In the Telecommunications Act of 1996 (the 1996 Act), Congress specified that consumers in “rural, insular, and high-cost areas” should have access to telecommunication rates and services that are “reasonably comparable” to consumers in urban areas. The 1996 Act altered the federal mechanism for funding universal service by requiring telecommunications carriers and other entities providing interstate telecommunications service to contribute to the USF, unless exempted by FCC. The carriers generally pass these costs on to customers, sometimes in the form of a line item on customers’ telephone bills. USF provides financial support to carriers through four different programs, each targeting a particular group of telecommunications carriers or consumers. The high-cost program provides support to both wireline and wireless carriers that provide telecommunications services in areas that carriers would otherwise not serve and where there is no competition from other providers. These are typically rural or remote areas where the customer base is relatively small and the cost of installing infrastructure is high. The high-cost program has been the largest USF program based on disbursements and has been particularly important to rural areas. High- cost support is intended to offset the carriers’ higher costs, thereby allowing them to provide services and rates that are reasonably comparable to those that consumers in lower-cost—generally urban— areas receive. In 2009, Congress required FCC to develop a broadband plan to ensure that every American has access to broadband capability, including a detailed plan for providing this service at affordable rates. In response, an FCC task force issued the National Broadband Plan in 2010, which recommended reforming USF so it could support both telephone and broadband service. FCC’s USF Transformation Order of 2011 emerged in response to this recommendation and provided USF support to carriers for broadband capable networks. The order required carriers that receive support to meet broadband-speed and quality-deployment requirements. Through the USF Transformation Order, FCC adopted a framework to transition high-cost carriers from traditional cost-accounting support to incentive-based support mechanisms, using forward-looking broadband cost models and competitive bidding. FCC’s forward-looking cost models use historical data to project the future financial needs of carriers providing telecommunications services. According to FCC, rate-of-return carriers receive about $2.5 billion in annual support from the high-cost program to support service deployments in these carriers’ 1,078 rate-of- return service areas, which FCC refers to as “study areas.” FCC has allowed rate-of-return carriers to choose, on a voluntarily basis, one the following mechanisms to receive USF support: Traditional cost-accounting support mechanism. This method retroactively provides support to carriers for costs already incurred, based on cost studies, including financial statements these companies provide each year. At the time of our review, according to FCC officials, FCC guaranteed these companies recovery of eligible deployment costs, plus a return of 10.25 percent on regulated investment costs. According to FCC’s OIG officials we interviewed, many carriers contract with telecommunications accountants to navigate the complicated process of determining which costs are reimbursable by the high-cost program and file the associated documentation with USAC. According to FCC, as of September 2019, there were approximately 437 study areas served by rate-of- return carriers receiving support through this mechanism. Model-based support mechanism. This method is aimed at providing a level of support to carriers based on modeled forward- looking costs and revenues of an efficient carrier to serve an area with voice and broadband Internet. According to FCC officials, in developing the model, FCC: had experts peer-review the model’s methodology; demonstrated how different inputs affect model support and sought stakeholder feedback on the reasonableness of how these inputs affected support levels; publicly released the model’s methodology; and used historical deployment cost and revenue data to develop the model’s inputs and assumptions. As of September 2019, FCC officials told us that rate-of-return companies serving 641 study areas were receiving support through this mechanism (or almost 60 percent of all 1,078 rate-of-return carriers’ study areas). FCC determines overall policy and issues the regulations that govern the high-cost program, while FCC’s Wireline Competition Bureau in particular implements FCC’s policies and programs regarding rate-of-return carriers. State governments play a role in implementing the federal high- cost program, as do a not-for-profit corporation (USAC) and an association (NECA). As shown in table 1, FCC, USAC, and NECA have responsibilities for the high-cost program to ensure payments to rate-of- return carriers are made properly. FCC has the following audit and oversight procedures for the high-cost program: Carrier self-certification. Carriers submit cost and line count data directly to NECA. Carrier self-certification is the primary tool for ensuring that carriers use high-cost program support consistent with program rules. USAC uses these data to qualify carriers for the program and also to calculate the amount of support carriers are eligible to receive. Carrier audits. Audits of carriers receiving high-cost program support are the primary tool used to oversee carrier activities, and audits may be conducted by USAC, state regulators, or FCC’s OIG. USAC primarily relies on assessments from the Payment Quality Assurance Program and Beneficiary and Contributor Audit Program that occur after disbursements have been made to detect improper payments, which may include fraud. Carrier data validation process. All cost data that the carriers submit to NECA for purposes of high-cost support are subject to several electronic validations, which focus on ensuring that all required data are reported and that the data ranges are consistent with information reported in previous years. In addition, NECA compares the reported cost data with financial records supporting carriers’ audited financial statements to identify any discrepancies and to require corrections when discrepancies are discovered. Carriers’ broadband deployment verification. Since 2018, USAC has performed carrier broadband deployment verifications by obtaining broadband location data to monitor whether a carrier’s broadband deployment meets FCC requirements. Carriers receive verification reports from USAC that reflect the results of the verification process. Whistleblower process. USAC maintains a whistleblower log that is shared with FCC. Through whistleblower complaints, USAC may identify instances of potentially fraudulent activity. FCC has identified three rate-of-return carriers that received at least $34 million in improper payments from the high-cost program in prior years. Two such cases were described above. In the third case, a rate-of-return carrier self-reported to NECA and USAC what it represented to be the costs and revenues of providing its telecommunications service; as discussed previously, NECA and USAC rely upon the accuracy and completeness of the carrier’s reporting to calculate the carrier’s support. An FCC OIG investigation later revealed that the carrier had manipulated FCC’s accounting rules by including the costs of a nonregulated, commercial mobile radio service in the information it submitted to NECA, thus inflating the amount of high-cost program support the carrier received. FCC eventually determined that the carrier owed the federal government almost $7 million in support overpayments received between 2005 and 2010. A petition for reconsideration is pending. As there is a finite amount of funding for the high-cost program, compensating carriers for improper, ineligible, and inflated costs they claim means less program funds are available for deploying service to the areas the program was designed to serve. Federal internal control standards, along with GAO’s fraud risk framework, OMB guidance, and the Fraud Reduction and Data Analytics Act of 2015 have placed an increased focus on the need for federal program managers to take a strategic approach to managing improper payments and risks, including the risk of fraud. GAO’s fraud risk framework provides comprehensive guidance for conducting fraud-risk assessments and using the results to develop a robust fraud risk management strategy. This framework also describes overarching concepts and leading practices for establishing an organizational structure and culture that are conducive to fraud risk management, designing and implementing controls to prevent and detect potential fraud, and monitoring and evaluating fraud risk management activities. The leading practices in the fraud risk framework are organized into four components—commit, assess, design and implement, and evaluate and adapt—as depicted in figure 1. FCC, in various orders, has adopted several funding and other reforms specific to rate-of-return carriers. As described below, the reforms we reviewed were designed to (1) control the carrier and high-cost program expenditures, (2) incentivize efficient broadband deployment, and (3) ensure carriers’ compliance with the high-cost program. Prior to the 2011 USF Transformation Order, rate-of-return carriers primarily received high-cost support based on their actual costs. Under the old rules, carriers faced no FCC-imposed limits and, according to FCC, had no incentive to be more efficient. FCC adopted the reforms described in figure 2 to control the program’s expenditures. As shown in figure 2 above, FCC’s reform effort related to eliminating support to areas with competition has been ongoing since 2011. According to FCC officials, FCC relied on its broadband deployment data to identify competitively served areas, but we have previously reported that FCC’s broadband deployment data are not always accurate. In August 2017, FCC initiated a proceeding to review the Form 477—the principal tool FCC uses to gather data on communications services, including broadband services—to help inform its policy making. According to FCC, a goal of this proceeding was to enable FCC to collect better and more accurate information on the Form 477. In August 2019, FCC adopted an order based on the proceeding that, among other things, established requirements for collecting geospatial broadband-coverage maps from internet service providers. According to the order, FCC will require the service providers to submit granular maps of the areas where they have broadband-capable networks; FCC intends that these broadband-deployment maps will enable FCC to precisely target scarce universal service dollars to where broadband service is lacking. According to FCC, one of the USF’s core principles since 2011 has been to ensure that support is provided in the most efficient manner possible, recognizing that ultimately American consumers contribute to programs like the high-cost program. FCC adopted the reforms described in figure 3 to advance its long-standing objective of adopting incentive-based policies to spur additional broadband deployment, while preserving additional funding in the high-cost program for other reforms. According to FCC, the prior cases of carriers’ abuses of USF support for unrelated purposes prompted FCC to issue more specific rules for compliance and reporting obligations. Accordingly, FCC adopted reforms described in figure 4 to improve accountability and transparency of the high-cost program. Of the reforms we reviewed, one reform in particular—the development of a model-based support mechanism—shows promise in reducing fraud risk, according to stakeholders from federal and state government, industry, and accounting firms we contacted. Stakeholders said the model-based support mechanism is less prone to fraud risks and is a more efficient support mechanism than traditional cost-accounting support. In particular, unlike the traditional cost-accounting-support mechanism, model-based support does not rely on carrier-submitted data to determine support amounts. Instead, the model uses, among other things, a combination of historical cost data and other data, such as expected customer revenue, to determine support amounts. Since there are no data provided by carriers in the process of determining support amounts, there is no means by which carriers can provide falsified information to fraudulently receive excess support. The carriers involved in the previously described improper payments cases were receiving support from the traditional cost-accounting support mechanism. On the other hand, stakeholders told us FCC’s traditional cost-accounting support mechanism is complex and difficult to audit, and that such weaknesses make it prone to fraud risks. For example, USAC officials told us it is time consuming to detect inflated costs associated with carriers’ affiliate company transactions. The traditional cost-accounting support mechanism also requires that carriers separate costs based upon the type of service with which the cost was associated. According to FCC’s OIG officials and representatives from accounting firms we contacted, determining whether a carrier has overly attributed costs to eligible services is difficult. For instance, determining if labor costs are properly being allocated between eligible and ineligible services requires looking at each employee’s timesheet. According to USAC, it also faces challenges auditing traditional cost-accounting support payments due to limited expertise and capacity to address the complexity of the audits. USAC officials noted that this issue has been exacerbated by audit staff turnover. According to USAC officials and some stakeholders we contacted, auditing carriers receiving traditional cost-accounting support is also difficult due to the extensive documentation requirements for this type of support, requirements that often entails hundreds of pages of financial information per carrier. USAC officials told us that a single audit can take over 1,000 hours to complete, and USAC officials told us they only completed 10 audits of carriers that received support on a traditional cost-accounting basis in fiscal year 2018. As previously noted, FCC allows carriers to choose which funding mechanism is best suited for their company. FCC officials told us they developed the model-based funding mechanism in consultation with carriers and industry stakeholders. However, according to FCC officials, the model’s use is not mandatory because some carriers do not believe that the model would accurately reflect their specific costs. FCC officials said the agency does not have plans to assess the accuracy of the model’s cost estimates or require carriers to receive model-based support. FCC officials told us they did not have plans to assess the model. FCC officials told us they had not planned to do so because in May 2019 FCC had just made available model-based support to the remaining legacy carriers, and FCC was still in the process of evaluating next steps. Planning for and conducting such an assessment would enable FCC to demonstrate the validity of the model and its reliability in accounting for the costs of broadband deployment. Federal internal- control standards state that management should use quality information to make informed decisions and evaluate program performance in achieving key objectives. Furthermore, according to FCC’s strategic plan, FCC must ensure its USF programs, including those for the high- cost program, are well managed, efficient, and fiscally responsible, and the National Broadband Plan says that FCC should move rate-of-return carriers to incentive-based regulation mechanisms, such as model-based support. Yet because a substantial number of rate-of-return study areas— 437—continue to receive traditional cost-accounting support, and the carriers that provide service in these areas cannot be effectively audited, significant fraud risks remain for the high-cost program. By assessing the model, FCC would have greater assurance that it is producing reliable cost estimates and be better positioned to determine whether to make its use mandatory. Managers of federal programs are responsible for managing fraud risks. Implementing effective fraud risk-management processes is important to help ensure that federal programs fulfill their intended purpose and funds are spent effectively. GAO’s fraud risk framework is aligned with federal internal-control standards related to assessing fraud risk. It focuses on preventive activities, which generally offer the most cost-efficient use of resources since they enable managers to avoid a costly and inefficient “pay-and-chase” model, which refers to the practice of detecting fraudulent transactions and recovering funds after fraudulent payments have been made. As discussed previously, our fraud risk framework consists of four components—commit, assess, design and implement, and evaluate and adapt—each of which includes overarching concepts and leading practices for carrying them out. We found that FCC has implemented some policies and procedures related to managing fraud risk for the high-cost program. For example, according to a memorandum of understanding between FCC and USAC, FCC requires USAC to alert, as appropriate, FCC’s OIG and Enforcement Bureau about potential instances of fraud. However, as detailed in appendix II, FCC’s efforts do not fully align with some elements of the fraud risk framework. In particular, we found deficiencies in FCC’s efforts related to the following three overarching concepts and one high-level component: creating a structure with a dedicated entity to manage fraud risk activities (overarching concept within the commit component); planning regular fraud-risk assessments tailored to the program and assessing these risks to determine the program’s fraud risk profile (two overarching concepts within the assess component); and designing and implementing an antifraud strategy for the program (the design and implement component). Creating a structure with a dedicated entity to lead fraud risk- management activities. Leading practices for managing fraud risk include demonstrating management’s commitment to combating fraud and designating an entity to design and oversee fraud risk-management activities. According to GAO’s fraud risk framework, an entity should lead these activities by serving as the repository of knowledge on fraud risks and controls, managing the fraud-risk assessment process, leading fraud- awareness activities, and coordinating antifraud initiatives. According to FCC officials, FCC has steering committees for each of the four USF programs, including the high-cost program. According to FCC officials, the steering committees allow in-depth discussions about each program, including on operational issues such as current spending levels and information technology systems, as well as improper payments and other issues. However, fraud risk is but one of many responsibilities of these steering committees, and they do not fill the role of a dedicated fraud risk- management entity, as called for by the fraud risk framework. In August 2019, FCC officially launched a Fraud Division—comprising existing FCC staff who investigate and prosecute fraud—within its Enforcement Bureau. However, FCC told us the scope of the new division’s operations is limited to investigations, so the Fraud Division does not fill the role of a dedicated fraud risk-management entity. Planning regular fraud-risk assessments tailored to the program and determining the fraud risk profile. An effective antifraud entity tailors the approach for carrying out regular fraud-risk assessments of its programs. According to GAO’s fraud risk framework, the approach should, among other things: fully consider the specific fraud risks the agency or program faces, analyze the potential likelihood and effects of fraud schemes, and document prioritized fraud risks. According to FCC officials, FCC has annually worked with USAC high- cost program staff to identify and assess some risks facing the high-cost program, some of which are fraud risks, but has not planned regular fraud-risk assessments that are tailored to the high-cost program in accordance with GAO’s fraud risk framework. FCC officials also told us that they adopted a tool originally developed by another agency that was used to evaluate risks facing that agency’s loan and grant programs, not just fraud risks. Using that tool as a model, FCC created a risk assessment document that included fraud risk as one of nine categories of risks across the high-cost program. Based on our discussions with FCC officials, however, the document does not constitute a fraud-risk assessment that takes into account changes to the program or operating environment. Furthermore, the risk assessment document does not constitute a fully tailored risk assessment because it does not identify and assess the fraud risks stakeholders we interviewed described as inherent to the high-cost program, detailed below. Risk caused by the complexity of the high-cost program’s cost- allocation rules. Officials from three out of four accounting firms, FCC’s OIG, and a state utility commission we contacted singled out the specific fraud risk caused by what they described as confusing and subjective rules governing the process carriers use to separate eligible and ineligible costs. Risks related to oversight challenges. Stakeholders identified several oversight challenges as significant in that they could contribute to fraud risks for the program, such as: financial mismanagement within carriers that allowed companies to submit potentially fraudulent information to USAC and NECA, and that a telecommunications accountant told us contributed to previous instances of alleged fraud; USAC’s audit personnel challenges that were due to attrition and limited resources and expertise and that were identified by officials from FCC, USAC, FCC’s OIG, and an accounting firm; and deficiencies identified by FCC’s OIG in NECA’s internal controls over payments to carriers, data validation, and the appropriateness of NECA’s role validating carriers’ cost information. In addition, FCC’s OIG officials told us of oversight challenges related to carriers’ reporting, including that it is difficult for USAC to detect when carriers improperly report rates billed for services provided by an affiliate of the company or report incorrect labor rates. Furthermore, we found FCC had not identified and assessed risks to determine the fraud risk profile for the high-cost program, as called for in the fraud risk framework. A fraud risk profile is the summation of key findings and conclusions from a fraud-risk assessment, including the analysis of the types of internal and external fraud risks, their perceived likelihood and effects, managers’ risk tolerance, and the prioritization of risks. FCC officials said they consider the risk of fraud to be low in the high-cost program, and FCC includes fraud risk in its current risk assessment process. Since FCC believes the fraud risk is low for the high-cost program, FCC has not deemed it necessary to conduct a separate fraud-risk assessment of the program. For example, FCC provided us with documentation related to its Enterprise Risk Management activities that identifies risks USAC faces to achieving its corporate objectives. However, while FCC considers fraud risks as part of these activities, the document does not specify the fraud risk tolerance for the program or constitute a fraud risk profile. Without conducting regular fraud-risk assessments to gauge the likelihood and effects of the inherent fraud risks described above, and potentially others, FCC cannot determine or document the program’s fraud risk profile. Furthermore, FCC has no assurance that it has fully considered important fraud risks, determined its tolerance for risks that could be lower priorities, or made sound decisions on how to allocate resources to respond to fraud risks. Not doing so could result in FCC compensating carriers for improper, ineligible, and inflated costs, such as in the previously discussed cases of identified fraud. By regularly assessing fraud risks to determine a fraud risk profile, FCC could better determine the extent to which it has designed and implemented adequate fraud-prevention controls. Designing and implementing an antifraud strategy for the program. Managers who effectively manage fraud risk develop and document an antifraud strategy that describes the program’s activities for preventing, detecting, and responding to the fraud risks identified during the fraud-risk assessment. FCC and USAC have established mechanisms to enhance the oversight of USF programs, mechanisms that can also help mitigate fraud risks for the high-cost program, including: In fiscal year 2016, USAC implemented a risk-based selection method for conducting audits to identify the entities with the greatest risk. USAC forwards potential fraud, waste, and abuse cases to FCC. FCC’s OIG established a hotline that can be used to report potential fraud, and USAC established a Whistleblower Alert mechanism to inform USAC of possible instances of universal service support being misapplied or mismanaged, or when carriers are potentially violating laws, rules, or regulations. USAC shares this information with FCC. FCC and USAC formed a working group tasked with developing a data-analytics tool designed to share USAC high-cost program data with FCC. FCC’s documentation of the tool states that once developed, the tool will help FCC’s Enforcement Bureau in its fraud detection activities across all USF programs. FCC officials described the development of the tool as technically challenging and said there is no established timeline for implementing the tool. FCC officials said that FCC has regular, informal interactions concerning fraud risk with USAC and, to a lesser degree, with NECA and that FCC has confidence that USAC’s improved audit processes are identifying issues appropriately. However, FCC has not specifically designed or implemented an overall strategy to mitigate fraud risks across the high-cost program. An FCC official said FCC believes its existing antifraud activities are adequate. The FCC official said FCC considers the risk of fraud in the high-cost program to be low because USAC audits have revealed that carriers’ financial reporting errors occur at a low rate and therefore do not indicate that a large amount of fraud is occurring. The official said FCC’s fraud risk-management practices are based on federal internal-control standards and are woven into existing FCC mechanisms. Given that FCC has not conducted a fraud-risk assessment that is tailored to the high-cost program and that the deceptive nature of fraud makes it difficult to measure in a reliable way, it is unclear how FCC officials reached the conclusion that the program’s risk of fraud is low. Also, in the absence of an antifraud strategy, FCC has little assurance that it has the specific control activities to prevent and detect high-cost program fraud and that the types of misconduct that previously occurred are not widespread. The improper payment activity discussed previously was caught after USAC provided support to these carriers, and it was not prevented or detected through any strategic fraud risk-management effort on FCC’s part. Furthermore, the FCC’s OIG has expressed significant concerns about such abuses by rate-of-return carriers and about the effectiveness of USAC’s auditing processes in helping prevent improper payments to these carriers. As noted above, USAC’s high-cost program audits can take over 1,000 hours and USAC faces human capital challenges that have diminished its audit capacity. In addition, while NECA’s data validations and reviews of high-cost support provide opportunities to identify input and data-reporting errors, they do not specifically address whether or not the data provided by carriers are reasonable or if the money carriers spent addresses the intended purposes of the high-cost program. Designing and implementing an antifraud strategy that conforms to leading practices would help FCC effectively manage and respond to the fraud risks identified during the fraud-risk assessments. Given the continuing importance of deploying telecommunications services in difficult-to-serve areas, effective oversight for rate-of-return carriers is an important component for helping ensure that the high-cost program’s finite funds are used properly to meet the intent of the program. Overall, the traditional cost-accounting mechanism that FCC uses to provide support to a substantial number of rate-of-return carriers is complex, prone to fraud risks, and presents auditing challenges that FCC has not fully addressed. By following leading practices from GAO’s fraud risk framework, FCC could better ensure that it is addressing and strategically targeting the most significant fraud risks facing the high-cost program. Furthermore, FCC’s model-based support mechanism has now been in use by some rate-of-return carriers for several years and stakeholders agree that it is less prone to fraud risks. However, FCC has not assessed the extent to which the model is producing reliable cost estimates. By conducting such an assessment, FCC would have greater assurance that it is producing reliable cost estimates and be better positioned to determine whether to make its use mandatory. We are making the following five recommendations to FCC: The Chairman of FCC should ensure that FCC’s Office of Managing Director follows the leading practices in GAO’s fraud risk framework related to a dedicated entity’s management of its antifraud activities, such as serving as the repository of knowledge on fraud risks and coordinating antifraud initiatives. (Recommendation 1) The Chairman of FCC should plan regular fraud-risk assessments tailored to the high-cost program and assess these risks to determine the program’s fraud risk profile, as provided in GAO’s fraud risk framework. (Recommendation 2) The Chairman of FCC should design and implement an antifraud strategy for the high-cost program with specific control activities, based upon the results of fraud-risk assessments and a corresponding fraud risk profile, as provided in GAO’s fraud risk framework. (Recommendation 3) The Chairman of FCC should assess the model-based support mechanism to determine the extent to which it produces reliable cost estimates. (Recommendation 4) The Chairman of FCC should consider whether to make use of the model-based support mechanism mandatory depending on the results of the assessment. (Recommendation 5) We provided a draft of this report to FCC for review and comment. In FCC’s written comments, reprinted in appendix III, FCC described actions it would take to implement our recommendations. FCC also provided technical comments, which we incorporated as appropriate. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the appropriate congressional committees, the Chairman of the FCC, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-2834 or vonaha@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. To help managers combat fraud and preserve integrity in government agencies and programs, we identified leading practices for managing fraud risks and organized them into a conceptual framework called the Fraud Risk Management Framework (the framework). As described in the background section of this report and depicted visually in figure 1, the framework encompasses control activities to prevent, detect, and respond to fraud, with an emphasis on prevention, to help managers achieve the objective of mitigating fraud risks. The second of four framework components—Assess—calls for specific actions managers should take to achieve the objective of mitigating fraud risks. Specifically, managers should plan regular fraud-risk assessments and assess these risks to determine a fraud risk profile. Figure 5 illustrates the key elements of the fraud-risk assessment process that lead to the creation of a program’s fraud risk profile. We developed a data collection instrument to structure our assessment of the Federal Communications Commission’s (FCC) antifraud efforts for the high-cost program related to the commit, assess, and design and implement components of GAO’s fraud risk framework. For our assessment, we determined the extent to which FCC had implemented the leading practices within each component, as summarized in table 2. We did not assess FCC’s approach against leading practices in the “evaluate and adapt” component of the framework because we determined that FCC had not adopted fraud risk management leading practices within the first three components, and therefore it was premature for us to assess whether FCC was evaluating and adapting its use of these practices. In addition to the individual named above, Sally Moino (Assistant Director); Sean Standley (Analyst in Charge); Philip Farah; Camilo Flores; Mark Goldstein; Gary Guggolz; Hannah Hubbard; Josh Ormond; Ben Licht; Rebecca Shea; Andrew Stavisky; and Michelle Weathers made key contributions to this report.

Summary: The Universal Service Fund's high-cost program provides financial support to telecommunications carriers in areas where the cost to provide broadband is high. Through this program, FCC provides about $2.5 billion in annual support payments to rate-of-return carriers. The manner in which FCC currently provides the support payments to some of these carriers is prone to fraud risks. A prior case involved a rate-of-return carrier that received at least $27 million in improper payments from the program. GAO was asked to review funding reforms and fraud controls FCC has implemented for rate-of-return carriers. This report examines the extent to which FCC: (1) has implemented funding reforms specific to rate-of-return carriers, and (2) is managing fraud risks for the high-cost program in accordance with leading practices. GAO reviewed FCC's and USAC's procedures, relevant regulations, and guidance, and assessed these documents against applicable criteria, including federal internal-control standards, FCC's strategic plan, and GAO's fraud risk framework. GAO interviewed FCC and USAC officials, in addition to industry and other stakeholders representing a variety of non-generalizable viewpoints. The Federal Communications Commission (FCC) has implemented several funding reforms for small, rural telecommunications carriers—referred to as “rate-of-return carriers”—receiving high-cost program support. These reforms are aimed at controlling the program's expenditures and incentivizing efficient broadband deployment. According to FCC's strategic plan, FCC must ensure the high-cost program is well managed, efficient, and fiscally responsible. One of the reforms that GAO reviewed established a funding mechanism for the carriers whereby FCC determines the level of financial support to provide the carriers based on cost and revenue estimates produced by a model. Stakeholders told GAO that this model-based funding mechanism is less prone to fraud risks than the traditional cost-accounting funding mechanism, which reimburses carriers for their reported costs. However, FCC did not make use of this reform mandatory and a substantial number of rate-of-return carriers continue to receive support from the traditional funding mechanism. FCC officials said they developed the model-based funding mechanism in consultation with industry stakeholders. However, FCC officials said they did not have plans to assess the accuracy of cost estimates from the model, which has been in use for several years, or require carriers to receive model-based support as a way to reduce fraud risks. By assessing the model, FCC would have greater assurance that it is producing reliable cost estimates and be better positioned to determine whether to make its use mandatory. FCC has some policies and processes in place to manage fraud risks for the high-cost program. For example, the Universal Service Administrative Company (USAC)—the not-for-profit corporation that administers the program—reviews and audits rate-of-return support payments and forwards potential fraud cases to FCC's Office of Inspector General and Enforcement Bureau for further investigation. FCC is also developing a data-analytics tool to help detect fraud, and in August 2019 launched a new Fraud Division to focus on investigating fraud in the Universal Service Fund's programs. However, FCC's efforts do not fully align with some elements of GAO's fraud risk framework, including: designing and implementing an antifraud strategy for the program. Without regular fraud-risk assessments of the high-cost program, FCC has no assurance that it has fully considered important fraud risks, determined its tolerance for risks that could be lower priorities, or made sound decisions on how to allocate resources to respond to fraud risks. Not doing so could result in FCC compensating carriers for improper, ineligible, or inflated costs. Furthermore, in the absence of an antifraud strategy, FCC has little assurance that it can prevent or detect the types of documented rate-of-return carrier misconduct that have previously occurred. Designing and implementing an antifraud strategy that conforms to leading practices would help FCC effectively manage and respond to the fraud risks identified during the fraud-risk assessments. GAO is making five recommendations, including that FCC should assess the model-based support mechanism and consider making its use mandatory, and implement an antifraud strategy for the high-cost program. FCC stated it would take steps to implement these recommendations.