As described in figure 1, to support U.S. exports, EXIM offers four major types of financing products: direct loans, loan guarantees, export-credit insurance, and working capital guarantees. Regardless of type, EXIM’s financing products generally have one of three maturity periods: Short- term transactions are for less than 1 year; medium-term transactions are from 1 to 7 years long; and long-term transactions are more than 7 years. As we reported in July 2018, for all financing types, EXIM currently conducts a number of preauthorization and postauthorization antifraud activities. See the examples shown in figure 2. Fraud and “fraud risk” are distinct concepts. Fraud—obtaining something of value through willful misrepresentation—can be challenging to detect and adjudicate because of its deceptive nature. Fraud risk exists when individuals have an opportunity to engage in fraudulent activity, have an incentive or are under pressure (e.g., financial pressures) to commit fraud, or are able to rationalize committing fraud. When fraud risks can be identified and mitigated, fraud may be less likely to occur. Although the occurrence of fraud indicates there is a fraud risk, a fraud risk can exist even if actual fraud has not yet been identified or adjudicated. According to the Standards for Internal Control in the Federal Government, executive-branch agency managers are responsible for managing fraud risks and implementing practices for combating those risks. Specifically, federal internal control standards call for agency management officials to assess the internal and external risks (including fraud risks) their entities face as they seek to achieve their objectives. The standards state that as part of this overall assessment, management should consider the potential for fraud when identifying, analyzing, and responding to risks. Risk management is a formal and disciplined practice for addressing risk and reducing it to an acceptable level. The leading practices in the Fraud Risk Framework call for agencies to identify inherent fraud risks affecting the program, examine the suitability of existing fraud controls, and then prioritize mitigating “residual” fraud risks—that is, risks remaining after antifraud controls are adopted. Specifically, according to the assess component of the Fraud Risk Framework, managers who effectively assess fraud risks attempt to fully consider the specific fraud risks the agency or program faces, analyze the potential likelihood and impact of fraud schemes, and then ultimately document prioritized fraud risks. Moreover, managers can use the fraud risk assessment process to determine the extent to which controls may no longer be relevant or cost-effective. Leading practices that are consistent with this component include conducting quantitative or qualitative fraud risk assessments at regular intervals, or both, of the likelihood and impact of inherent risks on the program’s objectives, and determining the agency’s risk tolerance for the inherent fraud risks; identifying specific sources for gathering information about fraud risks, including information on fraud schemes that are reflected in adjudicated cases of fraud; examining the suitability of existing fraud controls for preventing fraud and mitigating fraud risks identified; and documenting in the program’s fraud risk profile the analysis of the types of inherent fraud risks assessed, their perceived likelihood and impact, managers’ risk tolerance, and the prioritization of the inherent fraud risks and any residual fraud risks. As we reported in July 2018, the Fraud Reduction and Data Analytics Act of 2015 requires the Office of Management and Budget (OMB) to establish guidelines that incorporate the leading practices of GAO’s Fraud Risk Framework. The act also requires federal agencies to submit to Congress a progress report each year, for 3 consecutive years, on implementation of the risk management and internal controls established under the OMB guidelines. OMB published guidance under OMB Circular A-123 in 2016 affirming that federal managers should adhere to the leading practices identified in the Fraud Risk Framework. As we reported in December 2018, EXIM identifies itself as subject to the act, and, as such, follows it. The Fraud Risk Framework is also aligned with federal internal control standards, specifically Principle 8 (“Assess Fraud Risk”) of the Green Book. Federal internal control standards also state that excessive pressures, such as financial pressures (e.g., delinquent federal debt), can pose a fraud risk factor to agency programs as these pressures can provide an incentive or motive to commit fraud. Although the existence of financial pressure alone does not necessarily indicate that fraud exists or will occur, financial pressure is often present when fraud does occur. Applicants for EXIM programs who have delinquent federal debt may not be able to obtain certain types of financing until they resolve their debts. Specifically, under 31 U.S.C. § 3720B, applicants who are delinquent on federal nontax debts may not receive federal financial assistance, including such assistance provided by EXIM, until they satisfactorily resolve the delinquency (e.g., pay in full or negotiate a new repayment plan). However, 31 U.S.C. § 3720B also provides that an agency head may waive this restriction. Additionally, OMB’s Circular No. A-129, Policies for Federal Credit Programs and Non-Tax Receivables, prescribes to agencies the policies, procedures, and standards for screening program participants to determine whether they are delinquent on any federal debt when applying to federal credit programs. We identified fraud risks—generally involving four overall fraud risk factors—by examining EXIM-associated court cases of fraud adjudicated from calendar year 2012 through calendar year 2017. We then communicated these fraud risks to EXIM, and EXIM officials reported examples of existing controls it uses to help detect and mitigate these fraud risks. EXIM also provided documentation reflecting its efforts to conduct a fraud risk assessment that considered various fraud risks affecting its major financing product lines, including fraud risks we identified during this review. We identified fraud risks—generally involving four overall fraud risk factors—by examining 44 EXIM-associated closed court cases of fraud adjudicated from calendar year 2012 through calendar year 2017. Specifically, the various fraud risks we identified overall involved one or more of the fraud risk factors illustrated in figure 3 below: opportunities to falsify self-reported information on applications or financial pressures that potentially incentivized participants or employees to commit fraud; opportunities to circumvent or take advantage of EXIM or lender opportunities to circumvent the intent of EXIM’s programs by diverting loan proceeds and other EXIM financing for personal use or benefit instead of for the export of U.S. goods. See appendix I for a summary of these 44 cases we reviewed. These 44 cases illustrate the financial risks associated with fraud against EXIM. Federal and state courts combined have ordered restitution of $82.4 million in the 44 adjudicated cases, but much of that restitution has not yet been paid. For example, as of October 2018, the total remaining unpaid restitution amount is $71.6 million, or over 80 percent. In one fraud case we reviewed, which was adjudicated in 2013, a federal court ordered a convicted U.S. exporter to pay EXIM $8.6 million in restitution for the fraud that he committed in a loan guarantee program. Since 2013, the participant has paid back $25.00 of this amount. EXIM reported having existing antifraud controls to mitigate the fraud risks we identified. Specifically, we communicated to EXIM the fraud risks we identified from our review of the 44 adjudicated cases. In response, EXIM officials described general antifraud controls the agency currently uses to help detect and mitigate each of the fraud risks we identified. The officials stated that EXIM has experience with all the fraud risks we identified and stated that they were generally confident that EXIM’s antifraud controls were appropriate for mitigating the risks. EXIM officials consider many of the fraud risks that we identified as risks that could impact any of the agency’s financing programs (i.e., credit insurance, loan guarantees, direct loans, or working capital guarantee programs). EXIM officials provided examples of the general antifraud controls that they said EXIM uses to mitigate the fraud risks we identified across all agency financing products. According to EXIM officials and as illustrated in figure 4 below, these controls include: fraud prevention and detection procedures; due diligence standards; and a list of “red flags” that EXIM staff should be aware of and is used to identify indicators of potential fraud and corruption that may appear on EXIM transaction documents. Officials said that their confidence in the controls stems from seeing a reduction in fraud cases since the early 2000s after these antifraud controls were put in place. EXIM officials clarified that this confidence does not stem from completing a comprehensive fraud risk assessment of fraud risks impacting all of its financing products consistent with the leading practices in the Fraud Risk Framework. EXIM also provided documentation reflecting its efforts to conduct a fraud risk assessment that considered various fraud risks affecting its major financing product lines, including fraud risks we identified during this review. EXIM officials said that the fraud risks we identified were generally already known to EXIM as they relate to or are very similar to those fraud risk factors contained in EXIM’s list of red flags. EXIM officials acknowledged that assessing its fraud risks and evaluating the agency’s existing antifraud controls may indicate opportunities for EXIM to further adapt EXIM’s antifraud controls to mitigate any residual fraud risks within its tolerance level. Such assessments can further help EXIM mitigate fraud and the resulting effects across all product lines before they occur, which includes the length of time it can take for EXIM to fully recover from restitution losses after fraud has been perpetrated, as illustrated in the 44 cases presented in appendix I. EXIM has procedures for detecting delinquent federal debt owed by EXIM applicants and participants. However, EXIM is missing additional opportunities to use readily available SAM data to identify ineligible applicants or participants that may have delinquent federal debt, and to use such data to determine eligibility or assess repayment fraud risk. EXIM has procedures to detect delinquent federal debt owed by applicants and participants that include reviewing their credit reports and requiring applicants to certify that they and other participants do not have such delinquent debt. Under 31 U.S.C. § 3720B, applicants who are delinquent on federal nontax debts may not receive federal financial assistance, including direct loans, loan guarantees, or loan insurance until they satisfactorily resolve the delinquency (e.g., pay in full or negotiate a new repayment plan). 31 U.S.C. § 3720B does not address delinquent federal tax debt; however, such delinquent federal debt may also pose a fraud risk or repayment fraud risk to EXIM’s financing programs. Additionally, OMB Circular No. A-129 prescribes to agencies the policies, procedures, and standards for screening program participants to determine whether they are delinquent on any federal debt when applying to federal credit programs, including recommending that agencies ask applicants to self-certify on their applications that they have no delinquencies; requiring agencies to obtain and review applicants’ credit reports; and encouraging agencies to use appropriate databases, such as the Department of the Treasury’s Do Not Pay portal sources to identify delinquent federal debtors during the application screening process. According to EXIM officials, the agency employs procedures to ensure its policies and processes meet these requirements for applicable financing products. Specifically, and as illustrated in figure 5 below, these procedures include reviewing the following: Self-certifications: EXIM applications for relevant financing programs include a self-certification by the applicant that the applicant does not have delinquent federal debt. However, as we have reported in the past, relying on applicants to self-report adverse actions on their applications, instead of verifying such information, could cause an agency to miss opportunities to develop a more-complete picture of the applicants. Credit reports: EXIM obtains credit reports for applicants and participants in some financing products. In particular, EXIM’s internal Loan Guarantee and Credit Insurance Manual of 2015 communicates the 31 U.S.C. § 3720B restriction to loan officers and instructs them to review the borrower’s credit report to check whether the borrower is delinquent on any federal debt. If the loan officer finds that the credit report reflects such delinquent federal debt, the manual further instructs the loan officer to advise and request guidance from EXIM’s Trade Finance Director and the Office of General Counsel. However, as we have reported in the past, some delinquent federal tax debt may not appear on the credit reports unless the Internal Revenue Service has filed a lien on the delinquent federal tax debt. World Check: EXIM, through the assistance of a third-party vendor, also makes use of some data sources listed in the Do Not Pay sources as part of its prescreening application process and possibly during postauthorization risk-based reviews. Specifically, EXIM officials told us that EXIM uses Thomson Reuters’s World Check database to identify federal debts owed by applicants as part of its Character, Reputational, and Transaction Integrity (CRTI) review process that is managed by EXIM’s Credit Review and Compliance Division. The World Check database currently checks over 20 different watch lists and other databases, including lists of entities excluded from doing business with the federal government maintained in GSA’s SAM. According to EXIM, other sources in the World Check database that reveal such federal debts could also lead indirectly to the discovery of delinquent federal debt. However, as discussed below, this check of SAM does not involve a check of delinquent federal debt. This CRTI review process is conducted during the underwriting (i.e., the preauthorization review) phase and may occur throughout the life cycle of transactions, such as during EXIM’s postauthorization risk-based reviews. EXIM officials told us that, as part of this process, loan officers or other EXIM officials send the names of applicants to EXIM librarians, who perform a manual search of the World Check database, review results, and return relevant results to EXIM officials for their consideration. EXIM officials noted that this process can be challenging, particularly when librarians perform searches on applicants with common names, which produce many results that are not useful. EXIM officials told us that EXIM does not track information on instances in which an applicant’s delinquent federal debt prevents a transaction from moving forward or prevents a specific applicant’s participation in a transaction. Consequently, EXIM officials told us that EXIM has no records of this happening. However as described in greater detail below, EXIM does not make use of readily available SAM data to identify delinquent federal debts owed by applicants and participants, which could limit its ability to detect instances in which applicants and participants owe these debts. EXIM is missing additional opportunities to use readily available SAM registration data to identify potentially ineligible applicants and participants that may have delinquent federal debt or may otherwise pose a repayment fraud risk. Specifically, while EXIM employs procedures that may reveal applicants’ delinquent federal debts, as described above, EXIM’s procedures for identifying applicants and participants with delinquent federal debt do not include a search of a specific data element in the SAM database that can be used to detect delinquent federal debtors. The data element we refer to here is the Debt Subject to Offset flag, which may reflect both nontax and tax delinquent federal debts owed. As mentioned previously, SAM is a government-wide information system that federal agencies can use to obtain information on businesses that do business with the federal government, including an entity’s Debt Subject to Offset status. The Debt Subject to Offset data element in SAM indicates that the entity potentially has a delinquent federal debt subject to collection under the Treasury Offset Program. The GSA officials who maintain the SAM database told us that all federal agencies have the legal authority to use the SAM registration database free of charge. Specifically, all federal agencies can use this database to manually search by an entity’s name, Data Universal Numbering System number, or Tax Identification Number for the purpose of detecting whether the entity potentially has delinquent federal debt, such as by identifying whether an entity’s SAM record contains the Debt Subject to Offset flag. Further, GSA officials also told us that all federal agencies are able to request batches of SAM registration data free of charge, for the purpose of matching these data to agency data by entities’ names, Data Universal Numbering System numbers, or Tax Identification Numbers for the purpose of identifying entities that may have the Debt Subject to Offset flag in SAM, among other available data. Performing data analytics, such as batch matching, on available data is a leading practice cited in the Fraud Risk Framework that we have reported can help improve agency efforts to combat fraud. In particular, we have found in prior work that using available data to verify that EXIM’s transaction applicants are not delinquent on federal debt can help EXIM assure applicant eligibility is consistent with federal guidance, provide reasonable assurance of repayment, and help prevent fraud. We have also found that using available data to independently verify self-reported delinquent federal debt information, such as self-reported information on delinquent federal tax debt owed, is a key detection and monitoring component of fraud prevention. We identified additional opportunities for EXIM to manually use SAM’s online database or data-matching approaches to identify applicants or participants with potential delinquent federal debt. Specifically, we registered in SAM to conduct several manual searches (by entities’ Data Universal Numbering System numbers, Tax Identification Numbers, and names) and confirmed that it can be used to conduct such searches without incurring any external costs charged by GSA. For example, we conducted two Data Universal Numbering System number searches and found two active EXIM participants appearing in SAM’s registration database with a Debt Subject to Offset flag. We also obtained historical SAM data from GSA and EXIM transaction data and confirmed that these data sources could be used to identify EXIM applicants and participants with potentially delinquent federal debt in a batch match (rather than manual, case-by-case searches). As illustrated in our batch-matching results below, we found this data-matching process can provide an opportunity to match these data sets using the Tax Identification Numbers and Data Universal Numbering System numbers for the entities in both data sets. Our batch-matching analyses indicated that, from calendar year 2014 through calendar year 2016, EXIM authorized transactions that had an aggregate authorization value of approximately $34.3 billion. Of that amount, we found the following: An aggregate authorization value of about $1.7 billion was associated with 32 U.S.-based companies that had a delinquent federal debt indicator in SAM in the same month that these transactions were authorized. The transactions mostly involved U.S.-based applicants and exporters. As mentioned above, associated parties we reviewed included not only the applicant, but also participants involved, including the borrower, buyer, and exporter, which may or may not be the applicant. While the results of this analysis do not mean that EXIM should have suspended these transactions in accordance with 31 U.S.C. § 3720B, these results nonetheless indicate that the data in SAM that indicate delinquent federal debt could provide an opportunity for EXIM to identify important indicators of applicants or other transaction participants with potential delinquent federal debt when determining their program eligibility and assessing any related fraud risks or repayment risks they present during EXIM’s preauthorization CRTI reviews. Because the Debt Subject to Offset flag may indicate either nontax debts or tax debts, it is possible that some of these entities owed delinquent federal nontax debts that are applicable under 31 U.S.C. § 3720B, indicating EXIM should have considered suspending these transactions. However, it is also possible that some of these entities owed delinquent federal tax debts that are not applicable under 31 U.S.C. § 3720B, but that may pose a fraud risk or repayment risk nonetheless. By using the Debt Subject to Offset flag as an indicator of these delinquent federal debts and gathering additional information on the specific facts and circumstances of each case, EXIM would be better positioned to assess the relevant compliance, fraud, and repayment risks an applicant’s or participant’s delinquent federal debt may pose. An aggregate authorization value of about $4.1 billion was associated with 97 U.S.-based companies that had a delinquent federal debt indicator in SAM during the transaction maturity period (i.e., after the month they were approved, but before the transactions’ maturity date). These transactions mostly involved U.S.-based applicants and exporters. As mentioned above, associated parties we reviewed included not only the applicant, but also participants involved, including the borrower, buyer, and exporter, which may or may not be the applicant. 31 U.S.C. § 3720B may prevent applicants with federal financial debts from obtaining loans, guarantees, and insurance; thus, it does not apply to any delinquent federal debt accrued after loan approval. However, we looked at potential delinquent debt accrued after approval because delinquent debt accrued after approval and during the transaction maturity period might affect EXIM’s view of a financing product’s repayment risk. Further, EXIM already conducts similar postauthorization monitoring to identify such risks through its use of World Check as part of its CRTI process described above. Thus, these results nonetheless illustrate that EXIM can use SAM data during EXIM’s postauthorization CRTI reviews to identify transaction participants with potential delinquent federal debt and determine the extent to which they may pose a repayment fraud risk. Prior to sharing our results with EXIM, EXIM officials told us that they have access to SAM entity registration records, but they believe searching the SAM registration database is a time-consuming process that should be reserved for rare circumstances. Further, EXIM officials also told us that using the SAM registration database to identify applicants or participants that have the Debt Subject to Offset flag in SAM would yield few results because the vast majority of their financing program participants are foreign-based entities, and thus would not also be contractors for the U.S. government and registered in SAM. However, we identified many U.S.-based entities that had a delinquent federal debt indicator either in the month a transaction was approved, or during the transaction’s maturity period, by searching in the SAM database and analyzing SAM data for EXIM applicant and participants, as described above. Further, it is not clear whether performing manual searches or batch matches with SAM data to identify delinquent federal debtors would be any more time-consuming than EXIM’s current procedures for doing so, which include manual searches of World Check and obtaining and reviewing credit reports, as described above. When we met with EXIM officials to communicate our batch-matching results above, they expressed concern that these results could imply that EXIM is doing business with applicants or participants with delinquent federal debt. They then indicated that they were interested in obtaining SAM registration data so that they could determine whether it would be feasible for them to perform the same type of analysis that we performed. In a subsequent meeting, EXIM officials informed us that they were also able to obtain current SAM registration data, analyze the SAM data against active EXIM participant data, and find dozens of active EXIM participants with the Debt Subject to Offset flag in SAM. The results of our analyses, as well as EXIM’s own experience with the SAM data, suggest EXIM also has an additional and practical opportunity to incorporate searches of SAM entity registration data as part of its postapproval monitoring of transactions to enhance its monitoring of and response to risks in ongoing transactions. Standards for Internal Control in the Federal Government state that management should use quality data to achieve agency objectives. For example, this could include agencies obtaining relevant operational, financial, or compliance-related data from reliable internal and external sources in a timely manner based on identified information requirements, and then using such data to make informed decisions and evaluate performance in achieving program objectives and addressing risks. Without also pursuing available debt data in SAM’s registration database, as an additional layer of due diligence, to identify applicants with delinquent federal debt during underwriting and compliance reviews, EXIM is potentially forgoing practical opportunities to use such data when determining applicants’ program eligibility and to adopt leading practices for managing repayment fraud risks across EXIM’s financing programs. In particular, such available SAM data can provide opportunities to verify independently the applicants’ self-certification of delinquent federal debts they owe and assess whether the applicants may have misrepresented their delinquent federal debt status on their applications, which is a fraud risk in the application process; detect potential delinquent federal debts that are not apparent in credit make informed eligibility decisions during preauthorization CRTI reviews and assess repayment fraud risk during postauthorization CRTI reviews. EXIM assumes the credit and country risks that the private sector is unable or unwilling to accept, including the risk of losses due to fraud. EXIM’s financing products face various fraud risks, and EXIM has begun to take steps to consider these fraud risks as part of a full fraud risk assessment, as we recommended in July 2018. However, because it remains unclear whether EXIM’s actions fully respond to the recommendations of our July 2018 report, we will continue to monitor EXIM’s progress in fully assessing its fraud risks. EXIM also employs procedures to detect delinquent federal debt owed by EXIM applicants and participants. However, EXIM is missing opportunities to use readily available SAM data to identify applicants or participants that may misrepresent their delinquent federal debt status and pose a repayment fraud risk to EXIM financing programs. Applicants or participants with delinquent federal debt could be one of many repayment fraud risks that could indicate an increased risk of nonrepayment and incentives to commit fraud against EXIM. EXIM officials believe searching SAM is a time-consuming process that would yield few results. However, manually searching SAM’s online registration database for the purpose of determining whether an applicant or participant may have a Debt Subject to Offset flag may not be any more time-consuming than what EXIM currently performs through its preauthorization or postauthorization CRTI reviews. Nevertheless, we demonstrate in this report the practicality and illustrate results of using such data through multiple approaches, such as batch matching, without incurring any external costs charged by GSA. By assessing the practicality of searching SAM data, EXIM may determine that this source of data provides an additional tool for combating fraud. Implementing these antifraud activities could further help EXIM verify program eligibility, identify repayment fraud risk, and provide EXIM with reasonable assurance that it is effectively and efficiently carrying out its mission of supporting U.S. jobs and the export of U.S. goods. We are making the following two recommendations to EXIM: EXIM’s chief operating officer should direct EXIM’s Credit Review and Compliance Division to assess and document the practicality of incorporating into its preauthorization CRTI reviews searches of data elements in SAM that indicate delinquent federal debts owed by applicants, and, if practical, implement relevant approaches—such as manual searches or batch matching. (Recommendation 1) EXIM’s chief operating officer should direct EXIM’s Credit Review and Compliance Division to assess and document the practicality of incorporating into its postauthorization CRTI reviews searches of data elements in SAM that indicate delinquent federal debts owed by applicants and participants, and, if practical, implement relevant approaches—such as manual searches or batch matching. (Recommendation 2) We provided a draft of this report to EXIM for review and comment. In its written comments, reproduced in appendix II, EXIM concurred with our recommendations and stated that it will move forward to implement them. EXIM also provided technical comments, which we incorporated as appropriate. In its written comments, EXIM noted a number of points it referred to as “key concerns.” These points do not disagree with our findings, conclusions, or recommendations. Specifically, EXIM stated that the 44 cases we reviewed involved transactions that were approved between 2002 and 2012 and that it will continue to work with the Department of Justice to collect restitution payments. Additionally, EXIM stated that it is in full compliance with 31 U.S.C. § 3720B and the related provisions of OMB Circular A-129 guidance regarding restrictions on doing business with delinquent federal debtors. However, assessing EXIM’s compliance with 31 U.S.C. § 3720B or OMB Circular A-129 was outside the scope of this report. Finally, for the purpose of implementing our recommendations, EXIM requested the data pertaining to the U.S.-based companies that we found to have a delinquent federal debt indicator in SAM. To identify those companies, we used (1) an extract of data that EXIM provided to us, and (2) GSA SAM data, which EXIM told us it can and has already obtained directly from GSA. We will provide EXIM with a copy of the EXIM data it requested. However, we believe EXIM will be better positioned to assess the practicality of checking the SAM delinquent federal debt flag by continuing to obtain the SAM data directly from GSA. We are sending copies of this report to the appropriate congressional committees, the president and board chairman of EXIM, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staffs have any questions about this report, please contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. The table below summarizes the information we reviewed during our review of the 44 Export-Import Bank of the United States (EXIM)- associated cases of alleged fraud that we were able to identify and determine were adjudicated from calendar years 2012 through 2017. Such information includes financing product types, dates adjudicated, fraud schemes, fraud risk factors involved, and the amount of EXIM restitution owed and paid to EXIM. As mentioned earlier, the fraud risks we identified in these 44 cases related to one or more of the following four fraud risk factors: (1) opportunities to falsify self-reported information on applications or transaction documents, (2) financial pressures that potentially incentivized participants or employees to commit fraud, (3) opportunities to circumvent or take advantage of EXIM or lender controls, or (4) opportunities to circumvent the intent of EXIM’s financing programs by diverting loan proceeds and other EXIM financing for personal use or benefit instead of for the export of U.S. goods. In addition to the contact named above, Jonathon Oldmixon (Assistant Director), Flavio Martinez (Analyst in Charge), Mason Calhoun, Marcus Corbin, Anthony Costulas, Adam Cowles, David Dornisch, Heather Dunahoo, Paulissa Earl, Colin Fallon, Dennis Fauber, Jennifer Felder, Dragan Matic, Maria McMullen, Christopher H. Schmitt, Albert Sim, Sabrina Streagle, and Steve Westley made key contributions to this report.

Summary: As the export credit agency of the United States, EXIM's mission is to help support U.S. jobs by facilitating the export of U.S. goods and services through direct loans, loan guarantees, working capital guarantees, and credit insurance. In September 2018, the total outstanding and undisbursed amount of these products and unrecovered default claims was about $60.5 billion, according to EXIM. The Export-Import Bank Reform Reauthorization Act of 2015 included a provision for GAO to review EXIM's antifraud controls. This report (1) describes key antifraud controls EXIM says it has for mitigating fraud risks identified by GAO, and describes EXIM's efforts to perform a fraud risk assessment that considers these fraud risks; and (2) identifies EXIM's procedures to detect delinquent federal debt owed by applicants and participants, and assesses additional opportunities to use readily available data to do so. GAO analyzed 44 EXIM-associated court cases of fraud adjudicated from calendar years 2012 through 2017, examined EXIM transaction data, and interviewed EXIM and GSA officials. GAO also analyzed data identifying delinquent federal debt as well as EXIM's procedures for doing so. The Export-Import Bank of the United States (EXIM) reported having antifraud controls in place for mitigating the fraud risks that GAO identified and communicated to EXIM officials. GAO reviewed 44 EXIM-associated court cases involving fraud and identified fraud risks involving the four fraud risk factors illustrated in the figure below. GAO communicated these fraud risks to EXIM officials, and they provided examples of antifraud controls they use to help mitigate these fraud risks for their major financing products. In February 2019, EXIM also provided documentation reflecting its efforts to conduct a fraud risk assessment that considered various fraud risks affecting its major financing product lines, including fraud risks GAO identified during this review. EXIM has procedures to identify applicants and participants with delinquent federal debt, such as obtaining applicants' credit reports that may indicate these debts when they apply to EXIM's financing programs. However, EXIM is missing additional opportunities to use readily available data containing delinquent federal debt indicators from the General Services Administration's (GSA) System for Award Management (SAM) to detect applicants and participants that may have delinquent federal debt. Federal law states that applicants who are delinquent on federal nontax debts may not receive federal direct loans, loan guarantees, or loan insurance until the delinquent debt is satisfactorily resolved. Using data from SAM, GAO found that, from calendar years 2014 through 2016, EXIM authorized transactions that had an aggregate authorization value of about $1.7 billion and were associated with 32 U.S.-based companies that had a delinquent federal debt indicator in SAM in the same month EXIM authorized these transactions . While these results alone do not mean EXIM should have suspended these transactions, they do indicate that there is a practical opportunity to use SAM data to help determine applicants' eligibility. Without assessing the practicality of pursuing such readily available data, EXIM is potentially forgoing opportunities to perform additional due diligence that would help inform its decisions about applicants' and participants' program eligibility and fraud risks. GAO is recommending that EXIM assess the practicality of using available SAM data and data-analytical approaches to detect applicants and participants with potential delinquent federal debt. EXIM concurred with GAO's recommendations.