Refugees: State and Its Partners Have Implemented Several Antifraud Measures but Could Further Reduce Staff Fraud Risks
Published: 2017-07-31T00:00:00

Fast Facts:
The United Nations estimates that there are more than 21 million refugees worldwide. The State Department works with Resettlement Support Centers (RSC) to review applications for resettlement to the United States.
According to State and RSC officials, some RSC staff have occasionally taken advantage of their positions to commit fraud. For example, they have collected money from vulnerable refugees, even though the resettlement process is free.
We found that RSCs have implemented several measures to reduce the risk of staff fraud, however, we recommended three actions to further prevent, detect, and mitigate risks.

Highlights:
section_title: Why GAO Did This Study
paragraphs: According to UNHCR, as of the end of 2015, more than 21 million people had become refugees. In fiscal year 2016, the United States admitted nearly 85,000 refugees. State manages the U.S. refugee admissions program (USRAP). UNHCR referred 61 percent of the refugees considered by the United States for resettlement from October 2011 to June 2016, and State worked with staff hired by nine RSCs to process their applications. Deterring and detecting fraud is essential to ensuring the integrity of USRAP.
GAO examined (1) how State works with UNHCR to ensure program integrity in the UNHCR resettlement referral process and (2) the extent to which State and RSCs follow leading practices to reduce the risk of fraud committed by RSC staff. GAO analyzed State and UNHCR data and documents; interviewed relevant officials; conducted fieldwork at UNHCR offices in Denmark, El Salvador, Jordan, Kenya, and Switzerland; interviewed senior officials from all nine RSCs; and visited RSCs in Austria, Jordan, Kenya, and a suboffice in El Salvador. This report is based on GAO-17-446SU , with certain sensitive information removed.
section_title: What GAO Found
paragraphs: The Department of State (State) and the United Nations High Commissioner for Refugees (UNHCR) have worked together on several measures designed to ensure integrity in the resettlement referral process. State and UNHCR have established a Framework for Cooperation to guide their partnership, emphasizing measures such as effective oversight structures, close coordination, and risk management. Working with State, UNHCR has implemented standard operating procedures and other guidance that, according to UNHCR officials, provide baseline requirements throughout the referral process. UNHCR also uses databases to help verify the identities of and manage information about refugees. These systems store biographic information such as names, personal histories, and the types of persecution refugees experienced in their home countries. They also maintain biometric information, such as iris scans and fingerprints.
To reduce the risk of fraud committed by staff at the nine Resettlement Support Centers (RSC) worldwide, State and RSCs have instituted several antifraud activities, many of which correspond with leading antifraud practices, but key gaps remain. Overseen by State, the organizations that operate RSCs hire staff to process and prescreen applicants who have been referred for resettlement consideration. According to State and RSC officials, RSCs have experienced staff fraud. Officials said that instances of staff fraud are uncommon, but they illustrate risks to the integrity of RSC operations. To manage these risks, State and RSCs have established a number of activities consistent with leading antifraud practices. For example, officials from all nine RSCs stated that they assign staff fraud risk management responsibilities to designated individuals. State has also worked with RSCs to develop and implement controls to ensure program integrity. However, RSCs face challenges implementing some of these controls. Additionally, State has not required RSCs to conduct regular staff fraud risk assessments tailored to each RSC or examined the suitability of related control activities. Without taking additional steps to address these issues, State and RSCs may face challenges in identifying new staff fraud risks or gaps in the program's internal control system as well as designing and implementing new control activities to mitigate them.
section_title: What GAO Recommends
paragraphs: To better assess and manage risks of fraud committed by staff at RSCs, State should actively pursue efforts to ensure RSCs comply with program integrity measures; require each RSC to conduct regular risk assessments tailored to its operations; and use these assessments to design, implement, and revise control activities to mitigate risks of staff fraud. State agreed with GAO's recommendations.

section_title: Letter
paragraphs: Millions of people worldwide have fled their home countries to seek  asylum because of persecution. If determined to have a well-founded fear  of persecution on account of their race, religion, nationality, political  opinion, or their membership in a particular social group, these individuals  can be registered as refugees with the governments of the countries to  which they have fled or with the United Nations High Commissioner for  Refugees (UNHCR).
At the end of 2015, UNHCR reported approximately 21.3 million refugees  worldwide. In fiscal year 2016, the United States admitted nearly 85,000  refugees for resettlement, the largest yearly number in more than 15  years. The Department of State’s (State) Bureau of Population, Refugees,  and Migration (PRM) manages the process by which refugees seek to be  resettled in the United States, which is known as the United States  Refugee Admissions Program (USRAP). State works with the  Department of Homeland Security’s (DHS) U.S. Citizenship and  Immigration Services (USCIS), which has responsibility for adjudicating  applications from these individuals. State receives applications and  referrals for refugee resettlement from a variety of sources, with most  coming from UNHCR. Both State and USCIS coordinate with nine  Resettlement Support Centers (RSC) worldwide to manage referrals and  applications to USRAP, collect information on each refugee applicant,  and prepare approved refugee applicants for resettlement to the United  States. State oversees these RSCs, four of which are operated by the  International Organization for Migration (IOM), and four of which are  operated by nongovernmental organizations (NGO). The ninth RSC, in  Havana, Cuba, is operated directly by State.
USRAP relies on the integrity of several processes, including refugee  registration, resettlement referrals, RSC preparation of applications for  refugee status, and the adjudication of applications for refugee  classification by USCIS, to help meet U.S. resettlement goals while also  safeguarding against fraud. According to State officials, incidents of staff  fraud occur infrequently, but there have been some cases of fraud  committed by RSC staff. State officials told us that these cases are  usually uncovered before any significant consequences occurred;  however, these incidents of staff fraud in USRAP have created concerns  about the integrity of the program.
Federal agencies within and outside of the intelligence community,  including the National Counterterrorism Center and the Federal Bureau of  Investigation, partner with State and USCIS on security checks to identify  and vet any potential national security concerns associated with an  applicant. Further, DHS’s U.S. Customs and Border Protection is  responsible for examining all individuals, including refugees, at U.S. ports  of entry to determine their admissibility, and the terms and conditions on  such admission, to the United States.
Pursuant to a provision in the Joint Explanatory Statement accompanying  the Consolidated Appropriations Act, 2016, and congressional requests,  we conducted a review of the refugee screening process. This report (1)  describes how State works with UNHCR to ensure program integrity in  the resettlement referral process and (2) examines the extent to which  State and RSCs follow leading practices to reduce the risk of fraud  committed by RSC staff.
This report is a public version of a sensitive report that we issued in June  2017. The Departments of State and Homeland Security deemed some  of the information in our June report to be sensitive, which must be  protected from public disclosure. Therefore, this report omits sensitive  information about State staffing levels, RSCs’ reported compliance with  some measures contained in State’s Program Integrity Guidelines, and  actions taken by specific RSCs to assess risk. Although the information  provided in this report is more limited, the report addresses the same  objectives as the sensitive report and uses the same methodology.
To describe how State works with UNHCR to ensure program integrity in  the resettlement referral process, we reviewed standard operating  procedures (SOP) and other guidance issued by UNHCR and State. We  also conducted interviews with UNHCR and State officials in Washington,  D.C.; UNHCR headquarters offices in Geneva, Switzerland, and  Copenhagen, Denmark; and UNHCR field offices in El Salvador, Jordan,  and Kenya. We also met with State and RSC officials in Austria, El  Salvador, Jordan, and Kenya. We traveled to these locations between  May 2016 and September 2016 and selected them to observe diverse  types of refugee populations and several different types of UNHCR  referrals. For the purposes of this report, we define “program integrity” as  the extent to which the resettlement referral process is free from fraud,  waste, and abuse by both staff and applicants. An important component  of program integrity is to combat fraud in the UNHCR resettlement referral  process. In this report, we define fraud as including any attempt to (1)  gain financial benefit as a staff member of UNHCR or one of its  contractors through inappropriate means or (2) gain access to the  program by an applicant through providing false information or other  inappropriate means. We describe how State and UNHCR work together  to ensure program integrity in the resettlement referral process and report  on measures put in place by State and UNHCR, but determining the  effectiveness of these measures was beyond the scope of our review.
To examine the extent to which State and RSCs follow leading practices  to reduce the risk of fraud committed by RSC staff, we took a number of  steps. First, we reviewed RSC SOPs and guidance documents from  State, IOM, and various NGOs. We evaluated the staff fraud risk  management activities conducted by State and RSCs by comparing  antifraud activities reported by RSCs with the leading practices  encompassed in GAO’s A Framework for Managing Fraud Risks in  Federal Programs (the Fraud Risk Framework). For the purposes of this  report, we reviewed documentation and spoke with State and RSC  officials about instances of fraud committed by staff at RSCs, including  malfeasance and collusion. To assess the controls PRM has in place to  monitor RSCs, we reviewed RSC cooperative agreements, recent  monitoring reports PRM completed for 8 of the 9 RSCs, questionnaires  completed by six RSC directors in advance of monitoring visits, and fiscal  year 2015 quarterly reports that RSCs submitted to PRM. We also  interviewed officials from IOM and various NGOs. We spoke with officials  at all nine RSCs, including during visits to RSCs in Austria, Jordan,  Kenya, and the RSC Latin America suboffice in El Salvador. Observations  from our site visits are not generalizable to all RSCs but provide  illustrative examples and apply to the USRAP program through fiscal year  2016.
Second, to analyze the extent to which RSCs reported compliance with  the 72 required control activities listed in State’s USRAP Program  Integrity Guidelines (see app. I), we examined the most recent Internal  Malfeasance Prevention and Mitigation Measures and Actions report  submitted to State by all nine RSCs. For each required measure, RSCs  report the actions taken to comply with the measure. If an RSC reported  an action that met the measure required by State, we determined the  RSC to have reported compliance. If an RSC (a) reported an action that  met some, but not all, of the parts of the required measure; (b) reported  progress toward compliance but had not yet fully complied with the  required measure; (c) reported an action that did not meet any parts of  the required measure; or (d) did not report actions related to a measure,  we determined that the RSC did not report compliance. While we  analyzed RSC reporting on these actions, we did not independently verify  all of the information contained in the reports. When possible, we did  verify certain information reported by RSCs, such as confirming during  our visits to RSC offices that required signage was displayed.
Third, we assessed whether RSC staff fraud risk assessments were  conducted at regular intervals or when the program experienced changes  and were tailored to RSC operations. We determined staff fraud risk  assessments to be conducted at regular intervals or when the program  experienced changes if RSCs reported conducting such an assessment  more than once. We determined that RSCs had not conducted staff fraud  risk assessments at regular intervals or when the program experienced  changes, if RSC officials reported that they had not conducted a staff  fraud risk assessment or if they reported they had conducted such an  assessment but had not done so more than once. If RSCs completed  staff fraud risk assessments, we examined whether those assessments  were tailored to RSC operations. We determined staff fraud risk  assessments to be tailored if RSCs reported that they had conducted a  risk assessment since October 2014 and assessments examined risks  specific to individual RSC operations. If a staff fraud risk assessment was  conducted, but RSC officials reported that it did not examine the risks  specific to RSCs individually, we determined the risk assessment was not  tailored to RSC operations.
In the background of this report, we report on the number of refugees  globally at the end of 2015, identify the number and nationality of  refugees referred to USRAP by UNHCR from fiscal year 2011 through  June 2016, and describe the process of classification as a refugee by the  United States. To do so, we analyzed data on global refugee populations  from UNHCR’s 2015 Global Trends Report. We also analyzed record- level data on all refugee applications to the United States from the State  system that serves as a repository of application information and tracks  the status of all individual refugee applications to USRAP—the Worldwide  Refugee Admissions Processing System (WRAPS). The data we  reviewed from WRAPS include information on all refugee applications  made from fiscal year 2011 through June 2016. We assessed the  reliability of RSCs’ data on refugees, for example, by reviewing the  information for missing data or obvious errors and interviewing State  officials responsible for ensuring data quality. We determined that these  data were sufficiently reliable for the purposes of this report. The data we  included regarding the staffing levels at all nine RSCs were provided by  State. In most cases, we used the data State reported for the number of  full-time staff equivalents in fiscal year 2016. We reviewed these numbers  with State officials, but it was beyond the scope of this report to fully  determine their reliability.
The performance audit upon which this report is based was conducted  from February 2016 to June 2017 in accordance with generally accepted  government auditing standards. Those standards require that we plan  and perform the audit to obtain sufficient, appropriate, evidence to provide  a reasonable basis for our findings and conclusions based on our audit  objectives. We believe that the evidence obtained provides a reasonable  basis for our findings and conclusions based on our audit objectives. We  subsequently worked with the Departments of State and Homeland  Security from June 2017 to July 2017 to prepare this unclassified version  of the original sensitive report for public release. This public version was  also prepared in accordance with these standards.
subsections: section_title: Background
subsections: section_title: UNHCR and the Processes of Refugee Registration and Resettlement Referral
paragraphs: In response to the large number of people displaced following World War  II, the United Nations established UNHCR in 1950 with the mandate of  providing protection to and seeking permanent solutions for refugees. The  1951 United Nations Convention Relating to the Status of Refugees   defines a refugee as someone who, as a result of events occurring before  January 1, 1951 and owing to a “well-founded fear of being persecuted  for reasons of race, religion, nationality, membership of a particular social  group or political opinion, is outside the country of his nationality and is  unable or, owing to such fear, is unwilling to avail himself of the protection  of that country; or who, not having a nationality and being outside the  country of his former habitual residence, as a result of such events, is  unable or, owing to such fear, is unwilling to return to it.” The 1967  Protocol Relating to the Status of Refugees expanded the definition of  refugee to include all refugees covered by the definition in the 1951  Convention with no date or geographic limitation. Over time, UNHCR’s  mandate has expanded beyond providing protection and humanitarian  assistance, and seeking, together with governments, durable solutions for  refugees, to include asylum-seekers, stateless persons, returnees, and in  certain circumstances, internally displaced persons. UNHCR has over  10,000 staff located at its headquarters in Geneva, Switzerland;  Budapest, Hungary; Copenhagen, Denmark; and in field offices in more  than 128 countries.
UNHCR’s mandate, as established by the United Nations General  Assembly, is the provision of international protection, material assistance,  and durable solutions to refugees and other persons of concern.  According to UNHCR, registration is a key tool for providing protection to  refugees. Registration in the refugee protection context is the recording,  verifying, and updating of information on asylum-seekers, refugees, and  other persons of concern to UNHCR. Registration is the first step in  formalizing the protection relationship between the individual seeking  protection and the host government in the country of asylum, UNHCR, or  both. UNHCR uses registration as a tool to assist in determining which  types of assistance and protection are most appropriate.
UNHCR also uses Refugee Status Determination (RSD), which it  describes as the legal or administrative process by which governments or  UNHCR determine whether an asylum-seeker meets the definition of a  refugee under international, regional, or national law. This determination  involves one or more interviews by trained government officials in the  country of asylum or by trained UNHCR RSD staff. RSD and registration  are distinct processes, although data recorded during the individual’s  registration as an asylum-seeker may be drawn upon and confirmed  during RSD. If an asylum-seeker is determined to be a refugee, his or her  registration will be updated from asylum-seeker to refugee, or if there was  no prior registration, the refugee will be registered as such. In the majority  of its operations, UNHCR records identity data in UNHCR’s database and  case management system, the Profile Global Registration System  (ProGres).
UNHCR promotes and provides both legal and physical protection, and  also provides for basic needs including food, water, shelter, and medical  care in response to refugee crises worldwide. According to UNHCR,  registration is a fundamental component of UNHCR’s protection activities.  For instance, during registration, the organization collects information on  the numbers of refugees and their specific characteristics, such as family  composition or special health needs, which assists it in determining the  type of assistance that an individual refugee or families may initially  require. Information on registered refugee populations is also used by the  organization to help determine the amount and types of assistance that  specific regions may need. Registration is described by UNHCR as an  ongoing process that includes inputting refugees’ biographic and  biometric information into databases and case management systems and  updating it. UNHCR uses ProGres to log and maintain biographic  information such as names and family information, and uses the  Biometric Identity Management System (BIMS) and IrisGuard to collect  and store biometric information such as iris scans and fingerprints.
UNHCR reports that the number of refugees registered with the  organization worldwide has grown significantly in recent years. For  instance, the total number of refugees was estimated to be approximately  21.3 million by the end of 2015, approximately 1.7 million more than the  total reported at the end of 2014. This number includes 4.9 million  refugees from Syria, 2.7 million from Afghanistan, and 1.1 million from  Somalia. See figure 1 for the number of UNHCR-registered refugees by  country of origin as of December 31, 2015.
In addition to providing protection and humanitarian assistance to  refugees and other persons of concern, UNHCR is mandated to work with  governments to provide “durable solutions” to those individuals so that  they may transition out of refugee status and rebuild their lives. The three  durable solutions that UNHCR facilitates include (1) voluntary repatriation  to a refugee’s home country, (2) integration within the country in which  they are currently located, and (3) resettlement to a third country. For  instance, a refugee may decide to permanently return to his or her home  country, with the support of UNHCR and that country, once the crisis that  prompted his or her flight ends. Alternatively, refugees unable to safely  repatriate to their home country may in certain cases, with the help of  UNHCR, acquire permanent legal status with rights such as citizenship in  their country of asylum, which UNHCR reports approximately 1.1 million  refugees have done over the past decade. However, if neither repatriation  nor local integration is available or appropriate, UNHCR may consider  submitting a refugee’s case to a third country for resettlement  consideration. UNHCR refers refugees for resettlement consideration to  various countries, including the United States, Australia, Canada,  Denmark, and the United Kingdom, among others. Refugees can be  referred for resettlement consideration by UNHCR only if they meet  UNHCR’s preconditions for resettlement consideration and fall under one  or more of the resettlement submission categories.
To assess refugees’ eligibility for resettlement referrals, UNHCR officials  conduct interviews with refugees to obtain their basic biographic  information, assess evidence of past or feared persecution, and  determine eligibility for all other solutions that might be available to them.  The organization documents this information in a resettlement referral  form. While most registered refugees receive some form of protection  assistance from the organization, less than 1 percent are referred for  resettlement in a third country, according to UNHCR.
section_title: The United States Refugee Admissions Process
paragraphs: State manages the USRAP admissions process in conjunction with DHS,  and both agencies work with other government agencies, UNHCR, IOM,  and various NGOs to process applications for refugees seeking  resettlement to the United States. From fiscal year 2011 through June  2016, 61 percent of all refugee cases referred to the United States for  resettlement consideration were referred by UNHCR, or roughly 405,000  referrals out of the 655,000 total. According to UNHCR, most of its  referrals are families. UNHCR submits refugee referrals to the United  States from all over the world. See table 1 for more information on the  nationality of refugees referred by UNHCR for potential admission to the  United States from fiscal year 2011 through June 2016.
Once UNHCR refers a case to the United States for resettlement  consideration, it is considered for access to USRAP. State accepts  UNHCR referrals via UNHCR’s ProGres database and uploads  biographic information to WRAPS, which is State’s own system that  serves as a repository of application information and tracks the status of  all individual refugee applications to USRAP.
The resettlement application process continues at one of the nine RSCs.  Through grants or voluntary contributions from State, various NGOs and  IOM operate eight of the nine RSCs. RSCs are responsible for  compiling eligible applications. They collect supporting documentation,  biographic information such as names and addresses, and family  information from each applicant. They are also responsible for  prescreening USRAP applicants—that is, conducting in-person interviews  with each applicant—during which staff employed by the organization that  manages the RSC collect information on the applicants’ persecution story  and why they claim to be unable to return home to their country of origin.  RSCs then provide all of this information to USCIS officers. In addition,  RSCs initiate the necessary biographic security checks for USRAP  applicants, coordinate medical exams with panel physicians, and provide  cultural orientation for refugees approved to travel to the United States,  as well as manage the provision of interpretation services for USCIS  interviews. See table 2 for more information on RSCs.
As part of the resettlement application process, USCIS officers travel  overseas to conduct in-person interviews of USRAP applicants and  adjudicate their applications for refugee status pending the results of  required security and background checks. RSCs provide interpreters to  USCIS officers during the interviews, as necessary.
section_title: Program Integrity and Managing Fraud Risks
paragraphs: Program integrity describes the extent to which the resettlement referral  process is free from fraud, waste, and abuse by both staff and applicants.  An important aspect of ensuring program integrity is designing,  implementing, and evaluating the efficacy of antifraud measures.
According to GAO’s Standards for Internal Control in the Federal  Government, fraud, such as malfeasance conducted by staff, poses a  significant risk to the integrity of a program. Accordingly, management  should consider the potential for fraud when identifying, analyzing, and  responding to program risks. Management responds to identified fraud  risks by developing antifraud activities designed to reduce or eliminate the  potential for fraud. Antifraud activities are a critical component for  ensuring the integrity of a program such as USRAP. Proactive fraud risk  management helps to facilitate a program’s mission and ensure that  program services achieve their intended purpose.
section_title: State Has Worked with UNHCR on Various Measures Designed to Ensure the Integrity of the Resettlement Referral Process
paragraphs: State and UNHCR have worked together on several measures designed  to ensure integrity in the resettlement referral process. The organizations  have developed a Framework for Cooperation to guide their partnership,  emphasizing measures such as oversight activities and risk management.  Additionally, UNHCR has developed SOPs and identity management  systems to combat the risk of fraud and worked with State to implement  these activities in the resettlement process.
subsections: section_title: State and UNHCR Have Developed a Framework for Cooperation Including Activities Designed to Help Ensure Program Integrity
paragraphs: Since 2000, State and UNHCR have outlined their formal partnership  using a Framework for Cooperation. State and UNHCR signed the most  recent framework document in 2016, covering the period of March 14,  2016 to December 31, 2017. According to State and UNHCR officials, the  organizations work together on the activities listed in the Framework for  Cooperation to achieve mutual goals. Specifically, the framework  emphasizes improved accountability at UNHCR through effective  oversight measures, close cooperation with State, and organization-wide  risk management.
The Framework for Cooperation notes that State will work to ensure that  UNHCR allocates sufficient resources to fully implement measures to  provide oversight and accountability. UNHCR has several offices that are  responsible for overseeing antifraud activities, in addition to providing  audit services, investigating instances of fraud, and conducting broad  reviews of country-level operations. The United Nations Office of Internal  Oversight Services and the Board of Auditors conduct regular reviews of  UNHCR and audit its financial statements, respectively. Both make  recommendations regarding the management of UNHCR and track the  status of those recommendations to help ensure effective management.  For example, the board’s annual reports track previous  recommendations, many of which focus on ensuring financial  accountability, conducting fraud risk assessments, and establishing  regular performance reporting mechanisms, among other things.
UNHCR also has an Inspector General’s office that investigates  allegations of staff misconduct and assigns responsibility to its  headquarters, Nairobi, or Bangkok staff to conduct investigations. In  2015, the Inspector General’s Investigative Office opened 88  investigations, including 21 investigations related to fraud complaints. Of  those 21 fraud investigations, 7 were related to the refugee status  determination or resettlement processes. According to UNHCR officials,  fraud committed by persons of concern is investigated locally, and local  management can open an investigation and decide sanctions if applicant  fraud is established.
In addition, according to UNHCR officials, between 2014 and 2016, the  organization sent as many as 10 teams to conduct reviews of field office  operations, including registration, protection, and resettlement. Although  the composition of these teams varies depending on the field operation  being visited, they usually include officials responsible for reviewing  registration, RSD, resettlement, interactions with the regional bureau, and  other things. According to UNHCR officials, these visits have resulted in  strengthening refugee protection and resettlement operations. For  example, in response to alleged instances of fraud at UNHCR’s activities  in an Asian country, the organization undertook two visits in 2016 to  investigate and respond. First, UNHCR’s Inspector General’s office  visited to investigate potential staff fraud but determined that while certain  procedures may not have been followed, staff fraud was not established.  Later, UNHCR sent a team to review how the operations there could be  strengthened throughout the registration, protection, and resettlement  processes. According to UNHCR officials, this visit resulted in  improvements throughout operations in the country, especially related to  the provision of assistance to urban populations of refugees.
The Framework for Cooperation also describes regular coordination and  communication between State and UNHCR as an important principle in  the relationship between the two organizations. Specifically, at the  headquarters level, the U.S. Mission in Geneva, Switzerland, has a  humanitarian affairs office that, according to State officials, coordinates  with UNHCR on a regular basis. For example, State reported that it works  with UNHCR to review draft policy and procedures. It also works with  UNHCR and other countries to help organize annual conferences on  resettlement issues, which include working groups on integrity.
The Framework for Cooperation also discusses UNHCR’s efforts to  improve accountability and monitoring. It notes that UNHCR has  committed to implementing Board of Auditors recommendations, including  implementing an organization-wide approach to risk management, an  enhanced framework for implementation with partners, and improved  management of oversight over implementing partners. In addition,  UNHCR has established committees on oversight and internal  compliance, which have helped in developing an accountability matrix  and monitoring progress made toward the implementation of oversight  recommendations. UNHCR has also developed an organization-wide risk  management strategy, known as enterprise risk management, across its  programs to assess risk in the resettlement referral process, thus  addressing a recommendation made by the Board of Auditors.
section_title: UNHCR Has Various Procedures and Systems Designed to Help Ensure Program Integrity in the Resettlement Referral Process and Works with State to Implement Them
paragraphs: UNHCR has developed guidance documents, baseline SOPs, and  identity management programs that it notes are meant to help ensure the  integrity of their operations, including the refugee resettlement referral  process. For example, UNHCR has developed guidance on registration,  RSD, resettlement, and other activities. The Handbook for Registration  lays out the policies and methodology for registration, while the  Resettlement Handbook provides guidance on the conditions for  resettlement, the types of resettlement submission categories, and the  procedures for making referrals to resettlement countries. UNHCR  headquarters also issued baseline SOPs on resettlement, which provide  a template for local field offices to complete and adapt for local situations.  The resettlement SOPs vary by country and refugee population but,  according to UNHCR officials, they adhere to these baseline  requirements. Despite the complexity and regional variations in its  refugee registration, refugee status determination, and resettlement  referral processes, UNHCR officials said that standardizing procedures  ensures that the organization has established basic antifraud practices  worldwide. These officials added that they believe that SOPs are among  the most important tools with which they ensure the integrity of the  resettlement referral process. UNHCR officials in two of the field offices  we visited indicated that changes to the baseline resettlement SOPs  allowed for regional specificity.
UNHCR officials also register refugees and manage their cases through  ProGres, which is a registration and case management tool. According to  UNHCR, registration and identity management are important ways to  provide legal and physical protection, identify refugees at risk, provide  population planning statistics, and facilitate implementation of durable  solutions. UNHCR developed ProGres in 2003; according to the  organization, it contained 7.2 million records and is used in 97 countries  as of July 2016. UNHCR primarily uses BIMS and IrisGuard to collect and  maintain biometric information, such as iris scans and fingerprints, and  runs them in parallel depending on the geographic region and  population. According to UNHCR officials, both BIMS and IrisGuard are  linked with ProGres, allowing biometric data collected on refugees to be  associated with biographic information. BIMS contains over 1.1 million  records from 16 countries on its central server, and UNHCR is currently  expanding its operation to additional countries, according to UNHCR  officials. On our visits to UNHCR field offices, we observed UNHCR  officials registering and managing case files in ProGres and verifying  biometric data in BIMS and IrisGuard. Using these systems, UNHCR  officials said they can check to ensure that a refugee is not already  registered or receiving assistance. See figure 2 for photographs of  technology that UNHCR uses to register and verify refugee identities.
UNHCR has worked with State on implementing some activities related to  collaboration with its identity management systems. For instance, to help  manage the identities of referred refugees, State and UNHCR developed  a Memorandum of Understanding (MOU) regarding the sharing of some  biometric information. According to a Letter of Understanding that  accompanies the MOU, it provides a framework whereby data from  UNHCR is shared with State, which allows for increased efficiency and  accuracy in processing resettlement referrals to the United States.
section_title: To Address Staff Fraud Risks, State and RSCs Have Taken Steps to Follow Many Leading Antifraud Practices but Could Improve Implementation of Controls and Assessment of Risk
paragraphs: State and RSCs report instituting a number of activities to combat the risk  of fraud committed by RSC staff. Many of these activities correspond with  leading practices identified in GAO’s Fraud Risk Framework. For  instance, State and RSCs have taken steps to commit to an  organizational culture and structure to help manage staff fraud risks.  Further, State and RSCs have designed and implemented several  specific control activities to mitigate staff fraud risks and taken steps to  monitor staff fraud risk management activities. However, State could take  additional steps to improve the implementation of existing controls,  assess the risks of staff fraud, and examine the suitability of existing  activities to control it. Further details on RSCs’ reported compliance with  some measures contained in State’s Program Integrity Guidelines,  challenges faced in compliance, and actions taken by specific RSCs to  assess risk are provided in the sensitive report that we issued in June  2017.
subsections: section_title: Although Identified as Uncommon by State and RSC Officials, Staff Fraud Has Been Experienced by RSCs in Some Instances
paragraphs: According to State officials, staff fraud at RSCs occurs infrequently, but  instances of staff fraud have taken place in recent years, such as RSC  staff soliciting bribes from applicants in exchange for promises of  expediting applicants through RSC processing. State officials said that  these events were uncovered before any significant consequences  occurred; however, such instances illustrate the risks to the integrity of  RSC operations. State and management from six of the nine RSCs stated  that they could not recall any instances of staff fraud occurring at their  RSCs. However, State and managers from the other three RSCs reported  instances of staff fraud or malfeasance in recent years, including the  following:  In 2013, an RSC reported a significant case of staff fraud, resulting in  the termination of two staff members. According to State and RSC  officials, two RSC staff promised to expedite applicant cases in  exchange for money. Although the staff were actually unable to  influence the outcome of the applicants’ cases, the illusion of  expediting the process in exchange for money allowed the extortion to  take place. After an investigation by State’s local Regional Security  Officer, the RSC terminated the two staff members and all individuals  involved were arrested. In response, State undertook new antifraud  initiatives, such as the creation of new antifraud guidelines for RSCs  and commissioning an evaluation of risks posed by staff fraud.
In 2014, while conducting interviews in the field, officials discovered  three interpreters soliciting money from applicants, according to State  officials. These officials said that the RSC identified the three  interpreters and discovered that they had a record of misconduct with  local police. The RSC terminated the interpreters and barred them  from any future employment with the RSC. Since the incident, State  officials said that the RSC has maintained a list of interpreters who  are barred from providing services for the RSC.
In 2016, another RSC discovered that a staff member connected a  personal thumb drive to an RSC laptop without approval with the  intention of accessing applicants’ files. The RSC reported the activity  to State and the organization that manages the RSC. In coordination  with State, RSC officials contracted with a private firm to conduct a  forensic analysis of any potentially compromised information. The  analysis determined that the staff member had attempted but failed to  access any information and subsequently, the staff member was  terminated.
section_title: State and RSCs Have Taken Steps to Combat Staff Fraud but Have Not Followed Some Leading Practices
paragraphs: To address instances of fraud committed by staff at RSCs, State and  RSCs report instituting a number of antifraud activities, many of which  correspond with leading practices identified in GAO’s Fraud Risk  Framework. GAO’s Fraud Risk Framework identifies leading antifraud  practices to aid program managers in managing fraud risks that affect  their program. The framework includes practices such as implementing  activities that demonstrate an antifraud culture, designing and applying  control activities to address fraud risks, monitoring the application of fraud  controls, and conducting regular fraud risk assessments. We found that  State and RSCs have taken steps to institute a number of these  practices, but some gaps remain.
subsections: section_title: State and RSCs Have Reported Implementing Activities that Demonstrate a Culture Committed to Staff Fraud Risk Management
paragraphs: By taking steps to promote organizational cultures and structures  conducive to combatting staff fraud, State and RSCs have worked to  demonstrate a commitment to managing staff fraud risks at RSCs. The  Fraud Risk Framework identifies the involvement of all levels of an  organization in setting an antifraud tone as a leading practice for fraud  risk management. Management at every RSC said that all RSC staff had  the responsibility to combat staff fraud. For example, management at all  eight RSCs operated by IOM or NGOs reported that they had required  their staff to review and sign their organization’s code of conduct  annually. Furthermore, managers at all nine RSCs said that they had  required their staff to attend annual antifraud training and reported to  State that RSC staff had complied with these measures.
Additionally, State and RSCs have created organizational structures to  combat staff fraud by assigning specific staff the responsibility of  overseeing staff fraud risk management activities, a leading practice  highlighted in the Fraud Risk Framework. All nine RSCs stated that they  had assigned staff fraud risk management responsibilities to specific staff  members. Individual RSCs have varied in how they assign these  responsibilities. For instance, while RSC Africa, RSC Middle East and  North Africa, and RSC Turkey and Middle East reported having positions  dedicated to leading their fraud risk management activities, RSCs Austria,  Cuba, and East Asia have assigned overseeing fraud risk management  activities as a duty of their respective RSC directors. The three  remaining RSCs operated by IOM—including RSCs Eurasia, Latin  America, and South Asia—stated that staff had been assigned to oversee  fraud risk management responsibilities at each of them. Additionally,  IOM maintains an ethics office located at its headquarters in Geneva,  Switzerland, to provide additional staff fraud risk oversight.
section_title: State and RSCs Report that RSCs Have Shared Information on and Designed Control Activities to Address Staff Fraud Risk, but Implementation Gaps Remain
paragraphs: To help prevent or mitigate fraud committed by staff at RSCs, State and  RSC officials said that they had established collaborative relationships  with both internal and external partners to share information, which is  consistent with another leading practice identified in the Fraud Risk  Framework. For example, State reported that it had hosted an annual  resettlement workshop, attended by RSC directors and UNHCR staff.  State also reported that RSC staff attend region-specific meetings to  share fraud risk management information. According to RSC Middle East  and North Africa reporting, they have held similar fraud-focused quarterly  meetings attended by representatives from State and UNHCR. In addition  to attending organized conferences and meetings, management at RSCs  stated that they had shared fraud-related information as it arose. When  an RSC experiences an instance of staff fraud, State requires the RSC to  report the fraud to State. According to RSC officials, depending on the  RSC’s operating organization, the RSC may also report the staff fraud to  its headquarters, inspector general, partner organizations, or ethics office.
Another leading practice in the Fraud Risk Framework is the development  of specific control activities to prevent and detect fraud. State officials  identified two key guidance documents containing control activities: RSC  SOPs and the Program Integrity Guidelines. First, according to State  officials, State provides guidance to RSCs on developing SOPs that  include staff fraud risk controls. For example, State requires RSCs to  record the names of staff and interpreters who interact with applicants  during prescreening interviews into WRAPS in order to mitigate fraud risk.  According to State and RSC officials, although each RSC has used  State’s guidance as a template, RSCs may incorporate additional  procedures, including program integrity activities, based on their specific  operational environment, such as size, complexity, location, or applicant  population.
Second, in response to the staff fraud incident in 2013 that resulted in the  termination of two RSC staff, State developed and provided RSCs with a  list of 87 measures designed to prevent and mitigate staff fraud at RSCs,  known as the Program Integrity Guidelines. Of the 87 measures, State  requires 72 and recommends the remaining 15. These measures include  control activities addressing issues such as background checks,  interpreter assignment, antifraud training, office layout, case file reviews,  electronic data management, and reporting and responding to instances  of suspected fraud. For example, State’s Program Integrity Guidelines  have required RSCs to establish physical drop boxes or e-mail addresses  to allow applicants to report instances of suspected staff fraud, as well as  whistleblower policies for other staff to inform RSC management of  suspected staff fraud. State has also required RSCs to include signage  that indicates that the admissions process is free and instructions on how  to report fraud. See figure 3 for examples of such RSC antifraud signage.  Each RSC that we visited displayed similar signage in interview rooms,  hallways, or applicant waiting areas.
Consistent with another leading practice identified in the Fraud Risk  Framework, State and RSCs also reported that they had implemented  control activities designed to prevent and detect staff fraud; however,  some gaps remain. State works with RSCs to implement the control  activities identified in the Program Integrity Guidelines to mitigate staff  fraud risks. RSCs report their compliance with the Program Integrity  Guidelines to State via annual RSC Internal Malfeasance Prevention and  Mitigation: Measures and Actions reports. For each measure listed in the  Program Integrity Guidelines, RSCs report the actions they have taken to  comply.
State required RSCs to comply with the original Program Integrity  Guidelines by October 2014. However, our review of the Measures and  Actions reports found that RSCs reported complying with most, but not  all, of the required measures applicable to their operations. Reported  compliance with required, applicable measures at individual RSCs ranged  from 86 percent to 100 percent. For 53 of the 72 measures, compliance  was reported by all RSCs for which the measure was applicable.
Though RSCs have reported complying with most of the controls required  by the Program Integrity Guidelines, some RSCs have reported that they  face challenges in fully implementing certain controls. State officials told  us that they work to ensure that each RSC complies with all required  controls in the Program Integrity Guidelines. If an RSC reports that it does  not yet fully comply with a measure listed in the Program Integrity  Guidelines, State expects the RSC to report its progress toward  compliance to State. While this reporting assists State in its  implementation efforts, gaps remain. Full compliance with these  measures could help RSCs ensure the integrity of their operations and  guard against staff fraud.
section_title: State and the Organizations that Operate RSCs Have Monitored Staff Fraud Risk Management Activities at RSCs
paragraphs: State and the organizations that operate RSCs have taken steps to  monitor their staff fraud risk management activities, a leading practice  identified in the Fraud Risk Framework. For State’s monitoring of RSC  antifraud activities, program officers and refugee coordinators have  served as the primary liaison between their assigned region’s RSCs and  State. According to State officials, its program officers have conducted  monitoring of RSCs through frequent communication, program reports,  and annual monitoring visits. State officials said that program officers  have communicated with RSC management frequently via telephone and  e-mail to conduct administrative functions, provide updates to State  guidance, and address issues, including those related to staff fraud.
Program officers also have reviewed program reports submitted by RSCs,  which include a section that describes instances of suspected staff fraud  from the previous quarter, if any, and updates to staff fraud risk  management activities. For example, one RSC reported that, as an  antifraud measure, it had prohibited staff from using their personal  smartphones at worksites and issued staff cellphones without cameras or  Internet capability. State also assigns to local U.S. embassies refugee  coordinators who monitor RSC staff fraud risk management activities  through frequent interaction with RSC staff. According to State officials,  during visits to RSCs, refugee coordinators have provided additional  monitoring of RSC staff fraud risk management activities by checking  compliance with State’s Program Integrity Guidelines and receiving  notification of and addressing reported instances of staff fraud.
Additionally, IOM and NGOs have reported conducting annual monitoring  visits of the RSCs that they operate. State has required the operating  organization of each RSC to “conduct annual monitoring that includes  fraud vulnerabilities” and submit the results of the monitoring visits to  State. All four RSCs operated by IOM and all four RSCs operated by  various NGOs reported that their respective operating organizations  conducted such monitoring visits. For example, when one operating  organization conducted a monitoring visit to an RSC in 2015, it  recommended that the RSC should program its computers to lock after 5  minutes of inactivity, as required by the Program Integrity Guidelines.
According to State officials, State program officers are also expected to  conduct annual monitoring visits and create monitoring reports to check  RSC compliance with State’s RSC SOPs and Program Integrity  Guidelines. According to these monitoring reports, program officers  observe day-to-day operations at RSCs during the monitoring visits. For  instance, program officers report that they have observed RSC  caseworkers conducting prescreening interviews of applicants. Upon  concluding the annual monitoring visits, program officers are to complete  written monitoring reports including a section that assesses RSC  compliance with the Program Integrity Guidelines and makes  recommendations to mitigate vulnerabilities for staff fraud. For example,  the completed monitoring report for one RSC recommended upgrading  the locks for its file library to an electronic system enabled by iris or  fingerprint scan as a step to mitigate vulnerabilities of staff fraud. Further,  program officers also have administered questionnaires to RSC directors  and caseworkers to gather feedback on RSC procedures. In these  questionnaires, State has asked RSC directors to comment on RSC  procedures concerning hiring and training new staff. During the period of  our review, State provided us with the most recent monitoring reports for  each of the RSCs that had completed one.
section_title: State and RSCs Have Taken Steps to Assess Staff Fraud Risks, but Some RSCs Have Not Conducted Risk Assessments or Examined the Suitability of Fraud Controls
paragraphs: State has taken some steps to assess the risks posed by staff fraud to  RSC operations. For example, in 2015, a contractor hired by State  completed a report assessing (1) areas of vulnerability to staff fraud at  RSCs, (2) current measures to address vulnerabilities and their  effectiveness, (3) important factors in preventing staff fraud, and (4)  optimization of State monitoring of RSCs. The report made a number of  recommendations regarding potential staff fraud risks.
Although State has taken steps to assess staff fraud risks, not all RSCs  have conducted staff fraud risk assessments that follow leading practices  identified in the Fraud Risk Framework, including (1) conducting  assessments at regular intervals or when the program experiences  changes, (2) tailoring assessments to the program and its operations, and  (3) examining the suitability of existing fraud controls. State officials told  us that not all RSCs had conducted staff fraud risk assessments because  State’s Program Integrity Guidelines recommend but do not require these  assessments. Without State requiring RSCs to conduct regular staff fraud  risk assessments tailored to their specific operations, staff fraud risk  assessments conducted by individual RSCs have varied. While officials  from six of the nine RSCs stated that they had completed some form of  staff fraud risk assessment, officials from four of them stated that they  had done so only once. Additionally, only two of the nine RSCs have  conducted staff fraud risk assessments specifically tailored to their  operations. Further, State and most RSCs have not examined the  suitability of existing fraud controls, another recommended leading  practice in the Fraud Risk Framework. For example, while one RSC has  regularly assessed the suitability of its existing staff fraud controls by  conducting regular staff fraud risk assessments that examine the  likelihood and impact of potential fraudulent activity and related fraud  controls, the remaining eight RSCs have not done so. State officials told  us that because State does not require RSCs to conduct risk  assessments, information needed to assess the suitability of existing  controls is not available from all RSCs.
GAO’s Standards for Internal Control in the Federal Government states  that changes in conditions affecting an entity and its environment often  require changes to the entity’s internal control system, as existing controls  may not be effective for addressing risk under changed conditions. For  instance, a study of USRAP conducted at State’s request notes that as  the number of refugees has increased in recent years, the potential for  staff fraud committed against refugees has increased as well. According  to this report, refugees may become more susceptible to participating in  acts of staff fraud as they become more desperate to reach another  country. As the number of refugees accepted varies each year by RSC,  internal control systems may need to be changed to respond to the  potential increased fraud risk. Moreover, as described earlier, individual  RSCs face challenges complying with some of the existing fraud controls  outlined in the Program Integrity Guidelines. Examining the suitability of  these controls could help managers identify areas where existing control  activities are not suitably designed or implemented to reduce risks to a  tolerable level. Based on this analysis, managers could prioritize and  target areas of residual risk.
Without requiring RSCs to conduct regular staff fraud risk assessments  that are tailored to their specific operating environments and reviewing  these assessments to examine the suitability of existing fraud controls,  State may lack necessary information about staff fraud risks and therefore  not have reasonable assurance that existing controls effectively reduce  these risks. Information from such risk assessments could help State and  RSCs revise existing controls or develop new controls to mitigate the staff  fraud risks faced by the program, if necessary.
section_title: Conclusions
paragraphs: Each year, the United States resettles tens of thousands of refugees from  around the world as part of its humanitarian commitment in the  international community. The refugee admissions process relies on RSC  staff to coordinate and manage refugee applications. Accordingly, staff  fraud can undermine the integrity of the program. To reduce these risks,  State and RSCs have instituted several antifraud activities, many of which  correspond with leading antifraud practices. One of these activities is  designing and implementing antifraud controls. For instance, State has  required that RSCs comply with 72 staff fraud control measures. While  RSCs have complied with most of these measures, persistent gaps  remain. Pursuing efforts to ensure RSC compliance with these controls is  essential to reducing the risks of staff fraud.
Additionally, some RSCs have not conducted regular risk assessments  tailored to their operations or examined the suitability of existing fraud  controls. Without these assessments, State and RSCs may not be able to  identify the staff fraud risks affecting their programs, fully assess the risks  associated with noncompliance with staff fraud control measures, or  evaluate the effectiveness of their control activities. In conjunction with  antifraud controls already put in place by State and RSCs, additional  steps could strengthen existing controls, assess future staff fraud risks to  the program, and better support the integrity of USRAP.
section_title: Recommendations for Executive Action
paragraphs: 1.  To support efforts to reduce staff fraud at RSCs, the Secretary of  State should direct the Bureau of Population, Refugees, and Migration  to actively pursue efforts to ensure that RSCs comply with required,  applicable measures in the Program Integrity Guidelines.  2.  To better identify risks from RSC staff fraud, the Secretary of State  should direct the Bureau of Population, Refugees, and Migration to  update guidance, such as the Program Integrity Guidelines, to require  each RSC to conduct regular staff fraud risk assessments that are  tailored to each RSC’s specific operations.  3.  To help ensure that control activities are designed to mitigate  identified RSC staff fraud risks, the Secretary of State should direct  the Bureau of Population, Refugees, and Migration to regularly review  RSC staff fraud risk assessments and use them to examine the  suitability of existing staff fraud controls and revise controls as  appropriate.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of the sensitive version of this report to the  Departments of State and Homeland Security for review and comment.  State provided written comments that are reprinted in appendix I. State,  DHS, and UNHCR also provided technical comments, which we have  incorporated as appropriate. State deemed some of the information in  their original agency comment letter pertaining to RSCs’ reported  compliance with the Program Integrity Guidelines to be sensitive, which  must be protected from public disclosure. Therefore, they have redacted  the sensitive information in the department’s comment letter, which is  included in appendix I. These redactions did not have a material effect on  the substance of the department’s comments.
State concurred with our recommendations and agreed that implementing  these activities could reduce the risk of staff fraud at RSCs. State noted  that it has developed new guidance to enhance the monitoring of RSCs,  which outlines roles, responsibilities, and tools for program officers and  refugee coordinators.
We are sending copies of this report to the appropriate congressional  committees, the Secretaries of State and Homeland Security, and other  interested parties. In addition, the report is available at no charge on the  GAO website at http://www.gao.gov.
Should you or your staff have questions about this report, please contact  me at (202) 512-9601 or melitot@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix II.
section_title: Appendix I: Comments from the Department of State
section_title: Appendix II: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
paragraphs: Thomas Melito, (202) 512-9601, or melitot@gao.gov.
section_title: Acknowledgments
paragraphs: In addition to the contact named above, Elizabeth Repko (Assistant  Director), Brian Hackney (Analyst-in-Charge), Ashley Alley, Kathryn  Bernet, Anthony Costulas, Rebecca Gambler, Cynthia Grant, Paul  Hobart, Mona Nichols Blake, Michael McKemey, Mary Pitts, Sean  Sannwaldt, and Su Jin Yon made significant contributions to this report.  Debbie Chung, Martin De Alteriis, Neil Doherty, Mark Dowling, Thomas  Lombardi, Erin McLaughlin, and Mary Moutsos provided technical  assistance.