Under the EB-5 Program Regional Center model, first enacted as a pilot program in 1992 and reauthorized numerous times since, a certain number of the EB-5 visas are set aside annually for immigrant investors investing within economic units called regional centers, which are established to promote economic growth. Most recently, the EB-5 Program Regional Center model was extended until September 30, 2016. Immigrant investors can choose to invest on their own or with others directly in a business, or they may use a regional center to pool their investment with those of other immigrant investors and other foreign and U.S. investors to develop larger projects owned and managed by others. Immigrant investors must demonstrate that their investment in a new commercial enterprise will result in the creation or, in the case of a troubled business, preservation or creation (or some combination of the two), of at least 10 full-time positions for qualifying employees. In recent years, the EB-5 Program has increased in popularity as a viable source of low-interest funding for major real estate development projects, such as the Barclays Center--a multipurpose indoor arena in Brooklyn, New York--and the Marriott Convention Center Hotel in Washington, D.C. Individuals seeking to establish a regional center under the EB-5 Program must submit an initial application and supporting documentation as well as an update for each fiscal year (or as otherwise requested by USCIS) showing that the regional center continues to meet the program requirements to maintain its regional-center designation. Prospective regional-center principals apply to the program by submitting Form I-924, Application for Regional Center under the Immigrant Investor Pilot Program. On this form, applicants are to provide a proposal, supported by economically or statistically valid forecasting tools, that describes, among other things, how the regional center (1) focuses on a geographic area of the United States; (2) will promote economic growth through increased export sales and improved regional productivity, job creation, and increased domestic capital investment; and (3) will create jobs directly or indirectly. Applicants must also include a detailed statement regarding the amount and source of capital committed to the regional center, as well as a description of the promotional efforts they have taken and planned. Once a regional center has been approved to participate in the program, a designated representative of the regional center must file a Form I-924A, Supplement to Form I-924, for each fiscal year, to provide USCIS with updated information demonstrating that the regional center continues to promote economic growth, improved regional productivity, job creation, or increased domestic capital investment within its approved geographic area. USCIS is to issue a notice of intent to terminate the participation of a regional center if the center fails to submit the required information or upon a determination that the regional center no longer serves the purpose of promoting economic growth. As shown in figure 1, prospective immigrant investors seeking to participate in the EB-5 Program must complete three forms and provide supporting documentation as appropriate. Supporting documentation is assessed to ensure that the prospective immigrant investors have met (1) the terms of participation for the program, (2) criteria for lawful admission for permanent residence on a conditional basis, and (3) requirements of the program to have the conditional basis of his or her lawful permanent resident status removed. As of August 2016, USCIS had approved approximately 851 regional centers spread across 48 states, the District of Columbia, and four U.S. territories; and had terminated the participation of 61 regional centers for not filing a Form I-924A or not promoting economic growth. The Fraud Risk Framework identifies leading practices for agencies to manage fraud risks. It includes control activities that help agencies prevent, detect, and respond to fraud risks as well as structures and environmental factors that influence or help managers achieve their objectives to mitigate fraud risks. The framework consists of four components for effectively managing fraud risks: commit, assess, design and implement, and evaluate and adapt (see fig. 2). Leading practices for each of these components include the following: (1) commit: create an organizational culture to combat fraud at all levels of the agency, and designate an entity within the program office to lead fraud risk management activities; (2) assess: assess the likelihood and impact of fraud risks, determine risk tolerance, examine the suitability of existing controls, and prioritize residual risks; (3) design and implement: develop, document, and communicate an antifraud strategy, focusing on preventive control activities; and (4) evaluate and adapt: collect and analyze data from reporting mechanisms and instances of detected fraud for real-time monitoring of fraud trends, and use the results of monitoring, evaluations, and investigations to improve fraud prevention, detection, and response. Since August 2015, USCIS has continued to take steps intended to enhance its fraud-detection activities. This includes conducting and planning risk assessments to gather additional information on potential fraud risks to the program. USCIS is also taking steps to collect more applicant and petitioner information through a random site visit pilot and expanding its use of background checks, among other things, to help improve its ability to identify specific incidence of fraud. Further, USCIS has taken preliminary steps to digitize and analyze the paper files submitted by petitioners and applicants to the program. However, the EB- 5 Program is hampered by a reliance on voluminous paper files, and failing to carry through with these planned efforts could limit USCIS's ability to improve fraud risk management. USCIS is currently conducting multiple risk assessments to help assess fraud risks to the program and has plans for future assessments. DHS concurred with our August 2015 recommendation that USCIS plan and conduct regular fraud risk assessments of the EB-5 Program in the future. In January 2016 and April 2016, USCIS officials updated us about their ongoing actions to conduct and plan risk assessments for the program. These assessments include a current study of potential fraud associated with certain immigrant investors' source of funds, a random site visit pilot that is planned for completion later this year, and a planned study of all national-security concerns associated with the program: Source-of-funds study: FDNS is leveraging overseas staff to attempt to identify potential sources of fraud stemming from immigrant investors' false statements regarding their source of funds to provide their investment in the program. Site-visit pilot: According to agency officials' statements and documentation we reviewed, FDNS is designing and implementing a plan to conduct random site visits. According to agency officials, the visits will also serve to improve their assessment of fraud risks, and, according to documentation, will be random, in-person, and unannounced, and are intended to, among other things, provide enhanced integrity of the EB-5 program by increasing compliance with statutory and regulatory requirements, as well as deterring regional center and investor fraud. According to agency officials and agency documentation, a total of 50 site visits in four different states are planned. An agency official stated that the first site visits began in August 2016. Another official stated that they anticipate conducting additional site visits on both a continual and as-needed basis. National-security concerns: In April 2016, FDNS officials stated that they also planned to conduct a risk assessment of all previously identified national-security concerns for the program but did not have final details to provide at the time of our review. Based on past and current risk assessments, a senior FDNS official stated that the most frequent incidents of fraud in the program were associated with securities fraud, whereby immigrant investors were defrauded by unscrupulous regional-center principals and their associates. The official's comments are consistent with our August 2015 findings that over half of ongoing investigations associated with the program related to securities fraud. In our report we also noted that the EB-5 program faced unique fraud risks compared to other immigration programs that included uncertainties in verifying that the funds invested were obtained lawfully and various investment-related schemes to defraud investors. For example, we reported that in one instance, a couple created a regional center and solicited immigrant investors with promises of investing in a local energy company. Instead of investing in that project, the couple used investor funds to, among other things, buy cars for themselves and regional-center employees, and invest in a financially troubled restaurant. Along with its risk assessments, since August 2015, USCIS has continued to take steps to improve its ability to identify potential instances of fraud. USCIS is taking various steps to capture and utilize additional information from its immigrant investor and regional-center program participants and is obtaining additional resources to aid its oversight. These actions were taken in part as a response to our August 2015 recommendation for USCIS to develop a strategy to expand information collection to strengthen fraud prevention, detection, and mitigation capabilities. According to USCIS officials, the EB-5 program has issued updated petition and application forms for public comment and anticipates publishing the revised forms in final in fiscal year 2017. These updated forms would help capture additional information about petitioners and applicants that could be used to potentially identify fraud. Along with capturing additional self-reported information from petitioners and applicants, USCIS officials stated that they are exploring increased use of Financial Crimes Enforcement Network (FinCEN) checks to identify potential fraudulent actors in the program, especially for regional-center applicants. Moreover, USCIS is exploring the potential use of a new process to allow interviews of immigrant investor petitioners seeking the removal of their conditional status at the I-829 stage, according to agency officials and documentation. According to agency documentation, this effort is in part a response to our August 2015 report, which recommended that USCIS develop a strategy to expand information collection such as considering the increased use of interviews at the I-829 phase. If implemented, the interviews will be conducted by knowledgeable USCIS officials based in Washington, D.C. As of August 2016, the officials stated that a limited number of pilot interviews had already taken place, and, as a result of these and additional pilot interviews, USCIS plans to refine and develop a comprehensive interview strategy. Further, to help the EB-5 program improve oversight, USCIS officials stated that they are working to improve their ability to track and report data related to EB-5 investments and job creation through the planned development of a case-management system. In August 2016, USCIS officials reported that a preliminary scoping meeting had been held and that project completion was tentatively planned for some time in fiscal year 2017. USCIS is also taking steps to obtain additional resources for program oversight. For example, FDNS has increased its number of authorized positions from 21 to 25 full-time equivalent staff and has added student intern positions and administrative support. According to agency officials and documentation, USCIS's IPO has also created a specialized group focused primarily on regulatory compliance of existing regional centers to help ensure that the centers continue to serve their purpose of promoting economic growth. Among other things, the compliance unit is expected to help coordinate referrals, such as potential fraud referrals, to FDNS and house an audit function, which anticipates conducting its first audit activities later in 2016. Officials expect that the audits will be conducted on-site at regional centers and that they will include a review of the centers' compliance with applicable laws and regulations. Most recently, USCIS has also issued proposed changes for public comment to increase the filing fees for immigrant investors and regional-center applicants either seeking to participate or currently participating in the program. Specifically, USCIS has proposed more than doubling the initial Form I-526 filing fee from $1,500 to $3,675, nearly tripling the I-924 regional- center designation or amendment fee from $6,230 to $17,795, and adding a new I-924A annual filing fee of $3,035. These new fees are designed to allow USCIS to fully recover the costs of the services it provides and also aid its efforts in administering the program including fraud-identification efforts. For example, the proposed rule requests increased fees to conduct additional oversight work such as through site visits. Moreover, USCIS officials stated that they are also developing standard operating procedures for adjudication staff for each immigrant investor form, which the agency plans to finalize by the end of calendar year 2016 or the first quarter of fiscal year 2017. These new procedures could help standardize and improve USCIS's adjudication processes, which could improve the ability of its staff to detect potential instances of fraud. We found in August 2015 that USCIS is unable to comprehensively identify and address fraud trends across the program because of its reliance on paper-based documentation and because it faces certain limitations with using available data and with collecting additional data on EB-5 immigrant investors or investments. Agency officials noted that the state of information within the program precluded certain fraud-detection and analysis efforts such as the development of an automated risk- weighting system to prioritize petitions and applications at higher risk of fraud. These issues continue to exist. Based on our review of 20 applications and petitions, we similarly determined that identifying fraud indicators in these petitions and applications is extremely challenging. These challenges exist in part because many of the files were several thousand pages long and would take significant time to review. According to USCIS documentation, the program anticipates receiving around 14,000 petitions and applications a year, and the average submission is approximately 1,000 pages in length, for a cumulative total of about 14 million pages that, based on current capabilities, would need to be reviewed manually. According to agency documentation, the average review time for an EB-5 filing can range from 5.5 hours for an I-829 removal of conditions petition to 40 hours for an I-924 application for a new regional center. We also found in August 2015 that USCIS planned to collect and maintain more readily available data on EB-5 Program petitioners and applicants through the deployment of electronic forms in its new system, the USCIS Electronic Immigration System (ELIS). However, according to agency officials, they do not anticipate capturing supporting information provided as evidence in the petitions and applications in USCIS ELIS in the near term. According to an FDNS official, this supporting information can be an important source of potential fraud indicators as it contains details such as business plans associated with the investment. Recognizing the limitations associated with its reliance on paper files, in January 2016 USCIS officials stated that they were analyzing alternatives to evaluate and compare the effectiveness, suitability, costs, and risks associated with different potential hardware and software solutions to detect fraud patterns across its EB-5 applications. In February 2016, USCIS completed a draft of this study, which evaluated both hardware and software options to support fraud detection in both the EB-5 and asylum programs. The study evaluated several document-conversion alternatives including hardware and software tools to scan paper files and convert them to digital text, as well as text analytic alternatives such as software that allows for the detailed analysis of text similar to that used for computer-aided plagiarism detection. For example, this software could be used to identify duplicate passages in different petitions and applications, which could indicate potential fraud. The study reported a number of challenges associated with digitizing and analyzing petitioner and applicant information for the EB-5 program. For example, the study noted that implementing text analytic techniques for computer-aided plagiarism detection will likely be costly since many software packages do not offer this capability without substantial modification. Based on the results of this study, USCIS officials told us that they were developing a set of proposals for management review and potential approval; however, these efforts remained in their development stages and were being reviewed by USCIS stakeholders for feedback, recommendation, and acceptance prior to procurement activities. FDNS officials stated that, at this time, they were optimistic that actions would be taken but were ultimately uncertain to what extent, if any, the proposals would be acted upon. USCIS continues to take steps to improve overall fraud risk management but has not incorporated certain leading practices that could benefit its efforts. Generally, USCIS has followed or partially followed selected leading practices identified in GAO's Fraud Risk Framework, such as having a commitment to establishing a culture of fraud risk management in the agency. However, USCIS has not developed a fraud risk profile, a component of the Fraud Risk Framework that helps inform an agency's decisions and plans to mitigate fraud risks. USCIS has taken some key steps that align with the leading practices in the Fraud Risk Framework. In particular, USCIS has taken actions that closely align with the first and second components, which call for federal managers to (1) commit to combating fraud by creating an organizational culture and structure conducive to fraud risk management; and (2) plan regular fraud risk assessments and assess risks to determine a fraud risk profile. For example, USCIS officials stated that they are committed to creating an organizational culture to combat fraud at all agency levels through leadership that is committed to assessing fraud risks and for training at all levels for adjudicators. In August 2015, we reported that FDNS had also developed and provided training on specific fraud-related topics believed to be immediately relevant to adjudication of EB-5 Program petitions and applications. We found that FDNS is the unit charged with preventing, detecting, and responding to allegations of fraud in the program and represents a dedicated entity for managing fraud risks, which is consistent with the Fraud Risk Framework's leading practices. With respect to assessing risks, as mentioned previously, USCIS is currently conducting multiple assessments to help it identify and manage EB-5 program fraud risks. The Fraud Risk Framework calls for agencies to plan regular fraud risk assessments to determine a fraud risk profile. We found that the risk assessments conducted for the program generally aligned with this component of the Fraud Risk Framework. For example, through one of these prior risk assessments, USCIS determined that enhanced security checks conducted by other federal entities, such as the Federal Bureau of Investigation and U.S. Customs and Border Protection, revealed information that could help identify potential fraud by the immigrant investor or the regional-center principal. As a result, USCIS now conducts selected background checks on all of its immigrant investors and regional-center principals. Most recently, according to a senior FDNS official, USCIS also signed a memorandum of understanding with FinCEN and anticipates conducting additional reviews to help identify potential fraudulent financial activity in its regional centers. While USCIS has taken steps to implement selected leading fraud- management practices, we found that USCIS has not developed a fraud risk profile--an overarching document that guides an organization's fraud-management efforts--as called for by the Fraud Risk Framework. Specifically, a fraud risk profile involves identifying inherent fraud risks affecting a program; assesses the likelihood and impact of these risks; determines a fraud risk tolerance; and examines the suitability of existing fraud controls and prioritizes residual fraud risks. (App. I describes the key elements of a fraud risk profile.) Instead, USCIS's completed and planned risk assessments span multiple years and were developed as separate documents and reports, and USCIS lacks a unifying document that consolidates these findings and informs the specific control activities managers design and implement. A senior FDNS official told us that FDNS is beginning the development of a fraud-management plan to help guide efforts for the program, but these efforts were in their early stages. Moreover, the official stated that they did not anticipate incorporating a fraud risk profile as part of their fraud-management plan. Without a profile, managers may lack an important tool that can serve as an internal benchmark in assessing the performance of fraud-control activities. Further, a profile can provide additional assurances to stakeholders and decision makers on the fraud risks to programs as well as steps taken to manage those risks. This fraud risk profile can include all elements of the prior risk assessments and any updates, serving as a central reference document that can inform and help initiate actions. Absent a fraud risk profile, USCIS may not be well positioned to identify and prioritize fraud risks in the EB-5 Program and ensure the appropriate controls are in place to mitigate these risks. USCIS has taken a number of steps recently to enhance its fraud- detection capabilities throughout the EB-5 Program. However, the anticipated benefits of these steps may take time to realize. In the meantime, the agency continues to be hindered by a reliance on time- consuming reviews of paper files that preclude certain potential fraud- detection activities such as the use of text analytics to help identify indicators of potential fraud in the applications and petitions of regional- center principals and immigrant investors. The continuation of planned efforts to digitize the files, including the supporting evidence submitted by applicants and petitioners, could help USCIS better identify fraud indicators in the program. Moreover, USCIS has incorporated several leading fraud risk management practices into its efforts, including committing to creating an organizational culture that combats fraud risks and assessing those risks through regular risk assessments. However, USCIS would be better positioned to prioritize and respond to evolving fraud risks by adopting an approach that is guided by a fraud risk profile, as called for by the Fraud Risk Framework. To strengthen USCIS's EB-5 Program fraud risk management, we recommend the Director of USCIS develop a fraud risk profile that aligns with leading practices identified in GAO's Fraud Risk Framework. We provided a draft of this report to DHS for its review and comment. In its written comments, reproduced in appendix II, DHS concurred with our recommendation and stated that USCIS will develop a fraud risk profile as described with estimated completion by September 30, 2017. We will continue to monitor the agency's efforts in this area. Upon completion and use of a fraud risk profile to guide its fraud risk management, USCIS will be better positioned to prioritize and respond to evolving fraud risks. DHS also provided technical comments, which we incorporated as appropriate. We are sending copies of this report to interested congressional committees and the Secretary of Homeland Security. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. In addition to the contact named above, Gabrielle Fagan and Linda Miller, Assistant Directors; Jon Najmi; Anna Maria Ortiz; Brynn Rovito; Kiran Sreepada; and Nick Weeks made key contributions to this report. The Framework for Managing Fraud Risks in Federal Programs (Fraud Risk Framework) identifies leading practices for agencies to manage fraud risks. It includes control activities that help agencies prevent, detect, and respond to fraud risks as well as structures and environmental factors that influence or help managers achieve their objectives to mitigate fraud risks. The framework consists of four components for effectively managing fraud risks: commit, assess, design and implement, and evaluate and adapt. Leading practices for each of these components include the following: (1) commit: create an organizational culture to combat fraud at all levels of the agency, and designate an entity within the program office to lead fraud risk management activities; (2) assess: assess the likelihood and impact of fraud risks, and determine risk tolerance, examine the suitability of existing controls, and prioritize residual risks; (3) design and implement: develop, document, and communicate an antifraud strategy, focusing on preventive control activities; and (4) evaluate and adapt: collect and analyze data from reporting mechanisms and instances of detected fraud for real-time monitoring of fraud trends, and use the results of monitoring, evaluations, and investigations to improve fraud prevention, detection, and response. The fraud risk profile is an essential piece of the antifraud strategy, as described in the "Design and Implement" section of the Fraud Risk Framework, and informs the specific control activities managers design and implement. The elements in table 1 reflect key elements of fraud risk assessments and the fraud risk profile. The table is meant solely for illustrative purposes to show one possible format for agencies to document their fraud risk profile. The table shows information related to one fraud risk; however, a robust fraud risk profile would include information about all fraud risks that may affect a program. Documenting fraud risks together can aid managers in understanding links between specific risks. In addition, other tools a program uses to assess risks, such as the risk matrix discussed in the "Assess" section of the Fraud Risk Framework, can supplement the documentation for the fraud risk profile. We adapted the table and additional information below it from Standards for Internal Control in the Federal Government, as well as a publication by the Australian National Audit Office and one cosponsored by the Institute of Internal Auditors, the American Institute of Certified Public Accountants, and the Association of Certified Fraud Examiners. The following is additional information about the elements in table 1. Identified Fraud Risks. What fraud risks does the program face? Include a brief description of the fraud risk or scheme. This list will vary by program, and may be informed by activities to gather information during the fraud risk assessment, such as interviews with staff, brainstorming sessions, and information from hotline referrals. Fraud Risk Factors. What conditions or actions are most likely to cause or increase the chances of a fraud risk occurring? This may reflect fraud risk factors highlighted in Standards for Internal Control in the Federal Government, as well as other factors that provide additional details about specific fraud risks. Fraud Risk Owner. Which group or individual within the program is responsible for addressing the risk? The owner of the fraud risk will vary by program, but generally the owner this is the entity with accountability for addressing the fraud risk. Inherent Risk Likelihood and Impact. In the absence of controls, how likely is the fraud risk and what would the impact be if it were to occur? As noted in the "Assess" section of the Fraud Risk Framework, the specific methodology for assessing the likelihood and impact of risks will vary by agency. One option for assessing likelihood is to use a five-point scale, as noted in table 1. When considering impact, participants of the fraud risk assessment may consider the impact of fraud on the program's compliance with laws and regulations, operations, and reputation. Inherent Risk Significance. In the absence of controls, how significant is the fraud risk based on an analysis of the likelihood and impact of the risk? While the specific methodology for assessing risks may vary by agency, including qualitative and quantitative methodologies, managers may multiply the likelihood and impact scores, or apply a five-point scale. Existing Antifraud Controls. What controls does the program already have in place to reduce the likelihood and impact of the inherent fraud risk? This is intended to assist with mapping the existing controls to the fraud risks or schemes, which would reduce the likelihood and impact of a fraud risk occurring. Residual Risk Likelihood and Impact. Taking into account the effectiveness of existing controls, how likely is the fraud risk and what would the impact be if it were to occur? Managers may consider assessing both the residual likelihood and impact of fraud risks using the five-point scale described in table 1. Controls that are not properly designed or operating effectively may contribute to high residual risk. Residual Risk Significance. How significant is the fraud risk based on an analysis of the likelihood and impact, as well as the effectiveness of existing controls? Like inherent risk significance, qualitative and quantitative methodologies may be used to establish residual risk significance. Fraud Risk Response. What actions does the program plan to address the fraud risk, if any, in order to bring fraud risks within managers' risk tolerance?

Summary:
Congress created the EB-5 visa category to promote job creation and capital investment by immigrant investors in exchange for lawful permanent residency and a path to citizenship. Participants must invest either $500,000 or $1 million in a business that is to create at least 10 jobs. Upon meeting program requirements, immigrant investors are eligible for conditional status to live and work in the United States and can apply to remove the conditional basis of lawful permanent residency after 2 years. In August 2015, GAO reported on weaknesses in certain USCIS fraud mitigation activities, and made two related recommendations. GAO was asked to review actions taken by USCIS to address fraud risks in the EB-5 program since its August 2015 report. This report examines the extent to which USCIS (1) has taken steps to enhance its fraud detection and mitigation efforts; and (2) has incorporated selected leading fraud risk management practices into its efforts. GAO reviewed relevant program documentation and information; selected and reviewed a random, nongeneralizable sample of immigrant investor petitions and regional-center applications submitted between fiscal years 2010 and 2014; and compared USCIS's actions against GAO's Fraud Risk Framework. The Department of Homeland Security's U.S. Citizenship and Immigration Services (USCIS) has recently taken steps intended to enhance fraud detection and mitigation activities for the Employment-Based Fifth Preference Immigrant Investor Program (EB-5 Program) and address previous GAO recommendations. This includes actions such as conducting and planning additional risk assessments to gather additional information on potential fraud risks to the program. For example, USCIS is leveraging overseas staff to investigate potential fraud associated with unlawful sources of immigrant investor funds and is conducting a site visit pilot to help assess the potential risks of fraud among EB-5 program investments. USCIS is also taking steps to collect more information about EB-5 program investments and immigrant investors through new, revised forms and expanding its use of background checks, among other things, to help improve its ability to identify specific incidence of fraud. However, fraud mitigation in the EB-5 Program is hindered by a reliance on voluminous paper files, which limit the agency's ability to collect and analyze program information. In its review of a nongeneralizable selection of files associated with EB-5 program regional centers and immigrant investors, GAO found that identifying fraud indicators is extremely challenging. For example, many of these files were several thousand pages long and would take significant time to review. According to USCIS documentation, the program anticipates receiving approximately 14 million pages of supporting documentation from its regional-center applicants and immigrant investor petitioners annually. Recognizing these limitations, USCIS has taken preliminary steps to study digitizing and analyzing the paper files submitted by petitioners and applicants to the program, which could help USCIS better identify fraud indicators in the program; however, these efforts are in the early stages. USCIS has incorporated selected leading fraud risk management practices into its efforts but could take additional actions to help guide and document its efforts. GAO's Fraud Risk Framework is a set of leading practices that can serve as a guide for program managers to use when developing efforts to combat fraud in a strategic, risk-based manner. USCIS's actions align with two key components of the Fraud Risk Framework: (1) commit to combating fraud by creating an organizational culture and structure conducive to fraud risk management such as by providing specialized fraud awareness training; and (2) assess risks by planning and completing regular fraud risk assessments. However, USCIS has not developed a fraud risk profile, an overarching document that guides its fraud management efforts, as called for in the Fraud Risk Framework. Instead, USCIS's risk assessments, spanning multiple years, were developed as separate documents and reports, and there is not a unifying document that consolidates and systematically prioritizes these findings. Without a fraud risk profile, USCIS may not be well positioned to identify and prioritize fraud risks in the EB-5 Program, ensure the appropriate controls are in place to mitigate fraud risks, and implement other Fraud Risk Framework components. GAO recommends that USCIS develop a fraud risk profile that aligns with leading practices identified in GAO's Fraud Risk Framework. The Department of Homeland Security concurred with GAO's recommendation.