Audit work we performed on FEMA’s IHP payments and DHS’s purchase card program identified widespread fraud, waste, and abuse. Findings from these audits and our related investigations show the result of ineffective preventive controls. As shown by our IHP work, ineffective preventive controls can result in hundreds of millions or potentially billions of dollars in improper and fraudulent payments. In addition, our work on DHS purchase cards showed that control weaknesses in government purchasing programs can also result in fraud, waste, and abuse. Between February and December 2006, we testified on three different occasions that potentially improper and fraudulent activities related to the IHP program are significant. Our February 2006 testimony focused on control weaknesses that resulted in FEMA making thousands of Expedited Assistance (EA) payments that were based on bogus registration data. Specifically, we found that FEMA made millions of dollars in payments on registrations containing Social Security numbers that had never been issued or belonged to deceased individuals. In addition, we also found that numerous registrations we selected for investigation contained bogus damaged address. We also successfully submitted fictitious registrations and received payments using bogus identities and addresses. Our second testimony in June 2006 discussed breakdowns in internal controls, in particular the lack of controls designed to prevent bogus registrations. These breakdowns resulted in an estimated 16 percent or $1 billion in payments made through February 2006 based on invalid registrations. The statistical sample testing used to reach this estimate found payments made on registrations that contained invalid identities, bogus addresses, addresses which the registrant did not live in at the time of the disaster, and duplicate registrations. Our data mining also found that FEMA paid millions of dollars on over 1,000 registrations containing the names and Social Security numbers of individuals incarcerated in federal or state prisons during the hurricanes, and paid millions of dollars in IHP payments to individuals who claimed a Post Office box as their damaged physical address in order to receive assistance. In our December 2006 testimony we found additional instances of IHP fraud, waste, and abuse, including duplicate housing assistance provided to thousands of individuals living in FEMA-provided housing. Specifically FEMA paid registrants rental assistance money while at the same time providing rent-free housing in apartments and FEMA trailers. We also found that FEMA provided about $20 million dollars in potentially duplicate payments to individuals who registered and received assistance twice using the same Social Security number and damaged address. These individuals registered once for Hurricane Katrina and then again for Hurricane Rita using the same Social Security number and damaged address. FEMA also paid several million more dollars worth of IHP payments to registrants who were ineligible nonqualified aliens. Based on data we received from several universities in the area, we identified that FEMA made IHP payments to more than 500 ineligible foreign students, despite receiving, in some cases, evidence clearly showing that they were not eligible for IHP benefits. The December 2006 testimony also pointed to the small amount of money that FEMA had been able to collect from improper payments as of November 2006. Specifically, in contrast to the $1 billion in potentially improper and/or fraudulent payments we estimated through February 2006, FEMA had detected, as of November 2006, about $290 million in improper payments, and had collected only $7 million. Our work on DHS purchase card controls found weak accountability over FEMA computers, printers, Global Positioning System (GPS) units, and other items bought for hurricane relief efforts using government purchase cards. Thirty-four percent of items obtained with purchase cards that we investigated could not be located and are thus presumed lost or stolen. As of October 2006, more than 40 computers, 10 printers, 20 GPS units, and 2 flat-bottom boats are missing. In addition, 18 other flat-bottom boats purchased by FEMA were in its possession, but FEMA did not own title to any of them. Based on these findings, and the findings on the IHP program, we have made recommendations to FEMA to develop effective systems and controls to minimize the opportunity for fraud, waste, and abuse in the future. FEMA has generally concurred with most of our recommendations and has reported on actions to improve prevention of fraud, waste, and abuse for the future. The results of our work serve to emphasize the overall lesson learned that fraud prevention is the most effective and efficient means to minimize fraud, waste, and abuse. It also demonstrates that the establishment of effective fraud prevention controls over the registration and payment process, fraud detection and monitoring adherence to those controls, and the aggressive pursuit and prosecution of individuals committing fraud are crucial elements of an effective fraud prevention program over any assistance programs with defined eligibility criteria, including disaster assistance programs. The very nature of the government’s need to quickly provide assistance to individuals adversely affected by disasters makes assistance payments more vulnerable to applicants attempting to obtain benefits that they are not entitled to receive. However, it is because of these known vulnerabilities that federal and state governments need to have effective controls in place to minimize the opportunities for individuals to defraud the government. Figure 1 provides an overview of how preventive controls help to screen out the majority of fraud, waste, and abuse, and how detection controls and prosecution can help to further minimize the extent to which a program is vulnerable to fraud. Preventive controls are a key element on an effective fraud prevention program and are also described in the Standards for Internal Control in the Federal Government. The most crucial element of effective fraud prevention controls is a focus on substantially diminishing the opportunity for fraudulent access into the system through front-end controls. Preventive controls should be designed to include, at a minimum, a requirement for data validation, system edit controls, and fraud awareness training. Finally, prior to implementing any new preventive controls, and well in advance of any disaster, agencies must adequately field test the new controls to ensure that controls are operating as intended and that legitimate victims are not denied benefits. Fraud prevention can be achieved by requiring that registrants provide information in a uniform format, and validating these data against other government or third-party sources to determine whether registrants provided accurate information on their identity and place of residence. Effective fraud prevention controls require that agencies enter into data- sharing arrangements with organizations to perform validation. In the current environment, agencies have at their disposal a large number of data sources that they can use to validate the identity and address of registrants. However, our work related to FEMA’s management of the IHP program for hurricanes Katrina and Rita found that its limited—or sometimes nonexistent—use of a third-party validation process left disaster assistance programs vulnerable to substantial fraud. For example, FEMA’s failure to implement preventive controls to validate the identity of individuals who applied using the telephone resulted in FEMA making millions of dollars in payments to individuals who used Social Security numbers that had never been issued or belonged to deceased individuals. Another method of data validation is through physical inspection of the disaster damage prior to payment. While physical inspections in a timely manner may not be possible to prevent all fraudulent and improper payments, our work found that FEMA continued to make payments without a valid physical inspection of our undercover registration’s bogus addresses, months after the hurricanes had occurred. System edit checks designed to identify problem registrants and claims (e.g., duplicates) before payments are made are also a crucial lesson learned with respect to ensuring that obviously false or duplicate information is not used to receive disaster relief payments. System edit checks are most effective if performed before distribution of a payment. Edit checks should include ensuring that (1) the same Social Security number was not used on multiple registrations and (2) the registrant provides a verifiable physical address on which the disaster damage is based. In the case of FEMA’s IHP program, ineffective edit checks resulted in millions paid to registrants who claimed the same damages twice, once for Hurricane Katrina and once for Hurricane Rita, and registrants who submitted multiple registrations using the same name, Social Security number, or address. Ineffective edit checks also resulted in payments being made based on obviously false data, including payments of millions of dollars to individuals who used a Post Office box as their damaged physical address in order to receive assistance. Beyond validation and edits, lessons learned show that other controls, including a well-trained work force that is aware of the potential for fraud, can help prevent fraud. Fraud awareness training with frontline personnel—specifically on the potential for fraud within the program and the likely types of fraud they could encounter—is crucial to stopping fraud before it gains access into the program. In addition, when implementing any new controls, it is important to field test all systems prior to putting them in place. On top of reducing the risk of untested controls allowing substantial fraud, field testing also helps to ensure that new controls do not improperly deny benefits to valid registrants. A safety net for those registrants who are wrongly denied disaster relief due to preventive controls should always be in place to ensure they receive assistance. Even with effective preventive controls, there is substantial residual risk that fraudulent and improper disaster relief payments can occur. Our work has shown that agencies must continue their efforts to monitor fraud and improper payment vulnerabilities in the execution of disaster relief programs, even if these efforts are more costly and less effective than preventive controls. Detection and monitoring efforts are addressed in the Standards for Internal Control in the Federal Government and include data-mining for fraudulent and suspicious transactions and reviews to establish the accountability of funds. Also, control weaknesses identified through detection and monitoring should be used to make improvements to preventive controls to reduce the risk for fraud, waste, and abuse in the future. The data-mining we performed to search for anomalies in registrant data and purchase card transactions show how important constant monitoring and detection can be. Through data-mining, we found rental assistance payments to individuals who were residing in FEMA-provided hotel rooms, trailers, and apartments and payments to ineligible, nonqualified aliens. We found examples of multiple registrations citing the same address or bank accounts, and numerous residents in a damaged apartment building all relocating to the same location, which may also suggest fraud. By comparing applicant data in FEMA’s own databases, we identified duplicate applications submitted for both Katrina and Rita, but intended to cover the same damage to the same residence. By comparing recipient data against federal and state prisoners’ databases, we identified instances where prisoners had fraudulently registered for and received disaster relief payments while incarcerated. Our examples illustrate that data-mining efforts should be done in a manner that uses creative solutions to search for potential fraud using all available data sources. To the extent that data-mining identifies systematic fraud, intelligence should be fed back into the fraud prevention process so that for future disasters the fraud is detected and prevented before money is disbursed. Depending on the type of assistance provided and the means in which the assistance was distributed, it can be important for an agency to monitor the use of disaster relief funds. Our review of FEMA’s IHP program found that while the vast majority of debit card transactions that were not withdrawn as cash appeared to have been used for disaster-related needs, we did find a number of purchases for nondisaster items such as football tickets, alcohol, massage parlor services, and adult videos. In addition, our review of items bought with DHS purchase cards found that many items bought for use in disaster relief were lost or stolen. By monitoring these types of uses, agencies may be able to ensure that disaster funds are used to help mitigate losses and not used for inappropriate items or services. Another element of a fraud prevention program is the collection of improper payments and the aggressive investigation and prosecution of individuals who committed fraud against the government. These back-end controls are often the most costly and less effective means of reducing losses to fraud, waste, and abuse. However, the deterrent value of prosecuting those who commit fraud sends the message that the government will not tolerate individuals stealing assistance money, and thus serving as a preventive measure for future disasters. Our experience is that investigations and prosecutions are a necessary part of an overall fraud prevention and deterrence program, but should be a last resort when all other controls have failed. For hurricanes Katrina and Rita, the Justice Department has set up the Katrina Fraud Task Force, which has successfully investigated and prosecuted numerous individuals who received assistance fraudulently from FEMA. In December 2006, we testified to the difficulty of collecting on improper payments after they have been disbursed. Specifically, in contrast to the $1 billion we estimated to be improper and potentially fraudulent payments— an estimate derived from statistical sampling—FEMA determined that it had overpaid nearly 60,000 registrants about $290 million as of November 2006. These overpayments, which FEMA refers to as recoupments, represent the improper payments that FEMA reported it had detected and for which it had issued collection letters. Although FEMA had identified about $290 million in overpayments, as of late 2006, FEMA stated that it had only collected nearly $7 million. The small amount of money that FEMA had collected on overpayments related to hurricanes Katrina and Rita further emphasizes the need for preventing fraud, waste, and abuse prior to payments going out the door. Lessons learned from our prior work show that, while investigations and prosecutions can be the most visible means to deal with individuals intent on perpetrating fraud schemes, they are also the most costly and should not be used in place of other more effective preventive controls. Still, by successfully prosecuting such individuals, agencies can deter others who are thinking of taking advantage of the inherent vulnerabilities in disaster relief programs. We have already referred thousands of cases we have identified as potentially improper and fraudulent to the Katrina Fraud Task force for further investigation and expect to refer others for additional investigation and possible prosecution. Our Katrina and Rita work to date has shown that there are at least tens of thousands of individuals that took advantage of the opportunity to commit fraud against the federal government. Our work shows that for one FEMA individual assistance program alone it is likely that over $1 billion has been lost to fraudulent and improper payments. With potentially billions of dollars of additional spending likely for Katrina and Rita recovery, state and federal agencies should implement lessons learned with respect to the importance of effective fraud, waste, and abuse prevention programs. With effective planning, relief agencies should not have to make a choice between speedy delivery of assistance and effective fraud prevention. Going forward, FEMA and other agencies involved in disaster recovery efforts must work hard to develop and institute effective controls that will ensure victims are provided assistance as quickly as possible while also minimizing fraud, waste, and abuse. Chairman and Members of the Committee, this concludes my statement. I would be pleased to answer any questions that you or other Members of the Committee have at this time. For further information about this testimony, please contact Gregory Kutz at (202) 512- 7455 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Hurricanes Katrina and Rita destroyed homes and displaced millions of individuals. While federal and state governments continue to respond to this disaster, GAO has identified significant control weaknesses--specifically in the Federal Emergency Management Agency (FEMA)'s Individuals and Households Program (IHP) and in Department of Homeland Security (DHS)'s purchase card program--resulting in significant fraud, waste, and abuse. In response to the numerous recommendations GAO made, DHS and FEMA have reported on numerous actions taken to address our recommendations. Lessons learned from GAO's prior work can serve as a framework for an effective fraud prevention system for federal and state governments as they consider spending billions more on disaster recovery. These lessons are particularly important because funding that is lost to fraud, waste, and abuse reduces the amount of money that could be delivered to victims in need. Today's testimony will (1) describe key findings from past GAO work and (2) use the results from that work and GAO's other experiences to discuss the importance of an effective fraud, waste and abuse prevention program. Prior GAO audit and investigative work on FEMA's controls over IHP payments and DHS's controls over purchase cards emphasizes one fundamental concept--that fraud prevention is the most effective and efficient means of minimizing fraud, waste, and abuse. GAO estimates that FEMA made about 16 percent or almost $1 billion dollars in improper and potentially fraudulent IHP payments to registrants who applied using invalid information, illustrating what can happen when fraud prevention controls are ineffective. For example, GAO found that FEMA made payments based on bogus damaged addresses, false identities, and identities belonging to federal and state prisoners. These findings highlight the need for effective controls over all types of recovery disbursements. With effective planning, relief agencies should not have to make a choice between speedy delivery of disaster recovery assistance and effective fraud prevention. Finally, GAO's findings of significant control weaknesses in DHS's purchase card program leading to fraud, waste, and abuse further underline the need for an effective framework for fraud prevention, monitoring, and detection. Our work on disaster assistance programs in particular show that preventive controls should be designed to include, at a minimum, a requirement that data used in decision making is validated against other government or third-party sources to determine accuracy. Inspections and physical validation should also be conducted whenever possible to confirm information prior to payment. System edit checks should also be used to identify problems before payments are made. Finally, providing training on fraud awareness is important in stopping fraud before it gets into any type of recovery program. Fraud detection and monitoring is also critical, although more costly and less effective than preventive controls. Key elements of detection include data mining for fraudulent information and performing reviews to establish the accountability of property and funds. The final element of a fraud prevention program is the collection of identified improper payments and the aggressive investigation and prosecution of individuals who commit fraud as a preventive measure for future disasters. These elements are most costly, and collecting money after it has been disbursed is far less effective than up front prevention--FEMA has collected only $7 million of the estimated $1 billion in potential improper and fraudulent IHP payments.