The terms hurricane and typhoon are regionally specific names for a strong tropical cyclone. These storms are referred to as tropical depressions when sustained winds are less than 39 miles-per-hour (mph) and are given a name as a tropical storm if sustained winds exceed gale force of 39 mph up to 74 mph. Hurricanes are tropical cyclones with sustained winds that exceed 74 mph, which circulate counterclockwise about their centers in the Northern Hemisphere. The Atlantic hurricane season runs from June 1 through November 30 each year. On August 13, 2004, the third storm of the 2004 hurricane season, named Hurricane Charley, made U.S. landfall as a category 4 hurricane near Charlotte Harbor on the Gulf of Mexico side of the Florida peninsula with sustained winds of 150 mph. This hurricane was the strongest hurricane to hit the United States since the category 5 Hurricane Andrew in 1992. Hurricane Charley caused catastrophic wind damage across central Florida, with nine tornadoes reported on August 13 in association with the hurricane. As indicated in figure 1, the hurricane’s path moved northeast across central Florida, with the center passing near Orlando at 86 mph as it moved off the northeast coast near Daytona Beach and into the Atlantic Ocean. Charley then moved north along the South Carolina coast, making U.S. landfall again at North Myrtle Beach as a category 1 hurricane with sustained winds of 75 mph. The hurricane rapidly weakened to a tropical storm over North Carolina as it moved up the Atlantic coast. Hurricane Charley created rain, flooding, and seven tornadoes in North Carolina and Virginia, including category F1 tornado damage at Kitty Hawk, North Carolina. On August 15, Charley merged with a frontal zone in southeastern Massachusetts that eventually moved into Canada. Hurricane Charley was cited in two federal disaster declarations for Florida and South Carolina. It was responsible for 33 U.S. deaths according to the Red Cross and 34 U.S. deaths according to NOAA’s National Climate Data Center (NCDC). The Property Claims Service and the Insurance Information Institute, both of which provide insurance damage information, estimated damage to insured property that averaged $7.2 billion and an equal amount for uninsured damages. With total damage estimated at about $15 billion, Charley became the third costliest hurricane in U.S. history through 2005. The sixth storm of the 2004 hurricane season, named Hurricane Frances, reached peak intensity as a category 4 hurricane with sustained winds of 144 mph out in the Atlantic Ocean as it passed north of the U.S. Virgin Islands on August 31, 2004. Frances was downgraded to a category 2 hurricane with sustained winds of around 100 mph by the time it made U.S. landfall near Sewall’s Point, 35 miles north of West Palm Beach on the east coast of Florida on September 5. As indicated in figure 1, Frances moved northwest across central Florida and became a tropical storm as it moved into the Gulf of Mexico near New Port Richey, Florida, on September 6. Later that day it again made U.S. landfall on the Florida panhandle and moved west into eastern Alabama and western Georgia. It weakened to a tropical depression on September 7, and moved into West Virginia early on September 9. Hurricane Frances produced gale force winds as it briefly accelerated northeast across New York and into northern New England until dissipating over the Gulf of St. Lawrence on September 10. Frances caused widespread rains and flooding over much of the eastern United States and a total of 101 tornadoes were reported in association with this hurricane, with 56 occurring in the Carolinas on September 7. Hurricane Frances was cited in five federal disaster declarations for Florida, Georgia, North Carolina, Pennsylvania, and South Carolina. It was responsible for 45 U.S. deaths according to the Red Cross and 38 U.S. deaths according to NOAA/NCDC. The American Insurance Services Group, an insurance trade association, estimated damage to insured property at $4.43 billion and an equal amount for uninsured damages. With total damage estimated at $8.9 billion, Frances became the fifth costliest hurricane in U.S. history through 2005. The ninth storm of the 2004 hurricane season, named Hurricane Ivan, reached category 5 strength three times in the course of its journey across the Atlantic into the Gulf of Mexico, with sustained winds as high as 167 mph. From September 5 to 12, Ivan caused considerable property damage and loss of life primarily in Grenada and Jamaica as it passed through the Caribbean Sea. Ivan weakened to a category 3 hurricane with sustained winds of 121 mph when it made U.S. landfall just west of Gulf Shores, Alabama, on September 16. As indicated in figure 1, Ivan moved across central Alabama where it weakened to a tropical storm and moved northeast as far as the Delmarva Peninsula on September 18. However, even as a weak tropical storm, Ivan produced considerable rain and flooding, spawning 113 tornadoes across the southeastern United States, as depicted in figure 2. This included two category F2 tornadoes in Florida that resulted in five deaths, and 61 tornadoes reported on September 17. Ivan then ceased its northeast movement and over the next 3 days made a large loop and moved southwest along the eastern U.S. coast, crossing Florida back into the Gulf of Mexico on September 21. There Ivan completed its loop and became a tropical storm, making landfall in southwestern Louisiana on September 24. Later that day, it dissipated over the upper Texas coast after completing a storm track more than 5,600 miles long. Hurricane Ivan was cited in nine federal disaster declarations for Alabama, Florida, Georgia, Louisiana, Mississippi, New Jersey, New York, North Carolina, and Pennsylvania. It was responsible for 63 U.S. deaths according to the Red Cross and 52 U.S. deaths according to NOAA/NCDC. The American Insurance Services Group estimated insured property damage at $7.1 billion and an equal amount for uninsured damages. With total damage estimated at $14.2 billion, Ivan became the fourth costliest hurricane in U.S. history through 2005. The 10th storm of the 2004 hurricane season, named Hurricane Jeanne, was a tropical storm as it moved over the U.S. Virgin Islands on September 14, 2004, and produced heavy rain over Puerto Rico on September 15, with sustained winds of 69 mph. Jeanne became a category 1 hurricane over the Dominican Republic with sustained winds of 81 mph that resulted in an estimated 3,000 deaths in Haiti from torrential rainfall, mudslides, and flooding on September 17. Jeanne made U.S. landfall at Port St. Lucie on the east coast of Florida, very near where hurricane Frances made U.S. landfall on September 5, as a category 3 hurricane with sustained winds of 121 mph on the morning of September 26. As indicated in figure 1, Jeanne moved westward across central Florida but quickly became a tropical storm by the time it reached Tampa. It further weakened to a tropical depression as it moved northward, dumping heavy rains across central Georgia and into the Carolinas, Virginia, and the Delmarva Peninsula. On September 29, Jeanne merged with a frontal zone that dissipated eastward into the Atlantic. Hurricane Jeanne was cited in five federal disaster declarations for the U.S. Virgin Islands, Puerto Rico, Florida, Virginia, and Delaware. It was responsible for 13 U.S. deaths, according to the Red Cross, and 28 U.S. deaths, according to NOAA/NCDC. The American Insurance Services Group estimated damage to insured property at $3.44 billion and an equal amount for uninsured damages. With total damage estimated at $6.9 billion, Jeanne became the seventh costliest hurricane in U.S. history through 2005. The Red Cross activated its preparedness and disaster relief operations before hurricane Charley made landfall, and remained on the ground providing critical emergency services through the three subsequent hurricanes. The Red Cross stated that this effort, through the 2004 hurricane season, resulted in the largest hurricane relief operation in its 123-year history. From mid-August through mid-October 2004, the Red Cross reported that it had established over 1,800 shelters that housed almost 425,000 people displaced by the hurricanes, provided over 11 million meals and snacks to hurricane victims and emergency workers, and provided more than 149,000 comfort kits and 113,000 cleanup kits. The Red Cross stated that this effort involved over 35,000 workers, of whom 90 percent were volunteers, to set up shelters, provide transportation, support the sheltering and feeding effort, and distribute supplies. As required by statute and regulation, the Red Cross receives an annual audit of its consolidated financial statements, including a schedule of expenditures of federal awards. The Red Cross is required to have its activities, including a complete, itemized report of all receipts and expenditures, audited by the Secretary of Defense through the U.S. Army Audit Agency pursuant to 36 U.S.C. 300110; Department of Defense Directive 1330.5; and Army Regulation 930-5. The Red Cross is also subject to the audit requirements of the Single Audit Act and OMB Circular No. A- 133, Audits of States, Local Governments, and Non-Profit Organizations. The Red Cross contracted with an independent public accounting firm, KPMG, to conduct a financial audit of its consolidated financial statements, as well as an audit of its schedule of expenditures of federal awards, for the fiscal year ended June 30, 2005. To fulfill its audit responsibilities, avoid duplication and unnecessary expense, and make the most efficient use of available resources, the U.S. Army Audit Agency reviewed KPMG’s work and reports. According to its report of October 21, 2005, the U.S. Army Audit Agency found nothing during its review to indicate that KPMG’s unqualified opinion on the Red Cross’s 2005 consolidated financial statements was inappropriate or could not be relied on. For the Red Cross single audit, the Department of Health and Human Services serves as the cognizant federal agency on behalf of all participating federal agencies under the Single Audit Act audit process. The cognizant agency will review the audit report submitted by KPMG, determine if additional workpaper review is necessary, and coordinate a management decision for KPMG findings and questioned costs. The awarding federal agency has 6 months from receipt of the report to assess any audit findings and questioned costs and issue management’s decision. Known questioned costs are those specifically identified by the auditor. Likely questioned costs are projected based upon an error rate of transactions tested. Resolution of questioned costs may be by repayment; financial adjustments; or other actions, such as changing procedures. The objectives of our audit were to determine whether (1) FEMA and the Red Cross established criteria for allowable reimbursable expenses related to hurricanes Charley, Frances, Ivan, and Jeanne; (2) Red Cross reimbursements did not duplicate funding paid by other federal programs; (3) Red Cross reimbursable claims were paid only for services in states and territories declared eligible for disaster relief; and (4) Red Cross reimbursable claims were paid only for allowable categories of services and support and were supported by adequate documentation. To determine whether there were established criteria for allowable reimbursable Red Cross expenses, we initially reviewed a draft agreement between FEMA and the Red Cross in March 2005. This draft agreement outlined the operating definitions and the proposed approach for federal reimbursement of Red Cross disaster relief, emergency services, and recovery expenditures associated with hurricanes Charley, Frances, Ivan, and Jeanne. We then participated in a series of meetings with representatives of the Red Cross, FEMA, DHS’s Office of Inspector General, KPMG, and OMB. The purpose of these meetings was to refine the criteria to be consistent with FEMA and Red Cross policies and procedures for disaster relief and Public Law 108-324. The final agreement was signed by FEMA and Red Cross officials in May 2005. To ensure that Red Cross reimbursements did not duplicate funds paid by other federal programs, we examined the FEMA and Red Cross agreement that provided that the Red Cross would not request reimbursement for any expenses paid by other federal funding sources. As the primary federal funding source for disaster assistance, FEMA identified any payments it had made to the Red Cross and reconciled amounts to reimbursement requests to ensure that its federal funds were not duplicated. We reviewed this identification and reconciliation process, conducted discussions with FEMA and Red Cross officials, and reviewed for indications of other federal funding during our audit of Red Cross reimbursement requests. To determine if Red Cross reimbursable claims were paid only for services in states and territories declared eligible for disaster relief, we reconciled 21 federal disaster declarations for hurricanes Charley, Frances, Ivan, and Jeanne to the FEMA and Red Cross agreement. We also identified states where federal disaster declarations were issued as a result of severe flooding caused by these four hurricanes. However, the Red Cross, as a not- for-profit organization, is not limited by federal disaster declarations and can provide emergency assistance where it determines there is a need. As a result, we identified several other states where Red Cross incurred some hurricane-associated expenses related to the four hurricanes that were part of the FEMA/Red Cross agreement. To determine whether reimbursable claims were paid only for allowable categories of services and support, and whether those claims were supported by adequate documentation, we reviewed audit work performed by the public accounting firm of KPMG. The Red Cross hired KPMG to perform an entitywide audit of its consolidated financial statements, including all of its federal awards in accordance with OMB Circular No. A- 133, Audits of States, Local Governments, and Non-Profit Organizations. In order to avoid duplication of audit work, we reviewed KPMG’s Single Audit Act audit of the Red Cross for the fiscal year ended June 30, 2005, that contained $88.6 million of incurred expenses and $28.1 million of net reimbursements to be paid from federal funds that we were mandated to audit under Public Law 108-324. We relied on KPMG’s work on the Red Cross’s internal controls and tests of transactions, retested 10 percent of 741 transactions sampled by KPMG, and performed other audit tests as we deemed necessary. We performed our work from March 2005 through March 2006 in accordance with generally accepted government auditing standards. We suspended our work from October 2005 through February 2006 because KPMG was waiting for support from an expanded test of client assistance debit cards from Red Cross chapter offices in the Gulf States affected by hurricanes Katrina and Rita. We provided a draft copy of this report to the American Red Cross and to FEMA for their review and comment on April 14, 2006, with a follow-up copy to DHS on May 11, 2006. We received written comments from Red Cross in a letter dated May 1, 2006, which is reprinted in its entirety in appendix I of this report. According to DHS, FEMA officials have been actively preparing for the 2006 Atlantic Hurricane Season and had no comments on the draft report. We found that FEMA and the Red Cross had properly established criteria for Red Cross reimbursement requests through a May 2005 agreement that identified allowable categories for disaster relief, recovery, and emergency services associated with hurricanes Charley, Frances, Ivan, and Jeanne. This agreement also included definitions of eligibility, listed 18 states and 2 territories where the Red Cross had incurred expenses associated with the four hurricanes, and established administrative procedures for Red Cross reimbursement requests and subsequent payment by federal appropriated funds. Allowable categories for disaster relief, recovery, and emergency services under the May 2005 FEMA/Red Cross agreement consisted of (1) mass care, (2) client personal living needs, (3) client housing needs, (4) client health needs, (5) direct service delivery support, and (6) operational support. These categories are discussed in more detail below. Mass care covered relief supplies and services provided for or distributed to disaster victims and emergency workers that included food, supplies, and expendable equipment to provide mass feeding and shelter operations. An example of Red Cross sheltering efforts is depicted in figure 3. clothing, medical and other supplies, and expendable equipment intended for bulk distribution or used in mass care activities, such as comfort kits, cleanup kits, blankets, lanterns, camp stoves, ice chests, and cots; food, water, ice, fuel, and other consumable supplies for bulk shipping and storage for safekeeping of household goods; sanitation projects, mass immunization, emergency first aid, and supplies used in shelters, first aid stations, service centers, or other Red Cross facilities; and food, transportation, and other services provided to emergency workers. The Red Cross reported that from mid-August through mid-October 2004, it had established over 1,800 shelters that housed almost 425,000 people displaced by the hurricanes, provided over 11 million meals and snacks to hurricane victims and emergency workers, and provided more than 149,000 comfort kits and 113,000 cleanup kits. Client personal living and housing needs covered relief supplies and service given to individuals and families to meet immediate living necessities or to operate households, such as living needs, including food, water, clothing, toilet articles, household supplies, laundry and dry cleaning, storage containers, bedding and linens, cribs and baby items, and coolers to store food, and housing needs, including accommodations in commercial facilities, rent and security deposits, utilities, and emergency repairs to make residences temporarily habitable. The Red Cross reported that more than 330,000 homes were damaged by hurricanes Charley, Frances, Ivan, and Jeanne, with more than 27,000 homes completely destroyed, including the one shown in figure 4. From mid-August through mid-October 2004, the Red Cross stated that it had helped more than 73,000 individuals and families in determining their needs, developing recovery plans, and providing financial aid. Client health needs covered relief supplies and services provided to disaster victims on an individual or family basis to provide for physical and mental health benefits, such as hospital, ambulance, X ray, and laboratory charges; eyeglasses, dentures, hearing aids, and artificial limbs; prescriptions, over-the-counter medication, and first aid supplies; special dietary, housing, or mobility devices; blood and blood products; and burial or cremation expenses. From mid-August through mid-October 2004, the Red Cross reported that volunteer nurses helped over 46,000 people with physical needs, and trained mental health professionals made over 78,000 contacts with people in need to begin the recovery process. Direct service delivery support covered expenses associated with the delivery of disaster services to disaster victims and workers. Emergency response vehicles provided mobile relief sites to distribute hot meals, water, and snacks to hurricane victims, as depicted in figure 5. Direct service delivery support included salaries, travel, and maintenance of disaster staff assigned to provide mass care, family living and housing, and client health services; purchase, rental, repair, and service of nonexpendable equipment and vehicles used to provide direct services and services in shelters and facilities; telephone and related communications equipment; rent, repair, and operating expenses of facilities used to provide direct shipping, freight, and handling expenses; and other miscellaneous expenses. The Red Cross stated that over 35,000 workers, 90 percent of whom were volunteers, were involved in setting up shelters, providing transportation, supporting the sheltering and feeding effort, and distributing supplies. Operational support covered expenses of managing and administering a disaster relief operation that included salaries, travel, and maintenance of disaster staff assigned to functions that support direct service to disaster victims and workers such as administration, records and reports, accounting, public affairs, logistics, training, staffing, local disaster volunteers, communications, computer operations, and liaison functions with other entities; rental, repair, and service of nonexpendable equipment, computer equipment, and vehicles used to provide management and administration; telephone and related communications equipment for field, district, and rent, repair, and operating expenses of facilities used to provide management and administration; printing, copy, postage, and delivery expenses; and meeting expenses and activity expenses to recognize volunteer efforts. Consistent with the law, the May 2005 FEMA/Red Cross agreement provided that the Red Cross would not seek reimbursement for any expenses reimbursed by other federal funding sources. We identified about $0.3 million of FEMA paid transient accommodations and deployment costs that were properly deducted by the Red Cross from its reimbursement requests, so as not to duplicate funding by other federal sources. The Red Cross also deducted from the reimbursements $60.2 million of private donations designated for disaster relief related to the four hurricanes. As the primary federal funding source for disaster assistance, FEMA established internal controls to identify any payments it made to the Red Cross. It subsequently reconciled these amounts to Red Cross requests for reimbursement to ensure that amounts were deducted so that federal funds were not used to reimburse Red Cross expenses more than once. During our audit, we reviewed this identification and reconciliation process and conducted discussions with FEMA and Red Cross officials. We did not identify any evidence of other federal funding during our audit of the Red Cross reimbursements. The Red Cross reported $88.6 million of incurred expenses in states and territories eligible for disaster relief under the four hurricanes in accordance with the FEMA/Red Cross agreement. This included $3.1 million for general relief for a call center, FEMA transient accommodations, and other recovery expenses not specifically identified with any particular one of the four hurricanes. Twenty-one federal disaster declarations were made by the President and issued by FEMA for hurricanes Charley (2), Frances (5), Ivan (9), and Jeanne (5), which cumulatively covered federal disaster aid to 12 states and 2 territories. Federal disaster declarations were also issued for four additional states— Ohio, Tennessee, Vermont, and West Virginia—as a result of severe flooding caused by these hurricanes. However, the Red Cross, as a not-for-profit organization funded primarily through private donations, is not limited by federal disaster declarations and can provide assistance where it determines there is a need. As a result, the FEMA/Red Cross agreement included some hurricane-associated expenses incurred in Arkansas and Texas that were used by Red Cross as staging areas for emergency relief aid to the areas affected by the four hurricanes. The agreement also included Red Cross assistance in Maryland, which was affected by flooding caused by Hurricane Ivan but was not covered by a federal disaster declaration. From August 11, 2004, through June 30, 2005, the Red Cross reported incurred expenses of $88.6 million in connection with hurricanes Charley, Frances, Ivan, and Jeanne. These expenses are presented by hurricane in figure 6. The reported $88.6 million of Red Cross incurred expenses for the four hurricanes by state and U.S. territory are presented in table 1. The May 2005 agreement signed by FEMA and the Red Cross identified 18 states and 2 territories as eligible for reimbursement from the 2004 hurricane appropriation. The agreement did not include Delaware, which was eligible for federal disaster assistance, because the Red Cross stated it incurred no expenses in the state. The 12 states and 2 territories presented in bold in table 1 were determined to be eligible for federal disaster relief in declarations by the President and FEMA that specifically cited hurricanes Charley, Frances, Ivan, or Jeanne. Another 4 states—Ohio, Tennessee, Vermont, and West Virginia—were declared eligible for federal disaster relief as a result of severe flooding caused by the four hurricanes, even though none of the hurricanes were specifically mentioned in the federal disaster declarations. Arkansas and Texas were not declared eligible for federal disaster relief, but the Red Cross stated that it had incurred some staging expenses there, although its expenses in Texas were included with its expenses for Louisiana. Maryland was not declared eligible for federal disaster relief, but the Red Cross provided some assistance there when heavy rains generated by hurricane Ivan caused flooding of the Susquehanna River in Port Deposit, Maryland, in September 2004. The state of New York expenses incurred by the Red Cross were included as general relief, which included a centralized call center and other recovery costs not specifically identified with any particular one of the four hurricanes. The Red Cross’s requested reimbursements of $28.1 million related to the four 2004 hurricanes were included in a schedule of $50.0 million of federal funds from other programs operated by the Red Cross for the fiscal year ended June 30, 2005. Since the Red Cross expends more than $500,000 annually of federal awards, it is required by the Single Audit Act to obtain an annual audit. The Red Cross’s entitywide financial statements and a schedule of expenditures of federal awards for the fiscal year ended June 30, 2005, were audited by the public accounting firm of KPMG in accordance with OMB Circular No. A-133, Audits of States, Local Governments, and Non-Profit Organizations. In order to not duplicate audit efforts, we reviewed and tested the audit work of KPMG related to the reported $88.6 million of Red Cross incurred expenses for the four 2004 hurricanes. In its Single Audit Act audit, KPMG determined that Red Cross expenses were generally incurred for eligible disaster services and supported by adequate documentation. We concur with that determination. However, KPMG identified six weaknesses in the Red Cross’s internal controls related to the reimbursement for the four 2004 hurricanes that it considered to be reportable conditions. KPMG also considered one of these, related to debit cards for client assistance, to be a material weakness. In its report, KPMG made recommendations to the Red Cross to strengthen internal controls related to these six reportable conditions, with which the Red Cross concurred. The report also identified about $712,000 of known questioned costs related to the federal share of the 2004 hurricane program identified through audit sampling that were caused by (1) a bank reporting error of $657,000 on client assistance debit cards and (2) missing or incomplete documentation of $55,000 to support incurred expenses. The Red Cross reported $88.6 million of incurred expenses related to the four 2004 hurricanes for the period August 11, 2004, through June 30, 2005. These expenses, less other federal funds and private donations received, were submitted to FEMA for reimbursement from federal appropriated funds provided under Public Law 108-324, as indicated in table 2. As indicated in table 2, the reported $88.6 million of Red Cross incurred expenses were reduced by $0.3 million of other federal funds and $60.2 million of private donations that resulted in a net reimbursement amount of $28.1 million. We reviewed KPMG’s Single Audit Act audit work on the Red Cross’s internal controls and tests of transactions, and we retested 10 percent of its 741 sample transactions of Red Cross expenses related to the four 2004 hurricanes. We found that we could rely upon the KPMG audit work. In conducting its audit, KPMG identified six reportable conditions in internal controls, the first of which KPMG also determined to be a material weakness. These conditions are discussed in more detail below. One method used by the Red Cross to provide financial assistance to disaster victims is the client assistance card, which is a MasterCard® branded debit card with client assistance amounts determined by on-site caseworkers. The cards were introduced on a large scale basis for the first time during the 2004 hurricane response in Florida. The cards are preferred by the Red Cross in part because of their acceptance by merchants, reduced paperwork, and the flexibility afforded to disaster clients. An internal authorizing approval document (Red Cross Form 1030) is used to issue a card to individual clients following initial casework. Individual card spending limits are determined by the caseworker’s assessment of the client’s immediate needs for housing, food, transportation, and other personal expenses, with a current maximum card balance of $5,000. Card spending limits can be restored after they are consumed if the caseworker determines additional client need exists. Most cards were “cash-enabled,” meaning they could be used to withdraw cash from any ATM. To limit certain risks of unauthorized card use, specific merchant codes are blocked by the card program’s bank administrator in order to prevent the card from being used at locations that principally sell goods such as alcohol and tobacco and at certain luxury retail outlets. KPMG conducted a monetary unit statistical sample of 336 transactions on 334 individual debit cards from a population of about 40,000 debit cards that generated $24.0 million of transactions. The Red Cross could not locate Form 1030s from local Red Cross chapters to support the debit card authorization for 23 of the 334 cards. An additional 17 Form 1030s did not have evidence of appropriate Red Cross approval signatures. For an additional 3 card transactions that KPMG tested outside the monetary unit sample, the Red Cross could not locate documentation to support the transactions. As a result of these exceptions, KPMG identified questioned costs of $55,334 because of missing support or approval signatures related to these 43 transactions. Various reports are available to the Red Cross from the bank issuing the client assistance debit cards to assist in monitoring the cards. These included reports showing amounts “loaded” for the authorized spending limit onto new and existing cards each month, as well as spending reports detailing amounts, dates, and merchants for all card charges. KPMG reported that the Red Cross did not have a procedure in place to reconcile the total amounts authorized by the casework process to the amounts actually loaded onto the cards. In one case identified in a Red Cross internal audit, the amount authorized by supporting casework was $41.26 but a debit card was erroneously loaded with an authorized limit of $4,126.00, all of which was spent. KPMG questioned the excess difference of $4,085. Additionally, while determining the population of client assistance card transactions for audit testing, KPMG identified an amount of $657,619 that the Red Cross could not initially resolve. This amount was the difference between detail amounts reported by the issuing bank based upon card transactions and summary amounts the bank reported to the Red Cross for the debit card program. The Red Cross used the amounts from the bank summary reports to record entries to its general ledger and to recognize debit card expenses for the 2004 hurricane program. No reconciliation between these two bank reports had been performed by the Red Cross following the 2004 hurricane season. The bank investigated the difference and discovered that its summary program reports were erroneously capturing duplicate cardholder information if a card was assigned to a cardholder more than one time. This caused an overstatement in the summary of debit card amounts, although the bank’s detail transaction reports on cards were correct. As a result of this bank error, KPMG identified questioned costs of $657,619. The Red Cross subsequently reduced its final request to FEMA for the 2004 hurricane reimbursement to $28.1 million after adjusting for the amount of the bank reporting error. Client assistance cards were introduced by the Red Cross shortly before the 2004 hurricane season. During the season, its Disaster Operations unit was responsible for monitoring transactions on client assistance cards issued by Red Cross headquarters in Washington, D.C. This unit was to review reports showing the amounts loaded onto cards for duplicate names and cards as well as for unusual balances. Any questionable transactions were to be referred to the Family Services unit for further investigation. However, no standard procedures were developed for monitoring cards until May 2005, when a one-page procedure provided examples of questionable card activity that should be pursued. This included reviewing card usage that exceeded normal authorized dollar limits, investigating multiple cards issued to individuals with the same or similar names, and spot-checking for other unusual data. This guidance also did not specify how identified suspicious transactions will be referred to the compliance units within the Red Cross, or require that follow-up or other ultimate resolution of questionable card activity be documented. The frequency and depth of Red Cross monitoring activities was unclear, and those activities were not routinely documented as to follow-up and resolution of any transactions referred to the Family Services unit. KPMG therefore considered this to be a reportable condition, with no questioned costs identified. Another method used by the Red Cross to provide financial assistance to disaster clients is the disbursing order (DO). A DO is a hard copy Red Cross form prepared by a caseworker that describes the specific goods or services to be provided to the disaster client, the name of the merchant to provide the goods or services, and the authorized dollar limit of the expenditure. The DO is first signed by both the caseworker and the disaster client. After providing the described goods or services to the client, the merchant submits the DO to the Red Cross for reimbursement. The DO is to be signed by both the merchant and the disaster client, who acknowledges receipt of the goods or services. KPMG judgmentally selected and tested 133 DOs from a population of $32.3 million that had been paid to merchants. KPMG found that 6 DOs were not signed by either the disaster client or the merchant and did not contain sufficient supporting documentation, such as an invoice or merchant receipt, which might provide alternative documentation that the goods were received by the intended client. KPMG accepted either signature as substantiation that the goods were delivered, though Red Cross procedure is to obtain both signatures. In addition, for another 2 DOs tested, each amount reimbursed to the merchant was equal to the DO’s authorized expenditure limit, which was greater than the actual expense requested by the merchant. As a result of these exceptions, KPMG identified questioned costs of $2,405 because of missing signatures and $4 because of excess merchant reimbursement. From August 2004 through March 2005, the Red Cross negotiated a master billing contract with a national retailer. The retailer was to centrally gather all DOs honored at its retail locations for reimbursement, and invoice the Red Cross for the sum of all such DOs on a monthly basis. Prior to payment to the merchant, the Red Cross reconciled the invoices to the underlying DOs, based on the information provided by the retailer. Approximately $2 million of financial assistance was provided to disaster clients through this individual merchant billing arrangement. The contract was discontinued in March 2005 after the bulk of client assistance had been provided. During a test of the Red Cross reconciliation process, KPMG could not match charges of $85,588 reimbursed to the merchant to any supporting DOs. The Red Cross investigated these differences as they were identified by KPMG, but was unable to resolve them. These unsupported expenses were included in the pool of costs subject to reimbursement and appear to be the only unmatched charges under the master billing arrangement based on a review of a sample of other monthly invoices and related reconciliations. As a result of these unsupported differences, KPMG identified questioned costs of $85,588. While providing disaster assistance, the Red Cross incurs other expenses related to managing the overall response effort, such as those for supplies, staff travel, and other logistics expenses. Most of these expenses for large- scale disasters are procured and paid for through the Red Cross National Shared Services Center, while other expenses may be incurred at the Red Cross chapter level and subsequently reimbursed by Red Cross national headquarters. KPMG judgmentally selected and tested 120 expense transactions incurred for other than client financial assistance from a population of $32.6 million. For 9 transactions primarily related to staff travel and other staff expenses, the Red Cross could not find supporting documents. As a result of these exceptions, KPMG identified questioned expenses of $21,526 because of missing support. Individuals and families requesting financial assistance are required to provide identification showing that they resided within the disaster- affected area at the time the disaster struck. During disaster response operations, Red Cross case workers interview affected clients to determine their eligibility and assess the type and level of assistance to best meet the clients’ need. For each client, a case file is opened, and a Red Cross standard assistance Form 901 is completed by the caseworker to document eligibility. The form is then signed by the caseworker to indicate that he or she has concluded that the individual or family is eligible for a specified level of financial assistance. For the 2004 hurricane season, some, but not all, of the case files were entered after the fact into a Red Cross database known as the Client Assistance System. KPMG judgmentally selected and tested 60 case files from the Client Assistance System. The Red Cross could not find 7 of the case files, although for 3 files, other records were found to corroborate eligibility. For 2 other case files, there was no evidence of caseworker signature, and for another case file there was insufficient information to document eligibility. KPMG identified questioned costs of $2,415 because of the 4 missing case files and the 1 case file with insufficient documentation. Based on its audit testing, KPMG identified about $712,000 of known questioned costs and $0.9 million of likely questioned costs related to the federal share of the 2004 hurricane program in its Single Audit Act audit of the Red Cross through June 30, 2005. These questioned costs are shown by reportable condition in table 3. In addition to known questioned costs that are specifically identified by the auditor, OMB Circular No. A-133 requires the auditor to consider the best estimate of total costs questioned (likely questioned costs). Based upon the percentage rate of known errors in the statistical monetary unit sample of client assistance cards, KPMG projected an error rate to the entire population of $24.0 million using a 96 percent confidence level and identified total likely questioned costs of about $2.9 million with 32 percent, or about $926,000, related to the federal share, as indicated in table 3. However, that projection is a statistical extrapolation and therefore is not supported by detailed exceptions within the total population. The Red Cross reduced its final request for FEMA reimbursement by the amount of the bank reporting error of $657,619, but did not reduce its reimbursement request for the other $171,000 of known questioned costs that included 32 percent, or about $55,000, related to the federal share. The Department of Health and Human Services, which serves as the cognizant federal agency for the Red Cross under the Single Audit Act audit process, will review the KPMG report and coordinate a management decision for the auditor’s findings and questioned costs. The awarding federal agency has 6 months from receipt of the report to assess any audit findings and questioned costs and issue management’s decision. Corrective action should also be initiated within 6 months after receiving the audit report and proceed as rapidly as possible. We received written comments from the American Red Cross Executive Vice President and Chief Financial Officer on a draft of this report. The Red Cross agreed with the report content, including the six weaknesses identified by KPMG, and stated that it is taking steps to strengthen its policies, procedures, and practices to remedy these weaknesses. It also described steps being taken in anticipation of the 2006 Atlantic Hurricane Season, which runs from June 1 through November 1, 2006. We have reprinted the American Red Cross comments in their entirety in appendix I. FEMA had no comments on the draft report. We are sending copies of this report to Senate Committee on Homeland Security and Governmental Affairs and the House Committee on Government Reform. We are also sending copies of this report to the Under Secretary of Emergency Preparedness and Response in the Department of Homeland Security responsible for FEMA, the Inspector General for the Department of Homeland Security, the Director of OMB, and the Vice President of Finance at the American Red Cross. Copies of this report are available to other interested parties on request. This report will also be available at no charge on GAO’s Web site at http://www.gao.gov. Should you or your staffs have any questions concerning this report, please contact me at (202) 512-3406 or by e-mail at sebastians@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report were Roger R. Stoltz, Assistant Director; Patricia A. Summers; and Eric S. Huff.

Summary: In accordance with Public Law 108-324, GAO is required to audit the reimbursement of up to $70 million of appropriated funds to the American Red Cross (Red Cross) for disaster relief associated with 2004 hurricanes Charley, Frances, Ivan, and Jeanne. The audit was performed to determine if (1) the Federal Emergency Management Agency (FEMA) established criteria and defined allowable expenditures to ensure that reimbursement claims paid to the Red Cross met the purposes of the law, (2) reimbursement funds paid to the Red Cross did not duplicate funding by other federal sources, (3) reimbursed funds assisted only eligible states and territories for disaster relief, and (4) reimbursement claims were supported by adequate documentation. The 2004 hurricane season was one of the most destructive in U.S. history. Fifteen named storms resulted in 21 federal disaster declarations. Four hurricanes affecting 19 states and 2 U.S. territories from August 13 through September 26, 2004, triggered the nation's biggest natural-disaster response up to that time. Over 150 deaths and $45 billion of estimated property damage are attributed to hurricanes Charley, Frances, Ivan, and Jeanne in the United States alone. Through 2005, these four storms rank among the seven costliest in U.S. history. The signed agreement between FEMA and the Red Cross properly established criteria for the Red Cross to be reimbursed for allowable expenses for disaster relief, recovery, and emergency services related to hurricanes Charley, Frances, Ivan, and Jeanne. The Red Cross incurred $88.6 million of allowable expenses. Consistent with the law, the agreement explicitly provided that the Red Cross would not seek reimbursement for any expenses reimbursed by other federal funding sources. GAO identified $0.3 million of FEMA paid costs that the Red Cross properly deducted from its reimbursement requests, so as not to duplicate funding by other federal sources. The Red Cross also reduced its requested reimbursements by $60.2 million to reflect private donations for disaster relief for the four hurricanes, for a net reimbursement of 28.1 million. Red Cross expenses were incurred in states and territories eligible for disaster relief associated with the four hurricanes in accordance with the FEMA/Red Cross agreement. The Red Cross requested reimbursement of $28.1 million for the period August 11, 2004, through June 30, 2005, for payment from federal appropriated funds under Public Law 108-324. After review and some retesting, GAO relied upon audit work conducted by the CPA firm of KPMG, LLP, which determined that most Red Cross expenses were incurred for eligible disaster services and were supported by adequate documentation. However, KPMG identified six weaknesses in the Red Cross's internal controls related to expenses incurred for the four hurricanes and reported $712,000 of known questioned costs, with which Red Cross concurred. The Red Cross also concurred with the content of the GAO report.