Export credit agencies such as the Bank are usually government agencies, although some private institutions operate export credit programs on their respective governments’ behalf, according to a Bank report on global export credit competition. These agencies offer financing for domestic companies to make sales to foreign buyers, in the form of products such as loans, guarantees, and insurance for exporters, according to the Organisation for Economic Co-operation and Development, which monitors international export credit activity. The Bank is one of several federal agencies promoting U.S. exports. According to the Bank, as of December 31, 2016, it had identified 96 export credit agencies worldwide. There have been significant changes in the role of export credit agencies since 2007 and the global financial crisis and the European debt crisis, according to the Bank. This is because ready access to credit before the global financial crisis has given way to caution in lending among private-sector banks, and also because other nations have adopted export credit agencies as a tool for national growth. For fiscal year 2014—which the Bank says is the most recent year in which it operated with full authority— the Bank reported authorizing nearly $20.5 billion in financing in support of an estimated $27.5 billion worth of U.S. exports and nearly 165,000 American jobs. For fiscal year 2017, operating under reduced authority, the Bank reported authorizing more than $3.4 billion in financing to support $7.4 billion of exports and an estimated 40,000 jobs. The Bank, which has about 430 employees, was established under the Export-Import Bank Act of 1945. Under the act, the Bank must have a “reasonable assurance” of repayment when providing financing; it must supplement, and not compete with, private capital; and it must provide terms that are competitive with foreign export credit agencies. Also relevant to whether the Bank provides assistance is whether foreign competitors of the U.S. exporter are receiving export credit assistance from their home nations, and thus the American exporter would need assistance to stay competitive. Over time, Congress has directed the Bank to support certain specific types of exports. Such requirements include using at least 25 percent of its authority to finance small-business exports; promoting exports related to renewable energy sources; and promoting financing for sub-Saharan Africa. As described in figure 1, to support U.S. exports, the Bank offers four major types of financing: direct loans, loan guarantees, export-credit insurance, and working capital guarantees. Bank products generally have three maturity periods: Short-term transactions are for less than 1 year; medium-term transactions are from 1 to 7 years long; and long-term transactions are more than 7 years. For fiscal year 2017, the Bank reported it had exposure in 166 countries. Figure 2 shows Bank exposure by product type, geographic region, and economic sector, for fiscal year 2017. Its greatest exposure, by product type, was in loan guarantees. By geographic region, the largest exposure was the Asian market. By economic sector, exposure was biggest in aircraft products. Because the Bank’s mission is to support U.S. jobs through exports, there are foreign-content eligibility criteria and limitations on the level of foreign content that may be included in a Bank financing package. For medium- and long-term transactions, for example, the Bank limits its support to 85 percent of the value of goods and services in a U.S. supply contract, or 100 percent of the U.S. content of an export contract, whichever is less. There are also requirements that certain products supported by the Bank must be shipped only on U.S.-flagged vessels. Defaults occur when transaction participants fail to meet their financial obligations. The Bank must report default rates to Congress quarterly. It calculates the default rate as overdue payments divided by financing provided. If the rate is 2 percent or more for a quarter, the Bank may not exceed the amount of loans, guarantees, and insurance outstanding on the last day of that quarter until the rate falls under 2 percent. As of March 31, 2018, the Bank reported its default rate at 0.438 percent. The Bank is overseen by a Board of Directors (the Board), which has a key role in approving Bank transactions, because directors must approve medium- and long-term transactions of greater than $10 million. Since July 2015, however, the Board has lacked a quorum (at least three members), which has precluded approval of these large transactions. Also due to the lack of a quorum, new transaction activity has shifted away from larger transactions, according to Bank managers. The Bank’s total exposure has recently declined by about a third, from $113.8 billion at the end of fiscal year 2013 to $72.5 billion at the close of fiscal year 2017, according to the Bank. In part during the period when the Board has lacked a quorum and been unable to approve large transactions, the amount of earnings the Bank has transferred to the Department of the Treasury has declined steadily, according to Bank figures. Since 2012, the amount the Bank transferred to the Treasury peaked at $1.1 billion in fiscal year 2013. In successive years, that transfer fell to $674.7 million in fiscal year 2014, $431.6 million in fiscal year 2015, and $283.9 million in fiscal year 2016, before reaching zero in fiscal year 2017. As the Board vacancies have continued, a backlog of Board-level transactions has grown, reaching an estimated $42.2 billion as of December 2017. The Board also has a key role in risk management, with members serving on the Bank’s Risk Management Committee, which oversees portfolio stress testing and risk exposure, according to the Bank. Board members also approve the appointment of the chief risk officer (CRO), the chief ethics officer, and members of advisory committees. During the course of our review, in addition to the Board quorum issue, Bank senior leadership changed. According to the Bank, the following took place: The acting chairman of the Board and president of the Bank resigned. The vice chairman, first vice president, and acting agency head also later resigned. Subsequently, a new executive vice president, chief operating officer, and acting agency head was named. Following that, an acting president and Board chairman was named. Fraud and “fraud risk” are distinct concepts. Fraud—obtaining something of value through willful misrepresentation—is challenging to detect because of its deceptive nature. Fraud risk exists when individuals have an opportunity to engage in fraudulent activity, have an incentive or are under pressure to commit fraud, or are able to rationalize committing fraud. When fraud risks can be identified and mitigated, fraud may be less likely to occur. Although the occurrence of fraud indicates there is a fraud risk, a fraud risk can exist even if actual fraud has not yet been identified or occurred. According to federal standards and guidance, executive-branch agency managers are responsible for managing fraud risks and implementing practices for combating those risks. Federal internal control standards call for agency management officials to assess the internal and external risks their entities face as they seek to achieve their objectives. The standards state that as part of this overall assessment, management should consider the potential for fraud when identifying, analyzing, and responding to risks. Risk management is a formal and disciplined practice for addressing risk and reducing it to an acceptable level. We issued our Fraud Risk Framework in July 2015. The Fraud Risk Framework provides a comprehensive set of leading practices, arranged in four components, which serve as a guide for agency managers developing efforts to combat fraud in a strategic, risk-based manner. The Fraud Risk Framework is also aligned with Principle 8 (“Assess Fraud Risk”) of the Green Book. The Fraud Risk Framework describes leading practices in four components: commit, assess, design and implement, and evaluate and adapt, as depicted in figure 3. The Fraud Reduction and Data Analytics Act of 2015, enacted in June 2016, requires the Office of Management and Budget (OMB) to establish guidelines for federal agencies to create controls to identify and assess fraud risks, and to design and implement antifraud control activities. The act also requires OMB to incorporate the leading practices of the Fraud Risk Framework in those guidelines. In July 2016, OMB published guidance on enterprise risk management and internal controls in federal executive departments and agencies. Among other things, this guidance affirms that managers should adhere to the leading practices identified in the Fraud Risk Framework. The act also requires federal agencies to submit to Congress a progress report each year, for 3 consecutive years, on implementation of the controls established under the OMB guidelines. The Bank has identified a dedicated entity to lead fraud risk management activities, as called for in the first component of GAO’s Fraud Risk Framework. In addition, employees generally have a positive view of antifraud efforts across the Bank, according to our employee survey. However, we also found that management and staff have differing views on key aspects of the Bank’s antifraud culture. In particular, we identified issues inconsistent with the notion of “an antifraud tone that permeates the organizational culture,” as the Fraud Risk Framework calls for, in which there is agreement across the organization on key fraud issues and practices. These areas of disagreement on aspects of the Bank’s antifraud culture include how active the Bank should be in preventing, detecting, and addressing fraud; and the adequacy of time for underwriting, which the Bank says is its primary safeguard against fraud. Bank managers said that our findings provide an opportunity for additional staff training on fraud issues. The Bank has identified two managers who serve as a dedicated entity for leading fraud risk management activities, managers told us. These are a vice president of the Credit Review and Compliance division (CRC) and an assistant general counsel in the Bank’s Office of the General Counsel (OGC). According to Bank managers, they work together under the direction of the CRO, who was permanently named to the position on a part-time basis in September 2016. GAO’s Fraud Risk Framework provides that the dedicated entity can be an individual or a team, depending on the needs of the agency. Hence, the Bank’s arrangement is consistent with the framework. Before recently identifying the two managers as the dedicated entity, Bank managers told us there was no centralized entity responsible for fraud risk management. Likewise, Bank written procedures, dated February 2015, for preventing, detecting, and prosecuting fraud provided there is no “central figure in charge” of such efforts. The CRO told us that he oversees the two managers in their work as the dedicated entity. We also found that the two managers named to form the dedicated entity are involved in one of the key activities contemplated by the Fraud Risk Framework. Overall, these activities include serving as a repository of knowledge on fraud risks and controls; leading or assisting with trainings and other fraud-awareness activities; and coordinating antifraud initiatives. The two managers have helped develop and provide training, some of which is mandatory and targeted directly at fraud issues, managers told us. The Bank provides semiannual fraud training through OGC for claims-processing staff, Bank managers also said. Other training, while nominally not directed at fraud, can nevertheless involve fraud issues, Bank managers told us. For instance, managers told us recent training on shipping matters included a review of fraudulent shipping documentation, which is one way fraud can be perpetrated. GAO’s Fraud Risk Framework calls for creating an organizational culture to combat fraud, such as by demonstrating senior-level commitment to fighting fraud and involving all levels of the agency in setting an antifraud tone. Bank managers, in interviews, and staff, in our employee survey, generally expressed positive views of the Bank’s antifraud culture. For example, according to Bank managers, the Bank has maintained an antifraud culture, which they attribute to factors including: fraud and ethics training; internal controls; tone set at the top by management; a realization after fraud cases in the 2000s that the Bank cannot be solely reactive to fraud; and the pursuit of fraud cases by the Bank and its OIG. Our survey results indicate that Bank employees also generally have a positive view of antifraud tone across the Bank and attention paid to combating fraud. For example: Eighty percent said Bank management in general has established a clear antifraud tone, to the extent of “a great deal” or “a lot.” Employees said that based on senior management’s actions, preventing, detecting, and addressing fraud is “extremely” or “very” important to the Bank (86 percent). Staff expressed “a great deal” or “a lot” of confidence in senior management (76 percent), managers in their division (85 percent), and their peers (82 percent), to respond to fraud on a timely and appropriate basis. Illustrative Comments from GAO’s Survey of Bank Employees “The Bank has become much more sensitized to the risks of fraud over the last 10 years.” “The progress made on combating fraud is tremendous. When I started, no one really cared, and fraud was common…. Now, blatant attempts at fraud are a rarity.” “There is a high degree of concern at all levels of the Bank regarding potential fraud, which has resulted in good oversight.” We also found indications of disagreement among managers and staff about how active the Bank should be in preventing, detecting, and addressing fraud. Overall, Bank managers told us, the Bank’s current approach has been appropriate for dealing with fraud. In particular, an OGC manager told us that with its underwriting and due diligence standards—the process for assessing and evaluating an application before approval—and established fraud procedures, the Bank has an appropriate strategy to mitigate fraud risks it knows about or envisions occurring. However, about one-third of survey respondents (35 percent) said the Bank should be “much more active” or “somewhat more active” in preventing, detecting, and addressing fraud. Less than half (44 percent) said the current level of activity should remain the same. Asked whether what they see as the Bank’s current approach for overseeing fraud and fraud risk, based on the level of responsibilities of various parties involved, is the most effective way to do so, about 6 in 10 (62 percent) said yes. While Bank managers characterized our survey results as positive, these divergent views indicate room for strengthening antifraud culture, in light of the Fraud Risk Framework’s goal of achieving shared views across the organization. Illustrative Comments from GAO’s Survey of Bank Employees “The Bank should be much more active in preventing, detecting, and addressing fraud, because the Bank handles business transactions that involve taxpayers’ money.” “The Bank needs more funding for technology to help with fraud prevention and additional Bank staff to spot/monitor fraud.” “The first- and second-level managers have not done all they could to ensure fraud prevention. The front-line credit officers are the ones in the best position to detect fraud and management does not always support it.” “A more proactive approach to fraud detection, rather than a reactive approach, would be more prudent. This means trying to sniff out fraud the preapplication and underwriting stages.” Another area where we identified differing views is in the adequacy of time for underwriting. Preapproval underwriting, and the due diligence done as part of that process, is the Bank’s main control against fraud, according to Bank managers and procedures. However, during our review, Bank managers also acknowledged in interviews that their business involves potentially competing objectives: performing sufficient due diligence to prevent and detect fraud prior to approving transactions, while still processing transactions in a timely manner to meet customers’ needs and achieve the Bank’s mission. Some comments we received in our employee survey illustrated the tension between the competing objectives of thorough due diligence and timely processing of transactions. Illustrative Comments from GAO’s Survey of Bank Employees “Detecting fraud is a very high priority, as is appropriate. But overemphasis on managing that risk would lead to a sense of paranoia when approaching any new risk.” “Given all the other obligations we have, even more time spent on fraud detection means less time for other transaction-related work, with only marginal benefit.” “Risk is part of the business, and being overly cautious leads to never taking any risk and consequently not serving the customers.” “Fraud is important to discuss, but it should not become the main force driving the organization. There needs to be more of a risk-based analysis when determining how much to concentrate on fraud.” According to a Bank report on global export credit competition, transaction processing time is an important factor in customers’ decisions to choose the Bank over foreign export-financing agencies. In recent years, the Bank has significantly reduced processing time. Bank statistics show that the percentage of transactions completed in 30 days or fewer grew from 57 percent in fiscal year 2009 to 91 percent in fiscal year 2016. For 100 days or fewer, the rate has increased from 90 percent to 99 percent over the same period. Bank managers told us they seek to strike the right balance between the competing objectives and believe they have done so. For example, according to the CRC division, the Bank chooses to perform some of its fraud-detection and mitigation activities after application approval—such as through reviews of transactions selected on both a random and risk- based basis—in order to not unduly delay processing applications. Under Bank practices, document review can be abbreviated, and, after underwriting approval, lenders may accept certain transaction documentation, such as invoices or shipping documents, at face value unless something appears suspicious, managers told us. In the particular case of processing short- and medium-term transactions, the Bank is alert to “red flag” items—known warning signs, such as use of nonbank financial institutions, or participants that are trading entities rather than original equipment manufacturers, managers told us. But otherwise, the Bank limits the extent of its application investigation, according to the Bank’s OGC. In particular, as the Bank’s OGC told us, the Bank is required by law to make medium-term offerings a “simple product.” There is pressure both legally and commercially to process transactions quickly, because, otherwise, an exporter could lose its business opportunity, the Bank’s OGC told us. In many of these transactions, both the exporter and buyer are small, the OGC also said, so it is more difficult to get information. As a result, according to the OGC, the Bank relies more on self-reporting by transaction parties. For these reasons, the Bank’s OGC told us, for both short- and medium-term products, there are not as many “inherent checks and balances” in the process. We note that based on previous GAO work, self-reporting can present an opportunity for fraud. However, our survey results suggest that significant portions of Bank staff question whether the Bank is striking the right balance in providing sufficient time for preapproval review of transactions. Specifically, Bank staff raised concerns about the amount of time dedicated to the key task of preapproval review of applications. For each of the Bank’s three major product maturity categories, we asked whether the application process provides enough time for Bank staff to conduct thorough due diligence on potential fraud risks. For short-term products—which Bank managers said, as a category in general, have been the most susceptible to fraud recently—less than half (47 percent) said there is “always” or “usually” enough time; and about 20 percent said there is “sometimes,” “seldom,” or “never” enough time. For both medium- and long-term products, about 6 in 10 (56 percent and 61 percent, respectively) said the application process “always” or “usually” provides enough time. As noted, while Bank managers characterized our survey results as positive, these views indicate an opportunity for the Bank to further set an antifraud tone that permeates the organizational culture. Illustrative Comments from GAO’s Survey of Bank Employees “More due diligence should be required in order to qualify for the U.S. government’s support.” “The Bank is more concerned with increasing sales than preventing fraud.” Our survey also identified that while nearly half (48 percent) of respondents rated fraud as a “very significant” or “significant” risk to the Bank, there may be misunderstanding among employees on where responsibility lies for fraud risk management. We asked employees to describe the extent to which each of six offices or groups—OGC, the OIG, the Office of Risk Management, Bank senior management, all bank staff and managers collectively, or others—are responsible for overseeing fraud risk management activities at the Bank. The OIG received the highest response, with 73 percent saying it has “a great deal of responsibility.” Bank managers told us this result is to be expected, because staff associate issues of fraud with the OIG. However, these survey results suggest confusion—lack of a shared view, from the standpoint of antifraud culture—around the OIG’s role, which includes investigating suspected fraud, rather than overseeing the Bank’s fraud risk management activities. The OIG acknowledged to us that its role does not include responsibility for overseeing fraud risk management activities at the Bank. Asked about our findings overall, Bank managers told us they view our survey results as positive because the results indicate employees have a strong awareness of fraud and the risk it presents to the Bank. For example, regarding the results about the role of the OIG, they noted that staff are actively encouraged to report suspected fraud through channels—first to OGC, for subsequent referral to the OIG. Thus, employees would understand the OIG as being responsive to fraud, and Bank managers believe this likely accounts for the survey result. Nevertheless, they said, our survey results provide an opportunity for more detailed training, to better communicate with staff. In particular, the Bank managers told us such training would focus on the Bank’s approach to fraud, plus the Bank’s organizational structure for addressing fraud. The training will also clarify that the OIG has an investigative function as well as an auditing function, they said. Our employee survey results underscore the potential benefit of further fraud training. Among respondents who said they have received fraud or fraud risk-related training provided by the Bank in the last 2 years, three-quarters said it was “extremely” or “very” relevant to their job duties. Nearly two-thirds (63 percent) said it was “extremely” or “very” useful to their duties. Overall, about half (52 percent) of respondents said fraud or fraud risk-related information obtained from management, or any Bank resources, has increased their understanding of fraud “a great deal” or “a lot.” The differences we identified in perceptions of fraud risk and fraud management responsibilities do not, by themselves, implicate the performance of any particular antifraud control, or suggest that any additional control is necessary. However, to the extent views on significant antifraud issues, such as how active the Bank should be in preventing, detecting, and addressing fraud, or adequacy of time devoted to underwriting, differ across the organization, the Bank cannot ensure that it is best setting an antifraud tone that permeates the organizational culture, as provided in the Fraud Risk Framework. In particular, as the framework describes, antifraud tone and culture are important parts of effective fraud risk management. These elements can provide an imperative among peers within an organization to address fraud risks, rather than have the organization rely solely on top-down directives. The Bank has taken some steps to assess fraud risk. However, it has not conducted a fraud risk assessment, tailored to its operations, or created a fraud risk profile, both as provided in the second component of GAO’s Fraud Risk Framework. Further, under the framework, recent changes in the Bank’s operating environment indicate a heightened need to do so. We also found that although the Bank has been compiling a “risk register” intended to catalog risks it faces across the organization, this compilation does not include some known fraud risks, indicating that the Bank’s assessment is incomplete. In addition, we found that while the Bank has adopted a general position on the degree of risk it will tolerate, its current risk tolerance is not specific and measurable, as provided by federal internal control standards. Bank managers told us they will revise their fraud risk management practices to fully adopt the Fraud Risk Framework. A leading practice of the Fraud Risk Framework calls for agencies to conduct fraud risk assessments at regular intervals, as well as when there are changes to the program or operating environment, because assessing fraud risks is an iterative process. Managers should determine where fraud can occur and the types of internal and external fraud the program faces. This includes an assessment of the likelihood and impact of fraud risks inherent to the program; that is, meaning both fraud risks known through fraud that has been experienced, as well as other fraud risk that can be identified, based on the nature of the program. According to a Bank report, FY2016 Enterprise Risk Assessment, the Bank is more susceptible to fraud, due to “the nature of the Bank’s mission, the high volume of transactions it executes, and the need for various groups within the Bank to work together to successfully defend against fraud.” The Bank’s short- and medium-term products are more susceptible to fraud, according to Bank managers. Other indicators of fraud, according to the managers, include domestic geography, transactions that involve truck shipments; international geography, since conducting adequate due diligence can be more difficult in remote locations; and when there are smaller, less well-known parties on both sides of the transaction. In this environment, the Bank has taken some steps to assess known fraud risks. Generally, the Bank’s practice has been to assess particular fraud risks and lessons learned following specific instances of fraud encountered, according to Bank managers. Because it has focused on fraud already encountered, the Bank’s practice has not been of the comprehensive nature provided in the Fraud Risk Framework. As an example of its current approach, according to Bank managers, the Bank experienced “significant fraud” in the early 2000s. This was chiefly in the medium-term program, and to a lesser degree, the short-term program, the managers said. As a result, the Bank made changes that reduced the fraud significantly, they said. Otherwise, according to the CRO, fraud has been addressed within product lines, as appropriate. Under its current approach, the Bank’s risk assessments do not include areas where fraud has not already been detected, according to Bank managers. They acknowledged that approach could expose the Bank to fraud risks for activities not yet discovered. A key difference between the Bank’s current approach, as illustrated above, and leading practices as provided in the Fraud Risk Framework, can be seen in how fraud risks are assessed. As described later, the Bank has been compiling risks it faces across the organization, with fraud risk among them. These efforts have focused on soliciting views of Bank staff. By contrast, the framework envisions a more comprehensive approach. Effective fraud risk assessments identify specific tools, methods, and sources for gathering information about fraud risks, according to the framework. Among other things, this can include data on trends from monitoring and detection activities. Under the framework, programs might develop surveys that specifically address fraud risks and related control activities. It may be possible, the framework suggests, to conduct focus groups, or engage relevant stakeholders, both internal and external, in one-on-one interviews or brainstorming about types of fraud risks. Thus, we found, the Bank’s current process for assessing fraud risk has been generally reactive and episodic, rather than regularly planned and comprehensive. Rather than adopt a more proactive approach, the Bank has instead relied on the normal processing and review of transactions— which build in experience with previous fraud schemes—as the truest test for identifying fraud issues or concerns, according to Bank managers. Recent changes in the Bank’s program and operating environment also heighten the need for comprehensively assessing fraud risks, according to the Fraud Risk Framework. Such changes include the Bank’s inability to approve large transactions due to the absence of a quorum. This has meant transaction activity has shifted to smaller transactions, which carry a greater risk of fraud, according to bank managers. Additionally, Congress recently mandated that the Bank increase its focus on small businesses, whose transactions present a different risk profile than those of the Bank’s large customers, according to Bank managers. Further, the Bank’s transaction backlog could also become an issue in the future. If a Board quorum is restored, there could be pressure to process transactions quickly in order to clear the backlog, which could undermine the quality of the underwriting process, according to documentation from the Office of the CRO. According to our review, the Bank’s current antifraud controls further the goal of protecting Bank resources and providing “reasonable assurance” of repayment. However, without planning and conducting regular fraud risk assessments, as identified in GAO’s Fraud Risk Framework, the Bank is vulnerable to not identifying material risks that can hurt performance or its ability to fulfill its mission. As Bank managers acknowledged to us, the Bank faces acute reputational risk if new instances of large or otherwise significant fraud emerge. The Bank has taken some steps in an effort to identify, manage, and respond to risks, including those related to fraud. It has been developing a “risk register”—a compilation of risks across the organization. It has also recently completed an “enterprise risk assessment” through an outside consultant. However, these efforts do not reach the full extent of the relevant leading practices of the Fraud Risk Framework. Specifically, the framework call for agencies to identify inherent fraud risks of a program, examine the suitability of existing fraud controls, and then to prioritize “residual” fraud risks—that is, risks remaining after antifraud controls are adopted. For the risk register, individual business units contribute items, such as indicating types of risk and likelihood, and methods to mitigate the risk. The register, through the Bank’s Office of Risk Management, notes the risk of fraudulent deals generally, characterizing the likelihood as “somewhat likely,” but having the possibility of “major” financial, operational, legal, and reputational impacts. However, particular methods of fraud known to the Bank through experience—such as applicants submitting fraudulent documentation—are absent thus far. This indicates the register is incomplete, from the standpoint of identifying where fraud can occur and the types of internal and external fraud risks the program faces, as provided in GAO’s Fraud Risk Framework. Other inherent fraud risks, such as those posed by the Bank’s more limited understanding of transactions made when it delegates lending authority to other institutions, are also absent from its risk register. Work continues on developing the risk register, Bank managers told us. However, adoption of the risk register has been delayed, due to a reorganization of Bank management and the vacancies on the Board. Without a more comprehensive assessment of inherent fraud risks, the Bank cannot be assured of the extent to which existing controls effectively mitigate inherent risks. According to the chief risk officer, the Bank’s risk register is part of a more wide-ranging “enterprise risk management” strategy, which includes documenting a range of risks across the organization, including fraud. In March 2017, as part of this strategy, the Bank completed the enterprise risk assessment. Based on assessments by senior Bank managers, it identifies fraud risk—defined as a “significant and high-profile fraud” conducted against the Bank—as one among a range of risks facing the Bank. Consistent with Bank managers’ representations to us, the enterprise risk assessment ranks the likelihood of fraud risk as low against other risks the Bank faces—fourth out of five among “operational” risks, and 24th out of 26 total identified risks. Figure 4 depicts how the Bank evaluates these operational risks, in a schematic pairing likelihood of the event with expected impact if they were to occur. In this context, fraud risk is the least prominent risk among the top operational risks identified. In addition to operational risks, the enterprise risk assessment also details six high risks facing the Bank overall. Among them are new or unfamiliar deal structures, which may present increased repayment risk; and doing business in new and unfamiliar technologies, sectors, and industries where the Bank has limited experience. Although fraud is not explicitly identified as a risk, we note these new activities could provide an opening for those seeking to commit fraud. During our review, Bank managers maintained that the enterprise risk assessment represents a “comprehensive fraud risk assessment” undertaken by the Bank. They also, however, acknowledged that this assessment does not contain all the elements of a fraud risk assessment as described in GAO’s Fraud Risk Framework. For instance, as noted, the Bank has not conducted a comprehensive assessment of inherent fraud risks, tailored to its operations. We note that because, as described above, the Bank has not undertaken a fraud risk assessment as envisioned by the Fraud Risk Framework, its ranking of fraud risk compared to other risks may change after it has completed such an assessment. This is because a comprehensive assessment may identify new fraud risks or produce revised assessments of known fraud risks, both of which could affect relative rankings of other risks. A leading practice of the Fraud Risk Framework calls for agencies to determine fraud risk tolerance. Further, federal internal control standards state that managers should consider defining risk tolerances that are specific and measurable. In addition, under the framework, tolerance cannot be determined until the agency has identified inherent fraud risks and assessed their likelihood or impact. As part of its overall risk management activities, the Bank has adopted a general position on its fraud risk tolerance. Specifically, Bank managers told us that, by its nature, the Bank accepts more risk than the commercial sector; and some level of fraud is to be expected because it is not reasonable to eliminate all fraud in its programs. The instances of fraud encountered by the Bank in recent years have centered on small exposures, according to bank managers. Thus, the current level of fraud the Bank experiences is “defensible,” given the Bank’s mission and number of transactions it undertakes, according to the CRO. Bank managers said that fraud activity has steadily declined over the last decade, based on what they cited as fraud indicators that are reviewed by the Bank’s OGC. Bank managers also pointed to claims as another indication of declining fraud activity. Transaction participants file claims for losses covered under Bank loan guarantee and insurance products, such as if a borrower fails to make required payments. The Bank considers fraud to be a subset of transactions that result in claims, and managers cited declining claims activity over the last decade as an indirect measure of fraud activity. Table 1 shows a history of claims paid for fiscal years 2008 through 2017. Overall, Bank managers told us that in light of the decline in fraud they described, the task facing the Bank is to make sure that staff do not lose their focus on fraud and become too comfortable. We asked the Bank to provide statistics supporting the claimed long-term decline in fraud activity, based on fraud indicators. In response, managers told us the indicators are actually not “precise or numerical measures.” Instead, OGC noted the office is aware of fraud activity through “consultations and general sense of day-to-day business.” As for claims, we note that not all fraud activity may result in claims. Consequently, an analysis of claims alone may not reveal a complete or accurate view of fraud activity. In addition, although Bank statistics we reviewed show a decline in number of claims filed from fiscal year 2014 through nearly the end of fiscal year 2017, the decline is likely attributable to the lapse in the Bank’s authority in fiscal year 2015, according to a Bank report. While the Bank has adopted a general position on its fraud risk tolerance—that the current level of fraud is defensible, given the Bank’s mission—its current risk tolerances are not specific and measurable. Without more specific and measurable risk tolerances, the Bank cannot be assured of the extent to which any fraud risks exceed the Bank’s fraud risk tolerance. For example, a measurable risk tolerance could express willingness to tolerate an estimated amount of potentially fraudulent activity, given resource constraints in eliminating all fraud risks. After initially telling us that the Bank’s fraud risk management practices are working well and do not need modification, Bank managers later told us they will revise their approach. They now plan to conduct periodic fraud risk assessments and assess risks to determine a fraud risk profile, as provided in GAO’s Fraud Risk Framework, they said. Asked what prompted the changes, the CRO attributed them to our inquiries plus the Bank’s own growing experience with enterprise risk management. Bank managers also noted that since 2013, there has been an evolution in Bank antifraud controls, as part of what they refer to as a continuous improvement process. Specifically, the Bank’s new effort will include a range of new fraud management activities, according to the managers, starting with a fraud risk assessment and also including determining a fraud risk profile, on a priority-risk basis. The Bank also plans to identify residual risks and mitigating factors. In addition, according to the managers, this new work in addressing fraud risk is planned to include developing specific fraud risk tolerance or tolerances, with a metric for measuring such tolerance. As for implementation of the planned new approach, Bank managers stated they plan to complete a fraud risk assessment by December 2018 and to determine the Bank’s fraud risk profile by February 2019. However, Bank managers did not provide us with documentation describing in detail how they plan to ensure their fraud risk assessments and fraud risk profile are consistent with GAO’s Fraud Risk Framework. For example, we requested documentation of any specific plans to adopt any of the four components of GAO’s framework. Bank managers told us they plan to work with an outside consultant, and provided an outline of planned activities. However, the information did not describe how the Bank will ensure its risk assessments and profile include a full range of inherent fraud risks, including known fraud risks that are absent from its current risk register. Similarly, the managers did not provide documentation describing how the Bank’s fraud risk assessments and profile will include risk tolerances that are specific and measurable. Our employee survey results highlight the importance of the Bank’s planned new approach. In comments, some respondents noted the changing nature of fraud, underscoring the importance of taking a wider, more proactive approach to fraud, which the Fraud Risk Framework encourages. Illustrative Comments from GAO’s Survey of Bank Employees “There are tricks that financial fraudsters would use that many of our staff are unaware of.” “The biggest risk is that we cease to see fraud controls as an ever-evolving process.” “Types of fraud are constantly changing.” “To assume that thieves don’t evolve is inane, and to assume that you have the best, most evolved mechanisms for combating fraud is presumptuous.” Given the importance, under a more proactive approach, of being able to identify and react to new forms of fraud, we also asked employees how well they believe Bank senior management understands new or changing ways of attempting or committing fraud. About two-thirds (67 percent) said senior Bank management understands “very well” or “for the most part,” with the remaining respondents undecided or believing otherwise. The Bank has instituted a number of antifraud controls but has not developed an antifraud strategy based on a fraud risk profile, or implemented specific control activities to achieve such a strategy. This is because, as discussed earlier, it has not yet completed a fraud risk assessment tailored to its operations. As described in the third component of GAO’s Fraud Risk Framework, agencies should design and implement a strategy with specific control activities to address risks identified in the fraud risk assessment. We also found the Bank has opportunities to improve antifraud controls through greater fraud awareness and use of data analytics. Leading practices for fraud risk management under the third component include fraud awareness and data analytics activities, which can enhance the agency’s ability to prevent and detect fraud. The Bank currently employs a number of antifraud controls, both before and after transaction approval, which Bank managers told us include: Specific antifraud activities within individual business units, as they operate their respective programs. Review of transactions, including checking for fraud activity, following transaction approval. Later-stage review, such as examinations and recommendations by the Bank’s OIG. Preapproval antifraud efforts: Underwriting is the initial step in preventing fraud, and underwriters have a heightened awareness of fraud and irregularities, Bank managers told us. Under the Bank’s antifraud procedures, underwriters in the business units should be aware of fraud risks in their transactions and be alert to indications of fraud. Prior to approval, transactions and their participants go through several evaluations. These can assist underwriters in preventing fraud, according to Bank procedures. Figure 5 describes selected preapproval evaluations. According to the Bank, additional preapproval measures include analyzing lenders, focusing on sufficiency of due diligence or what appear to be a high level of claims; requiring collateral on most medium-term transactions; not allowing online applications to proceed unless applicants provide required information; and using a two-step approval process, in which both the underwriter and the underwriter’s supervisor must approve certain transactions. Postapproval antifraud efforts: Postapproval monitoring is generally not directed specifically at fraud, but plays a key role in fraud detection. Specifically, Bank managers told us that the Bank typically learns of fraud through the claims process—that is, after transactions are approved. Figure 6 describes postapproval monitoring. Later, third parties, such as the Bank’s OIG, review transactions and operations, the chief risk officer told us. The Bank has developed a policy and expectations for employee conduct in matters of possible fraud, imposing a duty to report any “suspicion” of fraud to OGC or the OIG. In particular, OGC is not selective about what information it passes to OIG, a manager told us—anything about Bank transactions is referred, no matter the strength of the evidence. In our employee survey, some respondents expressed concern that there is reliance on postapproval monitoring, versus greater scrutiny at the time of application. Illustrative Comments from GAO’s Survey of Bank Employees  The current division of responsibilities “is not the most effective way for the Bank to oversee fraud and fraud risk, as responsibility needs to be given to the teams on the front end—such as the individual relationship managers and loan officers—not on the back end.”  The current arrangement “seems to be more of an after-the-fact approach to potentially (if reluctantly) detecting fraud than any proactive encouragement to actively prevent fraud.” Although the Bank has instituted these pre- and postapproval antifraud controls, they may not provide the most effective protection available. According to GAO’s Fraud Risk Framework, the leading practice is for agencies to design and implement antifraud controls based on a strategy determined after performing a fraud risk assessment and creating a fraud risk profile. However, as previously discussed, the Bank has not yet completed such an assessment to determine such a profile. Consequently, the Bank cannot develop an antifraud strategy and associated controls that meet the leading practice until it has completed a fraud risk assessment and documented the results in a fraud risk profile. As noted earlier, Bank managers told us they now recognize the need to conduct assessments and develop a fraud risk profile for the Bank, and that they plan to complete this work by February 2019. They further told us that, after conducting a risk assessment and developing a fraud risk profile, they plan to design and implement antifraud controls as may be indicated by the assessment, in keeping with the framework’s third component. Until the Bank creates an antifraud strategy based explicitly on a fraud risk assessment and corresponding fraud risk profile, and has designed and implemented specific control activities to prevent and detect fraud, it is at risk of failing to address fraud vulnerabilities that could hurt its performance, undermine its reputation, or impair its ability to fulfill its mission. As provided in GAO’s Fraud Risk Framework, increasing awareness of potential fraud schemes can serve a preventive purpose, by helping to create a culture of integrity and compliance, as well as to enable staff to better detect potential fraud. The Bank currently takes some steps to share information on fraud risks across the institution, through a variety of mechanisms, but it has opportunities to further improve information sharing to build fraud awareness. Training, cited earlier, is a leading practice of the Fraud Risk Framework, by which an agency can build fraud awareness. In particular, the framework cites requiring that all employees, including managers, attend training when hired and then on an ongoing basis thereafter. As discussed earlier, the Bank now conducts some training, and Bank managers told us they see our survey results as an opportunity to provide additional training. By extending training requirements to all employees, the Bank can seek to build awareness as broadly as possible, and with that, further reinforce antifraud tone and culture. Currently, according to our assessment of information the Bank provided, it does not offer dedicated fraud training across the organization, for all employees and on an ongoing basis. Another way to build fraud awareness is information sharing. For example, a manager in the Bank’s OGC told us he monitors fraud activity and communicates relevant fraud-related information to other units in the Bank, based on considerations such as whether a situation could be repeated in other cases. However, there are limitations in information- sharing. For example, the Bank’s OGC told us it restricts how widely it shares information on parties placed on an internally generated “watch list” of parties that should be scrutinized. The Bank also cannot share information provided by OIG on parties in a confidential law enforcement database as being under investigation, managers said, because those parties may not know they are under investigation. The reasons for such caution, according to managers, include the Privacy Act of 1974 and fear of creating a “de facto debarment list” absent any formal findings of fraud. In addition, CRC division managers told us that when the division discovers fraud-related information, it communicates such information to appropriate Bank staff. Despite concerns, we found there are opportunities for greater compilation and sharing of information, and employees said in our survey that they believe wider sharing of fraud-related information would be beneficial to building fraud awareness and performing their duties. For example, one way of boosting fraud awareness would be if Bank managers comprehensively tracked referrals of suspected fraud matters to the OIG and shared case outcomes with Bank staff, Bank managers told us. However, Bank managers told us they do not currently maintain and share such information on cases of suspected fraud referred to the OIG. Relatedly, GAO’s Fraud Risk Framework notes the opportunity for an agency to collaborate with its OIG when planning or conducting training, and promoting the results of successful OIG investigations internally. Some program managers also told us maintaining a repository of known fraud cases could aid in compliance and transaction approvals, but the Bank does not maintain and share this information with staff. In addition, as Bank managers acknowledge, compiling and maintaining information collected through the Bank’s database checks on transaction participants could serve as a library of useful information. However, Bank managers told us they do not currently maintain and share such information. In our survey, we asked employees whether Bank management provides any information on outcomes of fraud cases involving the Bank or Bank staff. Nearly half of respondents (49 percent) said no. About a third (35 percent) said yes. Among a subset of employees who reported that their job duties include direct responsibility for fraud matters, the “Yes” figure was higher but still less than a majority (41 percent). Some survey respondents noted lack of information-sharing about fraud practices and case outcomes, including that staff processing transactions must rely on personal memory for fraud issues that arose in previous transactions. Illustrative Comments from GAO’s Survey of Bank Employees “In some cases, there is no way to track bad actors or suspected fraudsters unless someone working the new transaction remembers that there was an issue with the actor in a previous transaction.” “Management seems to not want to discuss any fraud with staff. Instead, they should use the opportunity to educate staff about fraud that occurs and show the consequences that result. They need to be more open.” “While the Bank has put a lot of best practices in place, more could be done to more regularly communicate to staff about changing practices in committing and detecting fraud.” “Outcomes are rarely relayed to staff.” Underscoring the value of sharing information, our survey also found that when Bank management does share fraud-related information, Bank staff tend to find it useful in carrying out their duties. For those reporting that management does share fraud information, more than half of respondents (54 percent) said they found such information was “extremely” or “very” helpful in their job duties. Similarly, for those who reported they can readily access fraud-related information on their own from internal Bank resources, nearly two-thirds (63 percent) said the information was “extremely” or “very” helpful. In response to our inquiries, Bank managers said they plan to evaluate the feasibility of maintaining and sharing case outcome and database query information. In addition, they said OGC is exploring how it might share more fraud-related information, but in a protected way. In particular, the Bank wants to be able to share information on “integrity factors,” especially at the underwriting level. One way to do this might be distribution of fraud case studies as a refresher for staff, they said. Until the Bank makes greater efforts to share information on known fraud schemes or bad actors, the Bank forgoes the opportunity, as described in the Fraud Risk Framework, to build staff awareness that could enhance antifraud efforts in these ways. For example, by not sharing the outcomes of suspected fraud matters referred to the OIG, the Bank forgoes the opportunity to build awareness through lessons learned from actual cases, which could give staff especially relevant insight into future attempts at fraud. GAO’s Fraud Risk Framework cites data analytics as a leading practice for preventing and detecting fraud; in particular, to mitigate the likelihood and impact of fraud. We found the Bank makes limited use of data analytics for antifraud purposes. For example, it conducts analyses of claims cases, according to Bank managers, and, as noted earlier, considers fraud to be a subset of transactions that result in claims. Documentation of such activity provided to us by the Bank includes analyses and statistical summaries, such as number and types of claims filed, and tallies of claim decisions (for example, approved, denied). However, the Bank does not perform data analytics, which are additional leading practices described in the Fraud Risk Framework. According to one manager, the Bank does not perform data analytics on its transaction-related data because the Bank OIG does not provide a specific transaction number (or “deal number”) necessary to link fraud cases it successfully pursues to the specific transactions from which the OIG action arises. Without that link, the Bank cannot distinguish transactions proven to be fraudulent from other, nonfraudulent transactions in its data, the Bank manager said. The link would be necessary for data-analytics purposes, the manager said. This inability to tie proven fraud cases to individual transactions, based on inability to obtain the key identifying information from the OIG, is a significant weakness in the Bank’s postapproval transaction monitoring, the manager further said. The Bank and its OIG take different views on this linking information. The Bank has asked the OIG to provide these specific transaction numbers in an effort to link proven fraud cases to its transaction data, according to one Bank manager. OIG officials, meanwhile, told us they always notify the Bank when a conviction is made, and provide as much information as possible and appropriate under the circumstances, including company name and individual name. OIG officials also noted that, even without the specific transaction number the Bank requests, the Bank should nevertheless be able to use OIG-provided case data to search its own transaction files and successfully locate corresponding transactions. In response to our inquiries, Bank managers said they are now considering a move into data analytics, including predictive analytics, to guard against fraud. However, until the Bank has a feasible and cost- effective means of linking OIG cases to specific transactions, its ability to use data-analytics for antifraud purposes will be limited. Without the ability to make use of data-analytics, the Bank forgoes the opportunity to develop a best-practices antifraud tool that could aid in identifying potential fraud retrospectively, on transactions already approved, or prospectively, in advance of approval. The fourth and final component of GAO’s Fraud Risk Framework calls for ongoing monitoring and periodic evaluations of the effectiveness of antifraud controls. This monitoring and evaluation should be from the specific perspective of antifraud controls established based on a comprehensive fraud risk assessment. Such activities can serve as an early warning system to help identify and resolve issues in fraud risk management—whether they involve current controls or prospective changes. Ongoing monitoring and periodic evaluations provide assurances to managers that they are effectively preventing, detecting, and responding to potential fraud. Further, according to the framework, effective monitoring and evaluation focuses on measuring outcomes and progress toward achieving objectives. Because the Bank has not completed a comprehensive fraud risk assessment, or designed antifraud controls based on such an assessment, it is not in a position to fulfill this final component. Even at that, however, we found the Bank does not generally evaluate the effectiveness or efficiency of its current fraud risk management practices. For example, OGC and CRC managers—who form the dedicated entity for managing fraud risks (as described earlier in component one)—both told us they are unaware of any procedure to periodically assess the effectiveness of the Bank’s fraud risk management policies. In addition, the Bank currently has no formal method for tracking fraud activity, according to a Bank manager. Thus, the Bank is not in a position to explicitly judge the effectiveness of antifraud controls. Further, as described earlier, Bank managers told us the fraud indicators they do track are not precise or numerical measures and that, instead, OGC is aware of fraud activity through a general sense of daily business. Following our inquiries, Bank managers told us they plan to revise their approach to monitoring, evaluating, and adapting their fraud risk management practices. They said they now plan to evaluate the effectiveness of those practices, following adoption of the second and third components of GAO’s Fraud Risk Framework, and with the intent to adapt controls as indicated necessary, in accordance with the framework’s fourth component. Timing will depend on implementation of the underlying fraud risk assessment, Bank managers told us. The Bank cannot be assured that its antifraud controls are optimal until it has fulfilled component four of GAO’s Fraud Risk Framework in the comprehensive fashion envisioned, following previous full implementation of components two and three. In particular, it cannot be assured that current practices are adequate, based on inherent program risks. Proactively and strategically managing fraud risks can aid the Bank’s mission of supporting American jobs by facilitating U.S. exports, by reducing not only the risk of financial loss to the government, but also the risk of serious reputational harm to the Bank. The Bank has taken some steps to address fraud that are among leading practices identified in GAO’s Fraud Risk Framework. But overall, the Bank has approached fraud risk management on a fragmented, reactive basis, and its antifraud activities have not been marshalled into the kind of comprehensive, strategic fraud risk management regime envisioned by GAO’s Fraud Risk Framework and its leading practices. Chiefly, this is because the Bank has not anchored its fraud risk management policies in a comprehensive fraud risk assessment and corresponding risk profile, tailored to its operations, and then implemented controls designed to address the specific fraud risks identified in the assessment. Some fraud risk facing the Bank is already known, such as fabricated documentation. But as the Bank acknowledges, in addition to fraud risk inherent in its complex lines of business, it also faces significant risk from new or unfamiliar deal structures it may employ, and in new and unfamiliar technologies and industries it may service, where it has limited experience. Regular, comprehensive fraud risk assessments will address not only known types of fraud, but also seek to identify where fraud can occur and the types of fraud the program faces, including likelihood and impact. Accordingly, until the Bank begins conducting thorough, systematic assessments of its fraud risks, and compiles a risk profile prioritizing such risks, it cannot be assured that it satisfactorily understands its vulnerabilities to fraud and any gaps in its capabilities for addressing them. Following on from that, without developing and implementing an antifraud strategy that builds on the findings of the comprehensive risk assessments and risk profile, the Bank cannot be assured that its antifraud control activities are optimally designed for, and targeted to, the actual fraud risks its faces—meaning that it could be failing to address significant risks or targeting the wrong ones. Finally, without establishing outcome-oriented metrics and then regularly reviewing progress toward meeting these goals, the Bank cannot be assured that its antifraud control activities are working as intended. As we concluded our review, the Bank, encouragingly, said it would adopt the more proactive approach described by GAO’s Fraud Risk Framework. Thus, the Bank now needs to follow through on its stated intent to change its practices, and accomplish the tasks, described to us by Bank managers, as intended and in a timely fashion. This is true not only for current operations, but also prospectively, for the large transaction backlog the Bank faces, which Bank managers will process if or when the Bank’s quorum issue is resolved, and which could stress Bank fraud controls. The Bank’s identification of a dedicated entity to lead fraud risk management activities can be an important step in the right direction if that move now becomes the start of a sustained commitment. By fully adopting the elements of the framework, the Bank can strengthen its antifraud culture, better understand fraud risks facing its products and programs, and reshape how it monitors and evaluates the outcomes of its fraud risk management activities. In doing so, it will be better positioned to protect taxpayers and its multi-billion-dollar portfolio, while still meeting its mission to support American jobs and exports. Even though Bank managers have already told us they plan to implement the framework, they did not provide us documentation describing in detail how they will ensure their fraud risk assessment and fraud risk profile are consistent with leading practices of the framework—such as by ensuring the risk assessment considers all inherent fraud risks and the risk profile reflects risk tolerances that are specific and measurable. Thus, we include the following framework-specific recommendations in order to comprehensively enumerate relevant issues we identified, as well as to present clear benchmarks of accountability for assessing Bank progress. This complete listing is important in light of the Bank’s recent embrace of the framework; changes in the Bank’s executive leadership and vacancies on the Bank Board; and expected congressional consideration of the Bank’s reauthorization in 2019. We are making the following seven recommendations to the Bank: The acting Bank president and Board chairman should ensure that the Bank evaluates and implements methods to further promote and sustain an antifraud tone that permeates the Bank’s organizational culture, as described in GAO’s Fraud Risk Framework. This should include consideration of requiring training on fraud risks relevant to Bank programs, for new employees and all employees on an ongoing basis, with the training to include identifying roles and responsibilities in fraud risk management activities across the Bank. (Recommendation 1) As the agency begins efforts to plan and conduct regular fraud risk assessments and to determine a fraud risk profile, the acting Bank president and Board chairman should ensure that the Bank’s risk assessments and profile address not only known methods of fraud, including those that are absent from its current risk register, but other inherent fraud risks as well. (Recommendation 2) As the agency begins efforts to plan and conduct regular fraud risk assessments and to determine a fraud risk profile, the acting Bank president and Board chairman should ensure that the risk profile includes risk tolerances that are specific and measurable. (Recommendation 3) The acting Bank president and Board chairman should ensure that the Bank develops and implements an antifraud strategy with specific control activities, based upon the results of fraud risk assessments and a corresponding fraud risk profile, as provided in GAO’s Fraud Risk Framework. (Recommendation 4) The acting Bank president and Board chairman should ensure that the Bank identifies, and then implements, the best options for sharing more fraud-related information—including details of fraud case referrals and outcomes—among Bank staff, to help build fraud awareness, as described in GAO’s Fraud Risk Framework. (Recommendation 5) The acting Bank president and Board chairman should lead efforts to collaborate with the Bank’s OIG to identify a feasible, cost-effective means to systematically track outcomes of fraud referrals from the Bank to the OIG, including creating a means to link the OIG’s proven cases of fraud to the specific Bank transactions from which the OIG actions arose. If any such means are found to be feasible and cost-effective, the acting Bank president and Board chairman should direct appropriate staff to implement them, with such information to be used for purposes consistent with GAO’s Fraud Risk Framework, such as data analytics. (Recommendation 6) The acting Bank president and Board chairman should ensure that the Bank monitors and evaluates outcomes of fraud risk management activities, using a risk-based approach and outcome-oriented metrics, and that it subsequently adapts antifraud activities or implements new ones, as determined to be appropriate and consistent with GAO’s Fraud Risk Framework. (Recommendation 7) We provided a draft of this report to the Bank for review and comment. In written comments, summarized below and reproduced in appendix III, the Bank agreed with our recommendations. The bank also provided technical comments, which we incorporated as appropriate. In its written comments, the Bank said it will take several steps to implement our recommendations to improve its fraud risk management activities. For example, the Bank stated it would continue to evaluate and implement methods to promote and sustain an antifraud tone that permeates the Bank’s organizational culture. In assessing fraud risks, the Bank stated it will include not only known risks, but also other inherent risks not yet known to have led to fraud. Following a fraud risk assessment as provided in GAO’s Fraud Risk Framework, the Bank stated that it will develop antifraud controls based on that assessment, subject to cost-benefit analysis. The Bank also stated that it will monitor and evaluate outcomes of its fraud risk management activities, and adapt existing controls or implement new controls as indicated, subject to cost- benefit analysis. The Bank further stated it will identify and implement ways to share more fraud-related information. In its written comments, the Bank also raised four concerns about our work. First, the Bank stated that it keeps substantial reserves for losses, which protect against taxpayer costs. We clarified our report to indicate that Bank officials told us they maintain reserves to protect against taxpayer costs. We did not evaluate the extent to which these reserves protect against taxpayer costs because doing so was outside the scope of our review. Second, the Bank stated our employee survey does not directly support some of the conclusions that we draw from responses received, and that only 24 percent of respondents were in the Export Finance area, which handles underwriting of Bank transactions. We note that the leading practices of the Fraud Risk Framework call for involving all levels of the agency in setting an antifraud tone that permeates the organizational culture. We also note that the Office of the Export Finance is not the only division involved in fraud control activities. For example, during our review, Bank managers told us that employees in the Credit Review and Compliance division, the Office of the General Counsel, and the Office of the Chief Financial Officer, among other offices, are also involved in fraud control activities. Thus, we believe it is appropriate that survey responses from those who work in these and other offices are included in our survey results. As noted in our report, Bank managers, in interviews, and staff, in our employee survey, generally expressed positive views of the Bank’s antifraud culture, but they hold different views on key aspects of that culture. We believe that our survey results support these findings, as well as related conclusions and recommendation (Recommendation 1), with which the Bank agreed. Third, the Bank stated that it has been very effective in preventing, detecting, and prosecuting fraud in Bank transactions. Our review evaluated the extent to which the Bank has adopted leading practices for managing fraud risks, as described in the Fraud Risk Framework. We did not evaluate the operational effectiveness of specific Bank control activities for preventing, detecting, and prosecuting fraud because doing so was beyond the scope of our review. Fourth, the Bank stated that our report and the employee survey did not clearly and consistently distinguish between fraud and fraud risk, which may lead to confusion in both the survey responses and the analysis in the report. However, we define the terms “actual fraud” and “fraud risk” in our employee survey, which appears in appendix II. Further, as described in greater detail in appendix I, we pretested and modified the survey to ensure questions were understood by respondents and that we used correct terminology. This process allowed us to determine whether survey questions and answer choices were clear and appropriate. Thus, we believe the survey results support our findings. Overall, as noted, these findings include positive views of the Bank’s antifraud culture as well as differing views on some aspects of that culture. We are sending copies of this report to the appropriate congressional committees, the acting president and Board chairman of the Bank, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staffs have any questions about this report, please contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. This report examines management by the Export-Import Bank of the United States (the Bank) of fraud risks in its export credit activities, by evaluating the extent to which the Bank has adopted the four components described in GAO’s A Framework for Managing Fraud Risks in Federal Programs (Fraud Risk Framework). Specifically, we evaluate the extent to which the Bank has established an organizational culture and structure conducive to planned regular fraud risk assessments and assessed risks to determine a fraud risk profile; designed and implemented a strategy with specific control activities to mitigate assessed fraud risks; and evaluated outcomes using a risk-based approach and adapted activities to improve fraud risk management. To examine the extent to which the Bank has adopted the components of GAO’s Fraud Risk Framework, we reviewed Bank policy and governance documentation, plus other documentation; reviewed GAO and Bank Office of the Inspector General reports on fraud and fraud risk management topics; reviewed relevant reports of the Congressional Research Service and the Congressional Budget Office; and reviewed other reports and background information. Documentation we reviewed included Bank operating procedures, details of database search procedures, Bank annual reports, reports to Congress, the Bank’s strategic plan, risk assessments, and other materials. We also interviewed a range of Bank managers, at both the senior- management level and those overseeing relevant Bank operating units. These included the Bank’s chief financial officer, its chief risk officer, its acting chief operating officer, those with specific antifraud responsibilities, and others responsible for individual business units. These individual business units included those with responsibilities for monitoring transactions following approval. We then assessed our findings on the Bank’s fraud risk management practices and its antifraud controls against provisions of the Fraud Risk Framework, which also incorporates concepts from GAO’s Standards for Internal Control in the Federal Government. To examine the extent to which the Bank has established an organizational culture and structure conducive to fraud risk management, we conducted a web-based survey of Bank employees. In our survey, we assessed, among other things, perceptions of the Bank’s organizational culture and attitudes toward fraud and fraud risk management, and whether employees viewed senior Bank management as committed to establishing and maintaining an antifraud culture. We surveyed all non- senior-management Bank employees, regardless of their position or length of employment, who are responsible for implementing, but not determining, Bank policy (that is, those below the level of senior vice president). There were 403 employees in our survey population, and we received 296 responses, thus producing a response rate of 73.5 percent. We received sufficient representation across Bank offices and divisions, and, overall, obtained a range of employee views. To develop our survey instrument, we utilized background research, leading practices as identified in GAO’s Fraud Risk Framework, interviews with Bank senior managers, and other sources. We conducted in-person pretests of survey questions with five Bank employees, varying in position, Bank office or division, and seniority, at Bank headquarters in Washington, D.C. We pretested the survey instrument to ensure the questions were understood by respondents, that we used correct terminology, and that the survey was not burdensome to complete. This process allowed us to determine whether the survey question and answer choices were clear and appropriate. We modified our survey instrument as appropriate based on pretest results and suggestions made by an independent survey specialist. The final survey instrument included closed- and open-ended questions on Bank management and tone-at- the-top; fraud-related training and information; antifraud environment; and personal experiences with fraud at the Bank. Throughout the survey instrument, we defined important terms, such as “senior management,” so respondents could interpret key concepts consistently through the survey. We administered the survey, via the World Wide Web, from July 31, 2017, through September 22, 2017. To do so, we obtained from Bank management a file of Bank employees with relevant identifying information. Before we opened the survey, the Bank president, at our suggestion, sent an email to employees notifying them of the forthcoming survey and encouraging them to respond. We also sent Bank employees a notification email describing the forthcoming survey, in advance of sending employees another email providing a unique username and password to access the web-based survey. To improve the response rate, we contacted Bank employees by phone who had not yet completed the survey (nonrespondents), to determine their eligibility, update their contact information, answer any questions or concerns about the survey, and seek their commitment to participate. We also sent multiple follow-up emails to nonrespondents encouraging them to respond, and provided instructions for taking the survey. These follow-up contacts reduced the possibility of nonresponse error. We sent our follow-up reminder emails to the survey population on August 10, 17, and 29, 2017, and September 1 and 14, 2017. Because we surveyed all non-senior-management employees, the survey did not involve sampling error. To minimize nonsampling errors, and to enhance data quality, we employed recognized survey design practices in the development of the survey instrument and in the collection, processing, and analysis of the survey data. We calculated frequencies for closed-ended responses and reviewed open-ended response for themes and illustrative examples. When we analyzed the survey data, an independent analyst checked statistical programs used to collect and process responses. We selected survey excerpts—tallies of answers to selected questions, plus individual comments received from respondents—presented in the main text of this report based on relevance to the respective subject matter. We conducted our performance audit from October 2016 to July 2018, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: Results of GAO Survey of Bank Employees: “Anti-Fraud Controls at the Export-Import Bank of the United States” As described in appendix I, GAO conducted a survey of employees of the Export-Import Bank of the United States (the Bank), to obtain their views on the Bank’s organizational culture and attitudes toward fraud and fraud risk management. We surveyed 403 employees and obtained 296 responses, for a response rate of 73.5 percent. Our survey did not rely on a sample, as we distributed it to the entire employee population identified. Although originally presented through the World Wide Web, the questions and answer choices that follow are the same wording as shown to Bank employees. Results are tallied for each question. We omit, however, all individual responses to open-ended questions, in order to protect respondent anonymity. Underlined items indicate terms for which hyperlinked definitions were available in the original survey form. “Fraud” generally means obtaining something of value through willful misrepresentation; and in particular, misconduct involving Bank transactions. We mean it to include actual fraud, as found through the judicial system or an administrative process; as well as “fraud risk” – an opportunity, situation, or vulnerability that could allow for someone to engage in fraudulent activity. For this section and elsewhere, two additional definitions— “Senior management” refers to Bank managers at the senior vice president level and above. “Management in general” refers to a broader management group – first-level supervisors and above. 4. In your view, to what extent has Bank management in general established a clear anti-fraud tone for the Bank? A great deal A lot Some A little Not at all Unsure/don’t know Valid responses: 296 50.3% 29.4% 10.8% 2.7% 1.4% 5.4% 5. Based on the actions of Bank senior management in particular, how important do you think preventing, detecting, and otherwise addressing fraud is to the Bank? Extremely important Very important Not at all important Unsure/don’t know 61.5% 25.0% 7.1% 1.7% 1.0% 3.7% 6. Based on the actions of the managers of your division in particular, how important do you think preventing, detecting, and otherwise addressing fraud is to the Bank? Extremely important Very important Not at all important Unsure/don’t know 60.5% 27.9% 5.1% 1.7% 1.4% 3.4% 7. How clearly has Bank management in general communicated a standard of conduct that applies to all employees, and which includes the Bank’s expectations of behavior concerning fraud? Extremely clearly Very clearly Somewhat clearly Slightly clearly Not at all clear Unsure/don’t know Valid responses: 294 44.6% 33.3% 16.0% 1.7% 1.7% 2.7% 8. Based on your experience, for each entity below, which category best describes the level of responsibility the entity has for overseeing fraud risk management activities at the Bank? for the Bank to oversee fraud and fraud risk? Yes No Unsure/don’t know Valid responses: 295 62.4% 7.1% 30.5% 9(a). Why, or why not, is this the most effective way for the Bank to oversee fraud and fraud risk? 23. In your view, should the Bank be more, or less, active in preventing, detecting, and otherwise addressing fraud or fraud risk? Much more active Somewhat more active Remain the same Much less active Unsure/don’t know 9.8% 25.7% 43.6% 1.7% – 19.3% 23(a). Why do you feel this is the appropriate level of activity for addressing fraud or fraud risk? Excluding “Not applicable to my job or experience”— Always enough time Usually enough time Sometimes enough time Seldom enough time Never enough time Unsure/don’t know 14.9% 32.2% 14.4% 4.6% 1.1% 32.8% 31. If you have additional comments on any of the items above, or on fraud- or fraud risk-related issues at the Bank generally, please feel free to provide them below. 32. Would you be willing to speak with GAO regarding your answers to the survey, the topics raised above, or other fraud-related matters? 32(a). Please provide your name and contact information. In addition to the contact named above, Jonathon Oldmixon (Assistant Director), Marcus Corbin, Carrie Davidson, David Dornisch, Paulissa Earl, Colin Fallon, Dennis Fauber, Kimberly Gianopoulos, Gina Hoover, Farahnaaz Khakoo-Mausel, Heather Latta, Flavio Martinez, Maria McMullen, Carl Ramirez, Christopher H. Schmitt, Sabrina Streagle, and Celia Thomas made key contributions to this report.

Summary: According to the Bank, it serves as a financier of last resort for U.S. firms seeking to sell to foreign buyers but that cannot obtain private financing for their deals. Its programs support tens of thousands of American jobs and enable billions of dollars in U.S. export sales annually, the Bank says. The Bank is also backed by the full faith and credit of the United States government, meaning that taxpayers could be responsible for Bank losses. The Export-Import Bank Reform Reauthorization Act of 2015 included a provision for GAO to review the Bank's antifraud controls within 4 years, and every 4 years thereafter. This report examines the extent to which the Bank has adopted the four components of GAO's Fraud Risk Framework—commit to combating fraud; regularly assess fraud risks; design a corresponding antifraud strategy with relevant controls; and evaluate outcomes and adapt. GAO reviewed Bank documentation; interviewed a range of Bank managers; and surveyed Bank employees about the extent to which the Bank has established an organizational culture and structure conducive to fraud risk management. In managing its vulnerability to fraud, the Export-Import Bank of the United States (the Bank) has adopted some aspects of GAO's A Framework for Managing Fraud Risks in Federal Programs (Fraud Risk Framework). This framework describes leading practices in four components: organizational culture, assessment of inherent program risks, design of tailored antifraud controls, and evaluation of outcomes. As provided in the framework, for example, the Bank has identified a dedicated entity within the Bank to lead fraud risk management. GAO also found that Bank managers and staff generally hold positive views of the Bank's antifraud culture. However, GAO also found that management and staff hold differing views on key aspects of that culture. These differing views include how active the Bank should be in addressing fraud. For example, Bank managers told GAO the Bank's current approach has been appropriate for dealing with fraud. However, about one-third of Bank staff responding to a GAO employee survey said the Bank should be “much more active” or “somewhat more active” in preventing, detecting, and addressing fraud. These and other divergent views indicate an opportunity to better ensure the Bank sets an antifraud tone that permeates the organizational culture, as provided in the Fraud Risk Framework. GAO found the Bank has taken some steps to assess fraud risk. For example, the Bank's practice has generally been to assess particular fraud risks and lessons learned following specific instances of fraud encountered, according to Bank managers. However, the Bank has not conducted a comprehensive fraud risk assessment, as provided in the framework. The Bank has also been compiling a “register” of risks identified across the organization, including fraud. This register, however, does not include some known methods of fraud, such as submission of fraudulent documentation, thus indicating it is incomplete. Without planning and conducting regular fraud risk assessments as called for in the framework, the Bank is vulnerable to failing to identify fraud risks that can damage its reputation or harm its ability to support U.S. jobs through greater exports. As provided in the framework, managers should determine where fraud can occur and the types of internal and external fraud the program faces, including an assessment of the likelihood and impact of fraud risks inherent to the program. At the conclusion of GAO's review, Bank managers said they will fully adopt the GAO framework. They said they plan to complete a fraud risk assessment by December 2018, and to determine the Bank's fraud risk profile—that is, document key findings and conclusions from the assessment—by February 2019. Work to adopt other framework components will begin afterward, the managers said. However, they did not provide details of how their efforts will be in accord with leading practices of the framework. As a result, GAO makes framework-specific recommendations in order to enumerate relevant issues and to present clear benchmarks for assessing Bank progress. This complete listing of recommendations is important in light of the Bank's recent embrace of the framework; recent changes in Bank leadership; and expected congressional consideration of the Bank's reauthorization in 2019. GAO makes seven recommendations, centering on conducting a fraud risk assessment, tailored to the Bank's operations, to serve as the basis for the design and evaluation of appropriate antifraud controls. The Bank agreed with GAO's recommendations, saying it will take steps to improve its fraud risk management activities.