations associated with its reliance on paper files, in  January 2016 USCIS officials stated that they were analyzing alternatives  to evaluate and compare the effectiveness, suitability, costs, and risks  associated with different potential hardware and software solutions to  detect fraud patterns across its EB-5 applications. In February 2016,  USCIS completed a draft of this study, which evaluated both hardware  and software options to support fraud detection in both the EB-5 and  asylum programs. The study evaluated several document-conversion  alternatives including hardware and software tools to scan paper files and  convert them to digital text, as well as text analytic alternatives such as  software that allows for the detailed analysis of text similar to that used for  computer-aided plagiarism detection. For example, this software could be  used to identify duplicate passages in different petitions and applications,  which could indicate potential fraud. The study reported a number of  challenges associated with digitizing and analyzing petitioner and  applicant information for the EB-5 program. For example, the study noted  that implementing text analytic techniques for computer-aided plagiarism  detection will likely be costly since many software packages do not offer  this capability without substantial modification. Based on the results of  this study, USCIS officials told us that they were developing a set of  proposals for management review and potential approval; however, these  efforts remained in their development stages and were being reviewed by  USCIS stakeholders for feedback, recommendation, and acceptance prior  to procurement activities. FDNS officials stated that, at this time, they  were optimistic that actions would be taken but were ultimately uncertain  to what extent, if any, the proposals would be acted upon.
section_title: USCIS Has Taken Steps to Incorporate Fraud Risk Management Leading Practices, but Has Not Yet Created a Fraud Risk Profile to Guide Its Efforts
paragraphs: USCIS continues to take steps to improve overall fraud risk management  but has not incorporated certain leading practices that could benefit its  efforts. Generally, USCIS has followed or partially followed selected  leading practices identified in GAO’s Fraud Risk Framework, such as  having a commitment to establishing a culture of fraud risk management  in the agency. However, USCIS has not developed a fraud risk profile, a  component of the Fraud Risk Framework that helps inform an agency’s  decisions and plans to mitigate fraud risks.
USCIS has taken some key steps that align with the leading practices in  the Fraud Risk Framework. In particular, USCIS has taken actions that  closely align with the first and second components, which call for federal  managers to (1) commit to combating fraud by creating an organizational  culture and structure conducive to fraud risk management; and (2) plan  regular fraud risk assessments and assess risks to determine a fraud risk  profile. For example, USCIS officials stated that they are committed to  creating an organizational culture to combat fraud at all agency levels  through leadership that is committed to assessing fraud risks and for  training at all levels for adjudicators. In August 2015, we reported that  FDNS had also developed and provided training on specific fraud-related  topics believed to be immediately relevant to adjudication of EB-5  Program petitions and applications. We found that FDNS is the unit  charged with preventing, detecting, and responding to allegations of fraud  in the program and represents a dedicated entity for managing fraud  risks, which is consistent with the Fraud Risk Framework’s leading  practices.
With respect to assessing risks, as mentioned previously, USCIS is  currently conducting multiple assessments to help it identify and manage  EB-5 program fraud risks. The Fraud Risk Framework calls for agencies  to plan regular fraud risk assessments to determine a fraud risk profile.  We found that the risk assessments conducted for the program generally  aligned with this component of the Fraud Risk Framework. For example,  through one of these prior risk assessments, USCIS determined that  enhanced security checks conducted by other federal entities, such as  the Federal Bureau of Investigation and U.S. Customs and Border  Protection, revealed information that could help identify potential fraud by  the immigrant investor or the regional-center principal. As a result, USCIS  now conducts selected background checks on all of its immigrant  investors and regional-center principals. Most recently, according to a  senior FDNS official, USCIS also signed a memorandum of  understanding with FinCEN and anticipates conducting additional reviews  to help identify potential fraudulent financial activity in its regional centers.
While USCIS has taken steps to implement selected leading fraud- management practices, we found that USCIS has not developed a fraud  risk profile—an overarching document that guides an organization’s  fraud-management efforts—as called for by the Fraud Risk Framework.  Specifically, a fraud risk profile involves identifying inherent fraud risks  affecting a program; assesses the likelihood and impact of these risks;  determines a fraud risk tolerance; and examines the suitability of existing  fraud controls and prioritizes residual fraud risks. (App. I describes the  key elements of a fraud risk profile.) Instead, USCIS’s completed and  planned risk assessments span multiple years and were developed as  separate documents and reports, and USCIS lacks a unifying document  that consolidates these findings and informs the specific control activities  managers design and implement. A senior FDNS official told us that  FDNS is beginning the development of a fraud-management plan to help  guide efforts for the program, but these efforts were in their early stages.  Moreover, the official stated that they did not anticipate incorporating a  fraud risk profile as part of their fraud-management plan. Without a  profile, managers may lack an important tool that can serve as an internal  benchmark in assessing the performance of fraud-control activities.  Further, a profile can provide additional assurances to stakeholders and  decision makers on the fraud risks to programs as well as steps taken to  manage those risks. This fraud risk profile can include all elements of the  prior risk assessments and any updates, serving as a central reference  document that can inform and help initiate actions. Absent a fraud risk  profile, USCIS may not be well positioned to identify and prioritize fraud  risks in the EB-5 Program and ensure the appropriate controls are in  place to mitigate these risks.
section_title: Conclusions
paragraphs: USCIS has taken a number of steps recently to enhance its fraud- detection capabilities throughout the EB-5 Program. However, the  anticipated benefits of these steps may take time to realize. In the  meantime, the agency continues to be hindered by a reliance on time- consuming reviews of paper files that preclude certain potential fraud- detection activities such as the use of text analytics to help identify  indicators of potential fraud in the applications and petitions of regional- center principals and immigrant investors. The continuation of planned  efforts to digitize the files, including the supporting evidence submitted by  applicants and petitioners, could help USCIS better identify fraud  indicators in the program. Moreover, USCIS has incorporated several  leading fraud risk management practices into its efforts, including  committing to creating an organizational culture that combats fraud risks  and assessing those risks through regular risk assessments. However,  USCIS would be better positioned to prioritize and respond to evolving  fraud risks by adopting an approach that is guided by a fraud risk profile,  as called for by the Fraud Risk Framework.
section_title: Recommendation for Executive Action
paragraphs: To strengthen USCIS’s EB-5 Program fraud risk management, we  recommend the Director of USCIS develop a fraud risk profile that aligns  with leading practices identified in GAO’s Fraud Risk Framework.
section_title: Agency Comments
paragraphs: We provided a draft of this report to DHS for its review and comment. In  its written comments, reproduced in appendix II, DHS concurred with our  recommendation and stated that USCIS will develop a fraud risk profile as  described with estimated completion by September 30, 2017. We will  continue to monitor the agency’s efforts in this area. Upon completion and  use of a fraud risk profile to guide its fraud risk management, USCIS will  be better positioned to prioritize and respond to evolving fraud risks. DHS  also provided technical comments, which we incorporated as appropriate.
We are sending copies of this report to interested congressional  committees and the Secretary of Homeland Security. In addition, the  report is available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. In addition to the contact named above,  Gabrielle Fagan and Linda Miller, Assistant Directors; Jon Najmi; Anna  Maria Ortiz; Brynn Rovito; Kiran Sreepada; and Nick Weeks made key  contributions to this report.
section_title: Appendix I: Example of a Fraud Risk profile
paragraphs: The Framework for Managing Fraud Risks in Federal Programs (Fraud  Risk Framework) identifies leading practices for agencies to manage  fraud risks. It includes control activities that help agencies prevent,  detect, and respond to fraud risks as well as structures and environmental  factors that influence or help managers achieve their objectives to  mitigate fraud risks. The framework consists of four components for  effectively managing fraud risks: commit, assess, design and implement,  and evaluate and adapt. Leading practices for each of these components  include the following:  (1)  commit: create an organizational culture to combat fraud at all  levels of the agency, and designate an entity within the program  office to lead fraud risk management activities;  (2)  assess: assess the likelihood and impact of fraud risks, and  determine risk tolerance, examine the suitability of existing  controls, and prioritize residual risks;  (3)  design and implement: develop, document, and communicate an  antifraud strategy, focusing on preventive control activities; and  (4)  evaluate and adapt: collect and analyze data from reporting  mechanisms and instances of detected fraud for real-time  monitoring of fraud trends, and use the results of monitoring,  evaluations, and investigations to improve fraud prevention,  detection, and response.
The fraud risk profile is an essential piece of the antifraud strategy, as  described in the “Design and Implement” section of the Fraud Risk  Framework, and informs the specific control activities managers design  and implement. The elements in table 1 reflect key elements of fraud risk  assessments and the fraud risk profile. The table is meant solely for  illustrative purposes to show one possible format for agencies to  document their fraud risk profile. The table shows information related to  one fraud risk; however, a robust fraud risk profile would include  information about all fraud risks that may affect a program. Documenting  fraud risks together can aid managers in understanding links between  specific risks. In addition, other tools a program uses to assess risks,  such as the risk matrix discussed in the “Assess” section of the Fraud  Risk Framework, can supplement the documentation for the fraud risk  profile. We adapted the table and additional information below it from  Standards for Internal Control in the Federal Government, as well as a  publication by the Australian National Audit Office and one cosponsored  by the Institute of Internal Auditors, the American Institute of Certified  Public Accountants, and the Association of Certified Fraud Examiners.
The following is additional information about the elements in table 1.
Identified Fraud Risks. What fraud risks does the program face? Include  a brief description of the fraud risk or scheme. This list will vary by  program, and may be informed by activities to gather information during  the fraud risk assessment, such as interviews with staff, brainstorming  sessions, and information from hotline referrals.
Fraud Risk Factors. What conditions or actions are most likely to cause  or increase the chances of a fraud risk occurring? This may reflect fraud  risk factors highlighted in Standards for Internal Control in the Federal  Government, as well as other factors that provide additional details about  specific fraud risks.
Fraud Risk Owner. Which group or individual within the program is  responsible for addressing the risk? The owner of the fraud risk will vary  by program, but generally the owner this is the entity with accountability  for addressing the fraud risk.
Inherent Risk Likelihood and Impact. In the absence of controls, how  likely is the fraud risk and what would the impact be if it were to occur? As  noted in the “Assess” section of the Fraud Risk Framework, the specific  methodology for assessing the likelihood and impact of risks will vary by  agency. One option for assessing likelihood is to use a five-point scale, as  noted in table 1. When considering impact, participants of the fraud risk  assessment may consider the impact of fraud on the program’s  compliance with laws and regulations, operations, and reputation.
Inherent Risk Significance. In the absence of controls, how significant is  the fraud risk based on an analysis of the likelihood and impact of the  risk? While the specific methodology for assessing risks may vary by  agency, including qualitative and quantitative methodologies, managers  may multiply the likelihood and impact scores, or apply a five-point scale.
Existing Antifraud Controls. What controls does the program already  have in place to reduce the likelihood and impact of the inherent fraud  risk? This is intended to assist with mapping the existing controls to the  fraud risks or schemes, which would reduce the likelihood and impact of a  fraud risk occurring.
Residual Risk Likelihood and Impact. Taking into account the  effectiveness of existing controls, how likely is the fraud risk and what  would the impact be if it were to occur? Managers may consider  assessing both the residual likelihood and impact of fraud risks using the  five-point scale described in table 1. Controls that are not properly  designed or operating effectively may contribute to high residual risk.
Residual Risk Significance. How significant is the fraud risk based on  an analysis of the likelihood and impact, as well as the effectiveness of  existing controls? Like inherent risk significance, qualitative and  quantitative methodologies may be used to establish residual risk  significance.
Fraud Risk Response. What actions does the program plan to address  the fraud risk, if any, in order to bring fraud risks within managers’ risk  tolerance?
section_title: Appendix II: Comments from the Department of Homeland Security