The Financial Institutions Reform, Recovery, and Enforcement Act (FIRREA) established RTC in 1989 to contain, manage, and resolve hundreds of failed thrift institutions. The Federal Deposit Insurance Corporation Improvement Act of 1991 clarified or expanded RTC’s and FDIC’s responsibilities for resolving failed thrifts and banks. As of April 25, 1994, RTC was responsible for resolving 743 thrifts. From fiscal year 1990 to May 19, 1994, FDIC was responsible for resolving 465 failed banks. Under the RTC Completion Act, RTC is to cease operating by December 31, 1995. After that date, FDIC will become responsible for (1) resolving the thrifts that fail after June 30, 1995, and (2) completing the disposition of thrift assets remaining in RTC’s inventory. When RTC assumes control of an institution, its Office of Investigations and its Legal Division’s Professional Liability Section work together. They determine which institution officers and directors, if any, are responsible for, or culpable in, the losses that resulted in the institution’s failure. Once these administrative determinations are made, RTC generally then files a professional liability suit or submits a criminal referral naming the culpable individuals. FDIC operates in much the same manner. Between its inception and June 30, 1994, RTC filed 245 professional liability suits against directors and officers, of which 181 are pending, and made 1,134 criminal referrals to the Department of Justice. FDIC had approximately 400 professional liability suits against directors and officers between January 1990 and July 1994, of which 120 are pending. In addition, FDIC filed 998 criminal referrals in that same period. RTC and FDIC are vulnerable to fraud, abuse, and mismanagement because they do not systematically screen job applicants or current employees to determine if they have been found culpable in the losses that caused federally insured institutions to fail. The Corporations have no systems designed to screen prospective employees to determine if the Corporations have found them culpable in the failures. In addition, after the Corporations make culpability determinations, they have no systems to verify whether they or a conservatorship institution currently employ the individuals deemed culpable. The Corporations’ databases concerning professional liability suits and criminal referrals are not designed to be used for employment screening and contain a number of shortcomings for performing this function. First, the databases are incomplete: Names of culpable individuals against whom legal action was not cost-effective are not always included in Corporation databases, and criminal referral listings to the Department of Justice are incomplete. Second, configuration of the Corporation databases constrains their usefulness in locating names of culpable individuals. Third, one RTC database incorrectly lists individuals as culpable when they are not. These shortcomings become critical when verifying whether prospective employees for, or current employees in, some vital capacity have been found culpable for institution failures. The Corporations’ databases of culpable individuals are incomplete, continuing to leave them vulnerable to fraud and mismanagement. For example, the Corporations do not always include in their databases the names of those individuals found culpable for institution failures if RTC and FDIC have determined that legal action would not be cost-effective. In addition, FDIC criminal referral listings are incomplete. After we compared all FDIC criminal referrals filed with Justice for one failed bank with an FDIC listing of all criminal referrals filed in the past 5 years, we found over half missing from the FDIC listing. FDIC had filed criminal referrals against eight individuals from the failed bank between November 1990 and February 1991, yet only three of the names were on its criminal referral listing. As a result, if the Corporations had performed employment screening, they would have been unaware of the culpability of the five not on the listing. FDIC acknowledged that the criminal referral listing, which came from a database not designed for employment screening, is not appropriate for this purpose due to the number of errors it contains. A similar situation exists with the RTC databases. RTC acknowledged that because each RTC region is responsible for entering its own data, some may not have entered all of the professional liability suit and criminal referral data necessary to make this database an integral part of an accurate screening system. This inconsistent reporting occurs because each region has discretion about how much information is placed in the system. The Corporations’ databases lack systematic means to identify culpable individuals, and the organization of FDIC’s database of professional liability suits constrains its usefulness. Both situations increase Corporation vulnerability. None of the Corporations’ databases pertaining to professional liability suits or criminal referrals systematically provide social security numbers or other similar identifiers necessary to make a positive identification for similar names. To perform our verification when social security numbers were not available, we requested individuals’ home addresses and dates of birth from the Corporations. These were sometimes available only on documents maintained by outside legal counsel. Further, the organization of FDIC’s professional liability suit database, containing over 1,500 individuals’ names, is such that it constrains the usefulness of the database for employment screening. It does not have the capability to retrieve defendants by name. Instead, this database, which FDIC officials acknowledged would be difficult to use for employment screening, identifies failed institutions resolved by FDIC, each followed by a list of defendants’ names. Therefore, we were unable to determine whether the Corporations employed any of these individuals in vital positions. RTC had never filed suit against two other RTC employees we found on its professional liability suit listing. RTC included these two names on the listing because it routinely enters the names of all directors and officers from a failed institution in the database from which it drew the listing. RTC told us that this database was not designed, nor ever intended to be used, for employment screening. Neither RTC nor FDIC has established a systematic means for communicating determinations of culpability to managers in a timely way. Managers become aware of culpability determinations made against current employees through happenstance. However, early notification would allow managers to evaluate and determine, in a timely manner, whether to restrict the employees’ duties and responsibilities or to evaluate their employment status. Such action would help limit the Corporations’ vulnerability to fraud, abuse, and mismanagement. For example, RTC hired an individual in January 1990 as a credit specialist to manage a conservatorship institution with $1.9 billion in assets. RTC filed a professional liability suit against him in December 1992. Being unaware of the suit, a senior manager at the regional RTC office offered the employee a new position (and a paid move) 4 days after RTC had filed the professional liability suit. In fact, the manager did not learn of the suit for 11 days after making the offer (15 days after RTC had filed suit). After learning of the suit on December 28, 1992, the manager acted to limit RTC’s vulnerability: He restricted the individual from all RTC offices and placed him on a fully paid administrative-leave status for approximately 1 month until his employment was to expire because the local RTC office was closing. Previously, the credit specialist’s duties included (1) providing guidance, direction, and control to the institution through the documentation and inventory of assets; (2) directing the sale of owned real estate and loans; and (3) assuming, in the absence of the managing agent in charge of the RTC conservatorship institution, the responsibilities and delegated authorities of the managing agent. In another instance, RTC filed a professional liability suit against the Vice President for Loan Workout (a conservatorship employee) at an RTC conservatorship institution having over $200 million in assets. Following the filing of the suit in December 1992, RTC sent a letter to the individual’s residence requesting that he resign. RTC did not inform the managing agent in charge of the RTC conservatorship institution where the vice president worked of either the suit or the letter. According to the managing agent, he was unaware that RTC had determined the vice president to be responsible for the failure of an institution until the employee showed him a copy of the RTC letter. The managing agent thus had no opportunity to consider revising the vice president’s duties and limiting RTC’s vulnerability. A Virginia newspaper published an article about RTC’s employment of the vice president. The article, entitled “Thrifts: From One Failure to Another,” stated that when RTC filed suit against the individual, it did not have to look far for the defendant as he was working a block away at another failed thrift being managed by RTC. In January 1994, RTC issued a policy covering civil service employees determined to be culpable in the losses of failed institutions. The policy states in part that “Conduct which does not clearly fall into one of [FIRREA’s] prohibited categories is less clear-cut and requires further analysis.” The policy also states, “An example that requires careful consideration is when an RTC employee is named, or about to be named, in a suit filed by the RTC Professional Liability Section.” While this policy is critical for managers in making employment decisions, it does not describe what “further analysis” is required. Thus, the policy provides neither the direction nor the clear guidance that managers need when deciding (1) to hire an individual previously found culpable for the failure of an institution or (2) what personnel action, if any, should be taken against current employees whom the Corporations have found culpable. Similarly, FDIC policy does not provide clear guidance for managers to make necessary employment decisions regarding culpability determinations. FDIC standards of ethical conduct, which adhere to those of the executive branch, state only that FDIC employees cannot be indebted to a failed institution through any extension of credit. Several federal agencies—including RTC and FDIC—coordinate their efforts to pursue claims, prosecutions, and enforcement actions to maximize recoveries at the lowest possible cost. Unfortunately, this effort does not extend to the systematic sharing of information between RTC and FDIC regarding the directors and officers each had found culpable in the failures of federally insured institutions. Responsible officials at RTC and FDIC acknowledged that the Corporations do not customarily share such information. Therefore, they are aware only of those employees against whom their own organization has brought action. After our request, RTC and FDIC identified 12 individuals, one of whom was a conservatorship institution employee, whom the Corporations had previously determined to be culpable and who were holding vital positions in FDIC, RTC, or conservatorship institutions. We identified two additional employees occupying vital positions whom the Corporations had found culpable. These discoveries illustrate the Corporations’ vulnerability. In response to our request for a list of such employees, RTC’s Office of Investigations identified three individuals who held vital positions although they had been determined to be culpable. Those individuals had been found responsible for losses and had been made subjects of professional liability suits or criminal referrals to the Department of Justice since 1989. FDIC’s investigative office identified nine FDIC employees holding vital positions who had been subjects of FDIC professional liability suits or criminal referrals during the 5 preceding years. The 12 RTC/FDIC-identified culpable employees held the vital positions of RTC managing agent, credit specialist, and operations specialist; loan workout officer at RTC conservatorship institutions; or FDIC credit specialist. We did not include in our investigation two other persons whom FDIC identified because they did not have asset disposition responsibilities. These two, however, held positions of trust, as FDIC employed them as investigators to ascertain individuals’ liability for institution failures. Concentrating on employees with asset disposition responsibilities, we obtained a list of 1,132 Corporation employees from RTC and FDIC. We compared this list with RTC’s database of subjects of professional liability suits and RTC’s and FDIC’s databases of subjects of criminal referrals to the Department of Justice. We found two additional employees deemed culpable in vital positions—an FDIC credit specialist and an RTC supervisory operations specialist. FDIC hired the credit specialist in February 1993, although RTC had previously filed a criminal referral that named the individual in 1990. While FDIC was aware that this person had resigned from RTC in May 1992, FDIC’s hiring and supervisory managers were unaware of the criminal referral until we asked that they check with RTC. The FDIC employee’s responsibilities included the analysis of proposed workouts; settlements; and budgets of large, complex assets, ranging to several millions of dollars. RTC hired the supervisory operations specialist in February 1990. In April 1991, RTC made a criminal referral to the Department of Justice, naming this individual. RTC overlooked this individual in the list of culpable employees it provided to us although the criminal referral clearly stated that he was an RTC employee. This oversight further emphasizes the need for both an effective, systematic screening process and adequate databases to support it. The Corporations’ vulnerability may not be limited to the 14 RTC, FDIC, or conservatorship employees that we identified during our investigation. For example, we were limited in our ability to use FDIC’s database of professional liability suits because the databases could not retrieve individuals by name. Thus, we were unable to determine whether the Corporations employed in vital positions any of the individuals whose names were contained in the database. Additionally, RTC maintained no database of employees of institutions that were in conservatorship and could not identify those having previous culpability determinations. Thus, RTC’s vulnerability to fraud, abuse, or mismanagement is increased. In March 1990, the U.S. Secret Service offered to do a vulnerability assessment targeting RTC employees and contractors. RTC did not accept the offer and performed its own assessment, which was published in November 1990. The Secret Service proposal included a review of the application process for new RTC employees and its contractors, as well as a review of RTC databases and criminal referral processes. The subject of RTC’s vulnerability assessment included adherence to RTC’s ethical standards—FIRREA. RTC found that its employment efforts are particularly vulnerable “in view of the need to rapidly employ staff . . . because RTC must ensure that prospective employees meet its own and other ethical requirements.” However, RTC’s ethical standards for its employees do not specifically address the employment of individuals against whom an administrative determination of culpability has been made, with the result that RTC did not identify its vulnerability to such individuals. While we cannot be certain that a Secret Service assessment would have identified the lack of RTC controls for determining which employees and applicants were culpable, as RTC’s focus was on existing ethical standards it did not identify this lack of controls as a vulnerability. RTC does not consider conservatorship employees to be either RTC or contract employees and therefore does not apply the FIRREA employment standards regarding competence, expertise, and integrity to them. We believe that conservatorship employees should be subject to the FIRREA standards because the standards apply to individuals who perform the functions and activities of RTC. “Any individual who, pursuant to a contract or any other arrangement, performs functions or activities of the [RTC], under the direct supervision of an officer or employee of the [RTC], shall be deemed to be an employee of the [RTC] for the purposes of title 18, United States Code and [FIRREA].” (12 U.S.C.A. § 1441 a(n)(1)(West Supp. 1993)). We found that many conservatorship employees perform critical functions of RTC, such as loan workout. They also report directly to an RTC employee, such as the managing agent or credit specialist. Nonetheless, RTC maintains that conservatorship employees are not subject to FIRREA’s employment restrictions. RTC and FDIC do not have the systematic means to always know when they are about to employ, or are already employing, someone whom either Corporation has found to be culpable in the losses that caused the failure of a federally insured financial institution. Their inability to make informed decisions concerning the hiring or duties of such individuals increases the Corporations’ vulnerability to fraud, abuse, or mismanagement. Further, while RTC will transfer its assets and operations to FDIC when RTC closes on December 31, 1995, we believe it is important for both Corporations to address the findings of this report now as they prepare for the transition period. Despite the dwindling number of institutions presently in conservatorship, the vulnerability of any failed thrift to culpable individuals will remain a concern as long as conservatorship is an available means of resolution. Addressing the findings of this report will not only help protect the assets of the institutions under the Corporations’ purview, it will help provide FDIC with assurance that it is aware of any RTC and conservatorship/receivership institution employees who have been found culpable for the losses of failed institutions. We recommend that the Acting Chairman of FDIC and the Deputy and Acting Chief Executive Officer of RTC direct their agencies to perform employment screening before hiring individuals and routinely do so for their current employees, using reliable databases of individuals found responsible for institution failures; develop reliable databases that will effectively identify individuals found culpable in institution failures; share information systematically, enabling each to be aware of those individuals the other has found culpable in the failure of federally insured institutions; and ensure that personnel guidance is clear and appropriate regarding employees and prospective employees for whom the Corporations have made culpability determinations. We also recommend that RTC’s Deputy and Acting Chief Executive Officer ensure that conservatorship employees who occupy positions with responsibilities for asset disposition—such as those performing loan workout functions—be included in the employment screening process. We sent a draft of this report to FDIC and RTC for comment. In their written comments dated September 14 and 16, 1994, respectively, FDIC and RTC agreed with our report and acknowledged that the issues raised are significant. According to FDIC’s Acting Chief Operating Officer and Deputy to the Chairman, FDIC will continue to review the draft report’s conclusions, providing us with the preliminary results of that review, and, in coordination with RTC, develop steps to correct the weaknesses identified. RTC’s Chief Financial Officer indicated that RTC will pursue our recommendations to the fullest extent possible and proposed specific initiatives to address each recommendation. RTC’s initiatives are responsive to our findings and recommendations. If fully and effectively implemented, these initiatives could resolve the issues identified. (See app. II and III for complete agency comments.) As agreed with your office, we plan no further distribution of this report until 30 days after the date of the letter, unless you publicly announce its contents earlier. At that time, we will send copies to the Secretary of the Treasury, the Acting Chairman of FDIC, the Deputy and Acting Chief Executive Officer of RTC, and other interested parties. We will make copies of this report available to others upon request. If you have questions concerning our investigative findings, please contact Robert Hast, Assistant Director for Investigations, of GAO’s New York Regional Office at (212) 264-0730. A list of major contributors is included in appendix IV. We performed our investigation between October 1992 and December 1993. We reviewed and considered relevant laws, regulations, and policies and interviewed responsible management officials at RTC and FDIC headquarters. From RTC, we requested the names of any RTC employee who had been the subject of a professional liability suit or criminal referral for responsibility in a failure of any federally insured institution since the inception of RTC. We requested the same information from FDIC regarding any FDIC employee in the past 5 years. To verify whether the Corporations had provided us the names of all such individuals, we requested personnel information as well as professional liability suit and criminal referral information. We matched RTC and FDIC employees with responsibilities concerning assets of failed institutions against both organizations’ criminal referral listings and against RTC’s professional liability suit listing. From RTC, we obtained listings from databases of (1) federal employees with asset disposition responsibilitiesand (2) individuals against whom RTC had filed professional liability suits or criminal referral actions for responsibility in the failures of federally insured institutions. From FDIC, we obtained listings from databases of (1) employees at FDIC consolidated offices who have responsibilities over assets of FDIC-controlled failed institutions and (2) individuals against whom FDIC had in the past 5 years filed professional liability suit or criminal referral actions for responsibility in the failures of federally insured institutions. James M. Lager, Assistant General Counsel Glenn G. Wolcott, Assistant General Counsel The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 6015 Gaithersburg, MD 20884-6015 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (301) 258-4066. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (301) 258-4097 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a congressional request, GAO reviewed whether the Resolution Trust Corporation (RTC) and the Federal Deposit Insurance Corporation (FDIC) have sufficient systems to assist hiring and management officials in culpability determinations. GAO found that: (1) RTC and FDIC are vulnerable to fraud, abuse, or mismanagement because they do not systematically screen employees or applicants found culpable for bank failures; (2) RTC and FDIC databases do not include the names of all culpable directors and officers of failed institutions; (3) RTC and FDIC databases do not include personal identifiers of culpable individuals; (4) the RTC database includes the names of individuals against whom no suits have been filed; (5) RTC and FDIC have no systematic means for promptly notifying managers and supervisors of employees against whom a culpability determination has been made; (6) RTC and FDIC do not share information regarding individuals found culpable for institution failures; (7) certain employees of RTC, FDIC, and conservatorship institutions hold vital positions although they have previously been determined to be culpable; (8) RTC and FDIC cannot ensure the identification of all culpable employees; (9) RTC is vulnerable to conservatorship employees who have been found culpable, since it does not maintain a database of non-federal conservatorship employees; and (10) RTC and FDIC should address these vulnerability issues to ensure the proper disposition of failed institutions' assets and to protect insurance funds' and taxpayers' interests.