In response to the large number of people displaced following World War II, the United Nations established UNHCR in 1950 with the mandate of providing protection to and seeking permanent solutions for refugees. The 1951 United Nations Convention Relating to the Status of Refugees defines a refugee as someone who, as a result of events occurring before January 1, 1951 and owing to a “well-founded fear of being persecuted for reasons of race, religion, nationality, membership of a particular social group or political opinion, is outside the country of his nationality and is unable or, owing to such fear, is unwilling to avail himself of the protection of that country; or who, not having a nationality and being outside the country of his former habitual residence, as a result of such events, is unable or, owing to such fear, is unwilling to return to it.” The 1967 Protocol Relating to the Status of Refugees expanded the definition of refugee to include all refugees covered by the definition in the 1951 Convention with no date or geographic limitation. Over time, UNHCR’s mandate has expanded beyond providing protection and humanitarian assistance, and seeking, together with governments, durable solutions for refugees, to include asylum-seekers, stateless persons, returnees, and in certain circumstances, internally displaced persons. UNHCR has over 10,000 staff located at its headquarters in Geneva, Switzerland; Budapest, Hungary; Copenhagen, Denmark; and in field offices in more than 128 countries. UNHCR’s mandate, as established by the United Nations General Assembly, is the provision of international protection, material assistance, and durable solutions to refugees and other persons of concern. According to UNHCR, registration is a key tool for providing protection to refugees. Registration in the refugee protection context is the recording, verifying, and updating of information on asylum-seekers, refugees, and other persons of concern to UNHCR. Registration is the first step in formalizing the protection relationship between the individual seeking protection and the host government in the country of asylum, UNHCR, or both. UNHCR uses registration as a tool to assist in determining which types of assistance and protection are most appropriate. UNHCR also uses Refugee Status Determination (RSD), which it describes as the legal or administrative process by which governments or UNHCR determine whether an asylum-seeker meets the definition of a refugee under international, regional, or national law. This determination involves one or more interviews by trained government officials in the country of asylum or by trained UNHCR RSD staff. RSD and registration are distinct processes, although data recorded during the individual’s registration as an asylum-seeker may be drawn upon and confirmed during RSD. If an asylum-seeker is determined to be a refugee, his or her registration will be updated from asylum-seeker to refugee, or if there was no prior registration, the refugee will be registered as such. In the majority of its operations, UNHCR records identity data in UNHCR’s database and case management system, the Profile Global Registration System (ProGres). UNHCR promotes and provides both legal and physical protection, and also provides for basic needs including food, water, shelter, and medical care in response to refugee crises worldwide. According to UNHCR, registration is a fundamental component of UNHCR’s protection activities. For instance, during registration, the organization collects information on the numbers of refugees and their specific characteristics, such as family composition or special health needs, which assists it in determining the type of assistance that an individual refugee or families may initially require. Information on registered refugee populations is also used by the organization to help determine the amount and types of assistance that specific regions may need. Registration is described by UNHCR as an ongoing process that includes inputting refugees’ biographic and biometric information into databases and case management systems and updating it. UNHCR uses ProGres to log and maintain biographic information such as names and family information, and uses the Biometric Identity Management System (BIMS) and IrisGuard to collect and store biometric information such as iris scans and fingerprints. UNHCR reports that the number of refugees registered with the organization worldwide has grown significantly in recent years. For instance, the total number of refugees was estimated to be approximately 21.3 million by the end of 2015, approximately 1.7 million more than the total reported at the end of 2014. This number includes 4.9 million refugees from Syria, 2.7 million from Afghanistan, and 1.1 million from Somalia. See figure 1 for the number of UNHCR-registered refugees by country of origin as of December 31, 2015. In addition to providing protection and humanitarian assistance to refugees and other persons of concern, UNHCR is mandated to work with governments to provide “durable solutions” to those individuals so that they may transition out of refugee status and rebuild their lives. The three durable solutions that UNHCR facilitates include (1) voluntary repatriation to a refugee’s home country, (2) integration within the country in which they are currently located, and (3) resettlement to a third country. For instance, a refugee may decide to permanently return to his or her home country, with the support of UNHCR and that country, once the crisis that prompted his or her flight ends. Alternatively, refugees unable to safely repatriate to their home country may in certain cases, with the help of UNHCR, acquire permanent legal status with rights such as citizenship in their country of asylum, which UNHCR reports approximately 1.1 million refugees have done over the past decade. However, if neither repatriation nor local integration is available or appropriate, UNHCR may consider submitting a refugee’s case to a third country for resettlement consideration. UNHCR refers refugees for resettlement consideration to various countries, including the United States, Australia, Canada, Denmark, and the United Kingdom, among others. Refugees can be referred for resettlement consideration by UNHCR only if they meet UNHCR’s preconditions for resettlement consideration and fall under one or more of the resettlement submission categories. To assess refugees’ eligibility for resettlement referrals, UNHCR officials conduct interviews with refugees to obtain their basic biographic information, assess evidence of past or feared persecution, and determine eligibility for all other solutions that might be available to them. The organization documents this information in a resettlement referral form. While most registered refugees receive some form of protection assistance from the organization, less than 1 percent are referred for resettlement in a third country, according to UNHCR. State manages the USRAP admissions process in conjunction with DHS, and both agencies work with other government agencies, UNHCR, IOM, and various NGOs to process applications for refugees seeking resettlement to the United States. From fiscal year 2011 through June 2016, 61 percent of all refugee cases referred to the United States for resettlement consideration were referred by UNHCR, or roughly 405,000 referrals out of the 655,000 total. According to UNHCR, most of its referrals are families. UNHCR submits refugee referrals to the United States from all over the world. See table 1 for more information on the nationality of refugees referred by UNHCR for potential admission to the United States from fiscal year 2011 through June 2016. Once UNHCR refers a case to the United States for resettlement consideration, it is considered for access to USRAP. State accepts UNHCR referrals via UNHCR’s ProGres database and uploads biographic information to WRAPS, which is State’s own system that serves as a repository of application information and tracks the status of all individual refugee applications to USRAP. The resettlement application process continues at one of the nine RSCs. Through grants or voluntary contributions from State, various NGOs and IOM operate eight of the nine RSCs. RSCs are responsible for compiling eligible applications. They collect supporting documentation, biographic information such as names and addresses, and family information from each applicant. They are also responsible for prescreening USRAP applicants—that is, conducting in-person interviews with each applicant—during which staff employed by the organization that manages the RSC collect information on the applicants’ persecution story and why they claim to be unable to return home to their country of origin. RSCs then provide all of this information to USCIS officers. In addition, RSCs initiate the necessary biographic security checks for USRAP applicants, coordinate medical exams with panel physicians, and provide cultural orientation for refugees approved to travel to the United States, as well as manage the provision of interpretation services for USCIS interviews. See table 2 for more information on RSCs. As part of the resettlement application process, USCIS officers travel overseas to conduct in-person interviews of USRAP applicants and adjudicate their applications for refugee status pending the results of required security and background checks. RSCs provide interpreters to USCIS officers during the interviews, as necessary. Program integrity describes the extent to which the resettlement referral process is free from fraud, waste, and abuse by both staff and applicants. An important aspect of ensuring program integrity is designing, implementing, and evaluating the efficacy of antifraud measures. According to GAO’s Standards for Internal Control in the Federal Government, fraud, such as malfeasance conducted by staff, poses a significant risk to the integrity of a program. Accordingly, management should consider the potential for fraud when identifying, analyzing, and responding to program risks. Management responds to identified fraud risks by developing antifraud activities designed to reduce or eliminate the potential for fraud. Antifraud activities are a critical component for ensuring the integrity of a program such as USRAP. Proactive fraud risk management helps to facilitate a program’s mission and ensure that program services achieve their intended purpose. State and UNHCR have worked together on several measures designed to ensure integrity in the resettlement referral process. The organizations have developed a Framework for Cooperation to guide their partnership, emphasizing measures such as oversight activities and risk management. Additionally, UNHCR has developed SOPs and identity management systems to combat the risk of fraud and worked with State to implement these activities in the resettlement process. Since 2000, State and UNHCR have outlined their formal partnership using a Framework for Cooperation. State and UNHCR signed the most recent framework document in 2016, covering the period of March 14, 2016 to December 31, 2017. According to State and UNHCR officials, the organizations work together on the activities listed in the Framework for Cooperation to achieve mutual goals. Specifically, the framework emphasizes improved accountability at UNHCR through effective oversight measures, close cooperation with State, and organization-wide risk management. The Framework for Cooperation notes that State will work to ensure that UNHCR allocates sufficient resources to fully implement measures to provide oversight and accountability. UNHCR has several offices that are responsible for overseeing antifraud activities, in addition to providing audit services, investigating instances of fraud, and conducting broad reviews of country-level operations. The United Nations Office of Internal Oversight Services and the Board of Auditors conduct regular reviews of UNHCR and audit its financial statements, respectively. Both make recommendations regarding the management of UNHCR and track the status of those recommendations to help ensure effective management. For example, the board’s annual reports track previous recommendations, many of which focus on ensuring financial accountability, conducting fraud risk assessments, and establishing regular performance reporting mechanisms, among other things. UNHCR also has an Inspector General’s office that investigates allegations of staff misconduct and assigns responsibility to its headquarters, Nairobi, or Bangkok staff to conduct investigations. In 2015, the Inspector General’s Investigative Office opened 88 investigations, including 21 investigations related to fraud complaints. Of those 21 fraud investigations, 7 were related to the refugee status determination or resettlement processes. According to UNHCR officials, fraud committed by persons of concern is investigated locally, and local management can open an investigation and decide sanctions if applicant fraud is established. In addition, according to UNHCR officials, between 2014 and 2016, the organization sent as many as 10 teams to conduct reviews of field office operations, including registration, protection, and resettlement. Although the composition of these teams varies depending on the field operation being visited, they usually include officials responsible for reviewing registration, RSD, resettlement, interactions with the regional bureau, and other things. According to UNHCR officials, these visits have resulted in strengthening refugee protection and resettlement operations. For example, in response to alleged instances of fraud at UNHCR’s activities in an Asian country, the organization undertook two visits in 2016 to investigate and respond. First, UNHCR’s Inspector General’s office visited to investigate potential staff fraud but determined that while certain procedures may not have been followed, staff fraud was not established. Later, UNHCR sent a team to review how the operations there could be strengthened throughout the registration, protection, and resettlement processes. According to UNHCR officials, this visit resulted in improvements throughout operations in the country, especially related to the provision of assistance to urban populations of refugees. The Framework for Cooperation also describes regular coordination and communication between State and UNHCR as an important principle in the relationship between the two organizations. Specifically, at the headquarters level, the U.S. Mission in Geneva, Switzerland, has a humanitarian affairs office that, according to State officials, coordinates with UNHCR on a regular basis. For example, State reported that it works with UNHCR to review draft policy and procedures. It also works with UNHCR and other countries to help organize annual conferences on resettlement issues, which include working groups on integrity. The Framework for Cooperation also discusses UNHCR’s efforts to improve accountability and monitoring. It notes that UNHCR has committed to implementing Board of Auditors recommendations, including implementing an organization-wide approach to risk management, an enhanced framework for implementation with partners, and improved management of oversight over implementing partners. In addition, UNHCR has established committees on oversight and internal compliance, which have helped in developing an accountability matrix and monitoring progress made toward the implementation of oversight recommendations. UNHCR has also developed an organization-wide risk management strategy, known as enterprise risk management, across its programs to assess risk in the resettlement referral process, thus addressing a recommendation made by the Board of Auditors. UNHCR has developed guidance documents, baseline SOPs, and identity management programs that it notes are meant to help ensure the integrity of their operations, including the refugee resettlement referral process. For example, UNHCR has developed guidance on registration, RSD, resettlement, and other activities. The Handbook for Registration lays out the policies and methodology for registration, while the Resettlement Handbook provides guidance on the conditions for resettlement, the types of resettlement submission categories, and the procedures for making referrals to resettlement countries. UNHCR headquarters also issued baseline SOPs on resettlement, which provide a template for local field offices to complete and adapt for local situations. The resettlement SOPs vary by country and refugee population but, according to UNHCR officials, they adhere to these baseline requirements. Despite the complexity and regional variations in its refugee registration, refugee status determination, and resettlement referral processes, UNHCR officials said that standardizing procedures ensures that the organization has established basic antifraud practices worldwide. These officials added that they believe that SOPs are among the most important tools with which they ensure the integrity of the resettlement referral process. UNHCR officials in two of the field offices we visited indicated that changes to the baseline resettlement SOPs allowed for regional specificity. UNHCR officials also register refugees and manage their cases through ProGres, which is a registration and case management tool. According to UNHCR, registration and identity management are important ways to provide legal and physical protection, identify refugees at risk, provide population planning statistics, and facilitate implementation of durable solutions. UNHCR developed ProGres in 2003; according to the organization, it contained 7.2 million records and is used in 97 countries as of July 2016. UNHCR primarily uses BIMS and IrisGuard to collect and maintain biometric information, such as iris scans and fingerprints, and runs them in parallel depending on the geographic region and population. According to UNHCR officials, both BIMS and IrisGuard are linked with ProGres, allowing biometric data collected on refugees to be associated with biographic information. BIMS contains over 1.1 million records from 16 countries on its central server, and UNHCR is currently expanding its operation to additional countries, according to UNHCR officials. On our visits to UNHCR field offices, we observed UNHCR officials registering and managing case files in ProGres and verifying biometric data in BIMS and IrisGuard. Using these systems, UNHCR officials said they can check to ensure that a refugee is not already registered or receiving assistance. See figure 2 for photographs of technology that UNHCR uses to register and verify refugee identities. UNHCR has worked with State on implementing some activities related to collaboration with its identity management systems. For instance, to help manage the identities of referred refugees, State and UNHCR developed a Memorandum of Understanding (MOU) regarding the sharing of some biometric information. According to a Letter of Understanding that accompanies the MOU, it provides a framework whereby data from UNHCR is shared with State, which allows for increased efficiency and accuracy in processing resettlement referrals to the United States. State and RSCs report instituting a number of activities to combat the risk of fraud committed by RSC staff. Many of these activities correspond with leading practices identified in GAO’s Fraud Risk Framework. For instance, State and RSCs have taken steps to commit to an organizational culture and structure to help manage staff fraud risks. Further, State and RSCs have designed and implemented several specific control activities to mitigate staff fraud risks and taken steps to monitor staff fraud risk management activities. However, State could take additional steps to improve the implementation of existing controls, assess the risks of staff fraud, and examine the suitability of existing activities to control it. Further details on RSCs’ reported compliance with some measures contained in State’s Program Integrity Guidelines, challenges faced in compliance, and actions taken by specific RSCs to assess risk are provided in the sensitive report that we issued in June 2017. According to State officials, staff fraud at RSCs occurs infrequently, but instances of staff fraud have taken place in recent years, such as RSC staff soliciting bribes from applicants in exchange for promises of expediting applicants through RSC processing. State officials said that these events were uncovered before any significant consequences occurred; however, such instances illustrate the risks to the integrity of RSC operations. State and management from six of the nine RSCs stated that they could not recall any instances of staff fraud occurring at their RSCs. However, State and managers from the other three RSCs reported instances of staff fraud or malfeasance in recent years, including the following: In 2013, an RSC reported a significant case of staff fraud, resulting in the termination of two staff members. According to State and RSC officials, two RSC staff promised to expedite applicant cases in exchange for money. Although the staff were actually unable to influence the outcome of the applicants’ cases, the illusion of expediting the process in exchange for money allowed the extortion to take place. After an investigation by State’s local Regional Security Officer, the RSC terminated the two staff members and all individuals involved were arrested. In response, State undertook new antifraud initiatives, such as the creation of new antifraud guidelines for RSCs and commissioning an evaluation of risks posed by staff fraud. In 2014, while conducting interviews in the field, officials discovered three interpreters soliciting money from applicants, according to State officials. These officials said that the RSC identified the three interpreters and discovered that they had a record of misconduct with local police. The RSC terminated the interpreters and barred them from any future employment with the RSC. Since the incident, State officials said that the RSC has maintained a list of interpreters who are barred from providing services for the RSC. In 2016, another RSC discovered that a staff member connected a personal thumb drive to an RSC laptop without approval with the intention of accessing applicants’ files. The RSC reported the activity to State and the organization that manages the RSC. In coordination with State, RSC officials contracted with a private firm to conduct a forensic analysis of any potentially compromised information. The analysis determined that the staff member had attempted but failed to access any information and subsequently, the staff member was terminated. To address instances of fraud committed by staff at RSCs, State and RSCs report instituting a number of antifraud activities, many of which correspond with leading practices identified in GAO’s Fraud Risk Framework. GAO’s Fraud Risk Framework identifies leading antifraud practices to aid program managers in managing fraud risks that affect their program. The framework includes practices such as implementing activities that demonstrate an antifraud culture, designing and applying control activities to address fraud risks, monitoring the application of fraud controls, and conducting regular fraud risk assessments. We found that State and RSCs have taken steps to institute a number of these practices, but some gaps remain. By taking steps to promote organizational cultures and structures conducive to combatting staff fraud, State and RSCs have worked to demonstrate a commitment to managing staff fraud risks at RSCs. The Fraud Risk Framework identifies the involvement of all levels of an organization in setting an antifraud tone as a leading practice for fraud risk management. Management at every RSC said that all RSC staff had the responsibility to combat staff fraud. For example, management at all eight RSCs operated by IOM or NGOs reported that they had required their staff to review and sign their organization’s code of conduct annually. Furthermore, managers at all nine RSCs said that they had required their staff to attend annual antifraud training and reported to State that RSC staff had complied with these measures. Additionally, State and RSCs have created organizational structures to combat staff fraud by assigning specific staff the responsibility of overseeing staff fraud risk management activities, a leading practice highlighted in the Fraud Risk Framework. All nine RSCs stated that they had assigned staff fraud risk management responsibilities to specific staff members. Individual RSCs have varied in how they assign these responsibilities. For instance, while RSC Africa, RSC Middle East and North Africa, and RSC Turkey and Middle East reported having positions dedicated to leading their fraud risk management activities, RSCs Austria, Cuba, and East Asia have assigned overseeing fraud risk management activities as a duty of their respective RSC directors. The three remaining RSCs operated by IOM—including RSCs Eurasia, Latin America, and South Asia—stated that staff had been assigned to oversee fraud risk management responsibilities at each of them. Additionally, IOM maintains an ethics office located at its headquarters in Geneva, Switzerland, to provide additional staff fraud risk oversight. To help prevent or mitigate fraud committed by staff at RSCs, State and RSC officials said that they had established collaborative relationships with both internal and external partners to share information, which is consistent with another leading practice identified in the Fraud Risk Framework. For example, State reported that it had hosted an annual resettlement workshop, attended by RSC directors and UNHCR staff. State also reported that RSC staff attend region-specific meetings to share fraud risk management information. According to RSC Middle East and North Africa reporting, they have held similar fraud-focused quarterly meetings attended by representatives from State and UNHCR. In addition to attending organized conferences and meetings, management at RSCs stated that they had shared fraud-related information as it arose. When an RSC experiences an instance of staff fraud, State requires the RSC to report the fraud to State. According to RSC officials, depending on the RSC’s operating organization, the RSC may also report the staff fraud to its headquarters, inspector general, partner organizations, or ethics office. Another leading practice in the Fraud Risk Framework is the development of specific control activities to prevent and detect fraud. State officials identified two key guidance documents containing control activities: RSC SOPs and the Program Integrity Guidelines. First, according to State officials, State provides guidance to RSCs on developing SOPs that include staff fraud risk controls. For example, State requires RSCs to record the names of staff and interpreters who interact with applicants during prescreening interviews into WRAPS in order to mitigate fraud risk. According to State and RSC officials, although each RSC has used State’s guidance as a template, RSCs may incorporate additional procedures, including program integrity activities, based on their specific operational environment, such as size, complexity, location, or applicant population. Second, in response to the staff fraud incident in 2013 that resulted in the termination of two RSC staff, State developed and provided RSCs with a list of 87 measures designed to prevent and mitigate staff fraud at RSCs, known as the Program Integrity Guidelines. Of the 87 measures, State requires 72 and recommends the remaining 15. These measures include control activities addressing issues such as background checks, interpreter assignment, antifraud training, office layout, case file reviews, electronic data management, and reporting and responding to instances of suspected fraud. For example, State’s Program Integrity Guidelines have required RSCs to establish physical drop boxes or e-mail addresses to allow applicants to report instances of suspected staff fraud, as well as whistleblower policies for other staff to inform RSC management of suspected staff fraud. State has also required RSCs to include signage that indicates that the admissions process is free and instructions on how to report fraud. See figure 3 for examples of such RSC antifraud signage. Each RSC that we visited displayed similar signage in interview rooms, hallways, or applicant waiting areas. Consistent with another leading practice identified in the Fraud Risk Framework, State and RSCs also reported that they had implemented control activities designed to prevent and detect staff fraud; however, some gaps remain. State works with RSCs to implement the control activities identified in the Program Integrity Guidelines to mitigate staff fraud risks. RSCs report their compliance with the Program Integrity Guidelines to State via annual RSC Internal Malfeasance Prevention and Mitigation: Measures and Actions reports. For each measure listed in the Program Integrity Guidelines, RSCs report the actions they have taken to comply. State required RSCs to comply with the original Program Integrity Guidelines by October 2014. However, our review of the Measures and Actions reports found that RSCs reported complying with most, but not all, of the required measures applicable to their operations. Reported compliance with required, applicable measures at individual RSCs ranged from 86 percent to 100 percent. For 53 of the 72 measures, compliance was reported by all RSCs for which the measure was applicable. Though RSCs have reported complying with most of the controls required by the Program Integrity Guidelines, some RSCs have reported that they face challenges in fully implementing certain controls. State officials told us that they work to ensure that each RSC complies with all required controls in the Program Integrity Guidelines. If an RSC reports that it does not yet fully comply with a measure listed in the Program Integrity Guidelines, State expects the RSC to report its progress toward compliance to State. While this reporting assists State in its implementation efforts, gaps remain. Full compliance with these measures could help RSCs ensure the integrity of their operations and guard against staff fraud. State and the organizations that operate RSCs have taken steps to monitor their staff fraud risk management activities, a leading practice identified in the Fraud Risk Framework. For State’s monitoring of RSC antifraud activities, program officers and refugee coordinators have served as the primary liaison between their assigned region’s RSCs and State. According to State officials, its program officers have conducted monitoring of RSCs through frequent communication, program reports, and annual monitoring visits. State officials said that program officers have communicated with RSC management frequently via telephone and e-mail to conduct administrative functions, provide updates to State guidance, and address issues, including those related to staff fraud. Program officers also have reviewed program reports submitted by RSCs, which include a section that describes instances of suspected staff fraud from the previous quarter, if any, and updates to staff fraud risk management activities. For example, one RSC reported that, as an antifraud measure, it had prohibited staff from using their personal smartphones at worksites and issued staff cellphones without cameras or Internet capability. State also assigns to local U.S. embassies refugee coordinators who monitor RSC staff fraud risk management activities through frequent interaction with RSC staff. According to State officials, during visits to RSCs, refugee coordinators have provided additional monitoring of RSC staff fraud risk management activities by checking compliance with State’s Program Integrity Guidelines and receiving notification of and addressing reported instances of staff fraud. Additionally, IOM and NGOs have reported conducting annual monitoring visits of the RSCs that they operate. State has required the operating organization of each RSC to “conduct annual monitoring that includes fraud vulnerabilities” and submit the results of the monitoring visits to State. All four RSCs operated by IOM and all four RSCs operated by various NGOs reported that their respective operating organizations conducted such monitoring visits. For example, when one operating organization conducted a monitoring visit to an RSC in 2015, it recommended that the RSC should program its computers to lock after 5 minutes of inactivity, as required by the Program Integrity Guidelines. According to State officials, State program officers are also expected to conduct annual monitoring visits and create monitoring reports to check RSC compliance with State’s RSC SOPs and Program Integrity Guidelines. According to these monitoring reports, program officers observe day-to-day operations at RSCs during the monitoring visits. For instance, program officers report that they have observed RSC caseworkers conducting prescreening interviews of applicants. Upon concluding the annual monitoring visits, program officers are to complete written monitoring reports including a section that assesses RSC compliance with the Program Integrity Guidelines and makes recommendations to mitigate vulnerabilities for staff fraud. For example, the completed monitoring report for one RSC recommended upgrading the locks for its file library to an electronic system enabled by iris or fingerprint scan as a step to mitigate vulnerabilities of staff fraud. Further, program officers also have administered questionnaires to RSC directors and caseworkers to gather feedback on RSC procedures. In these questionnaires, State has asked RSC directors to comment on RSC procedures concerning hiring and training new staff. During the period of our review, State provided us with the most recent monitoring reports for each of the RSCs that had completed one. State has taken some steps to assess the risks posed by staff fraud to RSC operations. For example, in 2015, a contractor hired by State completed a report assessing (1) areas of vulnerability to staff fraud at RSCs, (2) current measures to address vulnerabilities and their effectiveness, (3) important factors in preventing staff fraud, and (4) optimization of State monitoring of RSCs. The report made a number of recommendations regarding potential staff fraud risks. Although State has taken steps to assess staff fraud risks, not all RSCs have conducted staff fraud risk assessments that follow leading practices identified in the Fraud Risk Framework, including (1) conducting assessments at regular intervals or when the program experiences changes, (2) tailoring assessments to the program and its operations, and (3) examining the suitability of existing fraud controls. State officials told us that not all RSCs had conducted staff fraud risk assessments because State’s Program Integrity Guidelines recommend but do not require these assessments. Without State requiring RSCs to conduct regular staff fraud risk assessments tailored to their specific operations, staff fraud risk assessments conducted by individual RSCs have varied. While officials from six of the nine RSCs stated that they had completed some form of staff fraud risk assessment, officials from four of them stated that they had done so only once. Additionally, only two of the nine RSCs have conducted staff fraud risk assessments specifically tailored to their operations. Further, State and most RSCs have not examined the suitability of existing fraud controls, another recommended leading practice in the Fraud Risk Framework. For example, while one RSC has regularly assessed the suitability of its existing staff fraud controls by conducting regular staff fraud risk assessments that examine the likelihood and impact of potential fraudulent activity and related fraud controls, the remaining eight RSCs have not done so. State officials told us that because State does not require RSCs to conduct risk assessments, information needed to assess the suitability of existing controls is not available from all RSCs. GAO’s Standards for Internal Control in the Federal Government states that changes in conditions affecting an entity and its environment often require changes to the entity’s internal control system, as existing controls may not be effective for addressing risk under changed conditions. For instance, a study of USRAP conducted at State’s request notes that as the number of refugees has increased in recent years, the potential for staff fraud committed against refugees has increased as well. According to this report, refugees may become more susceptible to participating in acts of staff fraud as they become more desperate to reach another country. As the number of refugees accepted varies each year by RSC, internal control systems may need to be changed to respond to the potential increased fraud risk. Moreover, as described earlier, individual RSCs face challenges complying with some of the existing fraud controls outlined in the Program Integrity Guidelines. Examining the suitability of these controls could help managers identify areas where existing control activities are not suitably designed or implemented to reduce risks to a tolerable level. Based on this analysis, managers could prioritize and target areas of residual risk. Without requiring RSCs to conduct regular staff fraud risk assessments that are tailored to their specific operating environments and reviewing these assessments to examine the suitability of existing fraud controls, State may lack necessary information about staff fraud risks and therefore not have reasonable assurance that existing controls effectively reduce these risks. Information from such risk assessments could help State and RSCs revise existing controls or develop new controls to mitigate the staff fraud risks faced by the program, if necessary. Each year, the United States resettles tens of thousands of refugees from around the world as part of its humanitarian commitment in the international community. The refugee admissions process relies on RSC staff to coordinate and manage refugee applications. Accordingly, staff fraud can undermine the integrity of the program. To reduce these risks, State and RSCs have instituted several antifraud activities, many of which correspond with leading antifraud practices. One of these activities is designing and implementing antifraud controls. For instance, State has required that RSCs comply with 72 staff fraud control measures. While RSCs have complied with most of these measures, persistent gaps remain. Pursuing efforts to ensure RSC compliance with these controls is essential to reducing the risks of staff fraud. Additionally, some RSCs have not conducted regular risk assessments tailored to their operations or examined the suitability of existing fraud controls. Without these assessments, State and RSCs may not be able to identify the staff fraud risks affecting their programs, fully assess the risks associated with noncompliance with staff fraud control measures, or evaluate the effectiveness of their control activities. In conjunction with antifraud controls already put in place by State and RSCs, additional steps could strengthen existing controls, assess future staff fraud risks to the program, and better support the integrity of USRAP. 1. To support efforts to reduce staff fraud at RSCs, the Secretary of State should direct the Bureau of Population, Refugees, and Migration to actively pursue efforts to ensure that RSCs comply with required, applicable measures in the Program Integrity Guidelines. 2. To better identify risks from RSC staff fraud, the Secretary of State should direct the Bureau of Population, Refugees, and Migration to update guidance, such as the Program Integrity Guidelines, to require each RSC to conduct regular staff fraud risk assessments that are tailored to each RSC’s specific operations. 3. To help ensure that control activities are designed to mitigate identified RSC staff fraud risks, the Secretary of State should direct the Bureau of Population, Refugees, and Migration to regularly review RSC staff fraud risk assessments and use them to examine the suitability of existing staff fraud controls and revise controls as appropriate. We provided a draft of the sensitive version of this report to the Departments of State and Homeland Security for review and comment. State provided written comments that are reprinted in appendix I. State, DHS, and UNHCR also provided technical comments, which we have incorporated as appropriate. State deemed some of the information in their original agency comment letter pertaining to RSCs’ reported compliance with the Program Integrity Guidelines to be sensitive, which must be protected from public disclosure. Therefore, they have redacted the sensitive information in the department’s comment letter, which is included in appendix I. These redactions did not have a material effect on the substance of the department’s comments. State concurred with our recommendations and agreed that implementing these activities could reduce the risk of staff fraud at RSCs. State noted that it has developed new guidance to enhance the monitoring of RSCs, which outlines roles, responsibilities, and tools for program officers and refugee coordinators. We are sending copies of this report to the appropriate congressional committees, the Secretaries of State and Homeland Security, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. Should you or your staff have questions about this report, please contact me at (202) 512-9601 or melitot@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II. Thomas Melito, (202) 512-9601, or melitot@gao.gov. In addition to the contact named above, Elizabeth Repko (Assistant Director), Brian Hackney (Analyst-in-Charge), Ashley Alley, Kathryn Bernet, Anthony Costulas, Rebecca Gambler, Cynthia Grant, Paul Hobart, Mona Nichols Blake, Michael McKemey, Mary Pitts, Sean Sannwaldt, and Su Jin Yon made significant contributions to this report. Debbie Chung, Martin De Alteriis, Neil Doherty, Mark Dowling, Thomas Lombardi, Erin McLaughlin, and Mary Moutsos provided technical assistance.

Summary: According to UNHCR, as of the end of 2015, more than 21 million people had become refugees. In fiscal year 2016, the United States admitted nearly 85,000 refugees. State manages the U.S. refugee admissions program (USRAP). UNHCR referred 61 percent of the refugees considered by the United States for resettlement from October 2011 to June 2016, and State worked with staff hired by nine RSCs to process their applications. Deterring and detecting fraud is essential to ensuring the integrity of USRAP. GAO examined (1) how State works with UNHCR to ensure program integrity in the UNHCR resettlement referral process and (2) the extent to which State and RSCs follow leading practices to reduce the risk of fraud committed by RSC staff. GAO analyzed State and UNHCR data and documents; interviewed relevant officials; conducted fieldwork at UNHCR offices in Denmark, El Salvador, Jordan, Kenya, and Switzerland; interviewed senior officials from all nine RSCs; and visited RSCs in Austria, Jordan, Kenya, and a suboffice in El Salvador. This report is based on GAO-17-446SU , with certain sensitive information removed. The Department of State (State) and the United Nations High Commissioner for Refugees (UNHCR) have worked together on several measures designed to ensure integrity in the resettlement referral process. State and UNHCR have established a Framework for Cooperation to guide their partnership, emphasizing measures such as effective oversight structures, close coordination, and risk management. Working with State, UNHCR has implemented standard operating procedures and other guidance that, according to UNHCR officials, provide baseline requirements throughout the referral process. UNHCR also uses databases to help verify the identities of and manage information about refugees. These systems store biographic information such as names, personal histories, and the types of persecution refugees experienced in their home countries. They also maintain biometric information, such as iris scans and fingerprints. To reduce the risk of fraud committed by staff at the nine Resettlement Support Centers (RSC) worldwide, State and RSCs have instituted several antifraud activities, many of which correspond with leading antifraud practices, but key gaps remain. Overseen by State, the organizations that operate RSCs hire staff to process and prescreen applicants who have been referred for resettlement consideration. According to State and RSC officials, RSCs have experienced staff fraud. Officials said that instances of staff fraud are uncommon, but they illustrate risks to the integrity of RSC operations. To manage these risks, State and RSCs have established a number of activities consistent with leading antifraud practices. For example, officials from all nine RSCs stated that they assign staff fraud risk management responsibilities to designated individuals. State has also worked with RSCs to develop and implement controls to ensure program integrity. However, RSCs face challenges implementing some of these controls. Additionally, State has not required RSCs to conduct regular staff fraud risk assessments tailored to each RSC or examined the suitability of related control activities. Without taking additional steps to address these issues, State and RSCs may face challenges in identifying new staff fraud risks or gaps in the program's internal control system as well as designing and implementing new control activities to mitigate them. To better assess and manage risks of fraud committed by staff at RSCs, State should actively pursue efforts to ensure RSCs comply with program integrity measures; require each RSC to conduct regular risk assessments tailored to its operations; and use these assessments to design, implement, and revise control activities to mitigate risks of staff fraud. State agreed with GAO's recommendations.