In July 2017, we found that State and UNHCR have worked together on several measures designed to ensure integrity in the process through which UNHCR refers refugees to USRAP for potential resettlement in the United States (or, the resettlement referral process). Since 2000, State and UNHCR have outlined their formal partnership using a Framework for Cooperation. State and UNHCR signed the most recent framework document in 2016, covering the period of March 14, 2016 to December 31, 2017. The organizations developed the framework to guide their partnership, emphasizing measures such as oversight activities and risk management. Among other things, the framework emphasizes improved accountability at UNHCR through effective oversight measures, close cooperation with State, and organization-wide risk management. In addition, the framework notes that State will work to ensure that UNHCR allocates sufficient resources to fully implement measures to provide oversight and accountability. For instance, UNHCR has several offices that are responsible for overseeing antifraud activities, in addition to providing audit services, investigating instances of fraud, and conducting broad reviews of country-level operations such as the United Nations Office of Internal Oversight Services and the Board of Auditors. The framework also describes regular coordination and communication between State and UNHCR as an important principle in the relationship between the two organizations. Specifically, at the headquarters level, the U.S. Mission in Geneva, Switzerland, has a humanitarian affairs office that, according to State officials, coordinates with UNHCR on a regular basis. Additionally, UNHCR has developed standard operating procedures (SOPs) and identity management systems to combat the risk of fraud and worked with State to implement these activities in the resettlement process. Despite the complexity and regional variations in its refugee registration, refugee status determination, and resettlement referral processes, UNHCR officials said that standardizing procedures ensures that the organization has established basic antifraud practices worldwide. These officials added that they believe that the SOPs are among the most important tools with which they ensure the integrity of the resettlement referral process. UNHCR officials also collect biometric information on refugees, such as iris scans and fingerprints. State and UNHCR developed a Memorandum of Understanding (MOU) regarding the sharing of some biometric information. According to a Letter of Understanding that accompanies the MOU, it provides a framework whereby data from UNHCR is shared with State, which allows for increased efficiency and accuracy in processing resettlement referrals to the United States. See figure 2 for photographs of technology that UNHCR uses to register and verify refugee identities. State and RSCs have policies and procedures for processing refugee applications, but, as we found in July 2017, State has not established outcome-based performance measures to assess whether RSCs are meeting their objectives under USRAP. State’s USRAP Overseas Processing Manual includes requirements for information RSCs should collect when prescreening applicants and initiating national security checks, among other things. RSCs communicate directly with USRAP applicants and prepare their case files. For example, RSCs are to conduct prescreening interviews to record key information, such as applicants’ persecution stories and information about their extended family, and submit certain security checks based on the information collected during the interview to U.S. agencies. In addition, State developed SOPs for processing and prescreening refugee applications at RSCs, which State officials indicated provide baseline standards for RSC operations. Further, all four of the RSCs we visited provided us with their own local SOPs that incorporated the topics covered in State’s SOPs. Directors at the remaining five RSCs also told us that they had developed local SOPs that covered the overarching USRAP requirements. We observed how RSC staff implemented State’s case processing and prescreening policies and procedures during our site visits to four RSCs from June 2016 to September 2016. Specifically, we observed 27 prescreening interviews conducted by RSC caseworkers at the four RSCs we visited and found that these caseworkers generally adhered to State requirements during these interviews. In addition, we observed how RSC staff in all four locations implemented additional required procedures during our site visits, such as initiating required security checks and compiling case file information for USCIS interviewing officers, and found that these RSC staff were generally complying with SOPs. State has control activities in place to monitor how RSCs implement policies and procedures for USRAP, but it does not have outcome-based performance indicators to assess whether RSCs are meeting their objectives under USRAP. Consistent with State’s January 2016 Federal Assistance Policy Directive, and according to State officials, State is required to monitor the RSCs it funds, whether through cooperative agreements or voluntary contributions. On the basis of our interviews with State officials and as reflected in documentation from all nine RSCs, including quarterly reports to State, all RSCs have generally undergone the same monitoring regime regardless of funding mechanism. Further, according to State officials, the department has dedicated Program Officers located in Washington, D.C., and Refugee Coordinators based in U.S. embassies worldwide, who are responsible for providing support to RSCs and monitoring their activities—including conducting annual monitoring visits. Further, State has established objectives for RSCs, which include interviewing applicants to obtain relevant information for the adjudication and ensuring the accuracy of information in State’s database and the case files. State also establishes annual targets for the number of refugees who depart for the United States from each RSC. Although State has established objectives and monitors several quantitative goals for RSCs, it has not established outcome-based performance indicators for key RSC activities such as prescreening applicants or accurate case file preparation, or monitored RSC performance consistently across such indicators. Specifically, neither the quarterly reports nor other monitoring reports we examined have or use consistent outcome-based performance indicators from which State could evaluate whether RSCs were consistently and effectively prescreening applicants and preparing case files—key RSC activities that have important implications for timely and effective USCIS interviews and security checks. Developing outcome-based performance indicators, as required by State policy and performance management guidance, and monitoring RSC performance against such indicators on a regular basis, would better position State to determine whether all RSCs are processing refugee applications in accordance with their responsibilities under USRAP. USCIS has developed policies and procedures for adjudicating refugee applications. In July 2017, we found that these policies and procedures apply to all USCIS officers who adjudicate refugee applications—those from USCIS’s Refugee Affairs Division (RAD), International Operations Division (IO), and temporary officers from offices throughout USCIS—and include those for how officers are to review the case file before the interview and conduct the interview, as well as how supervisors are to review applications to ensure they are legally sufficient. We observed 29 USCIS refugee interviews at the four RSCs that we visited from June 2016 to September 2016 and found that the interviewing officers completed all parts of the assessment tool and followed other required policies. We also observed that the USCIS officers documented the questions they asked and the answers the applicants provided. We also observed USCIS supervisors while they reviewed officers’ initial decisions, interview transcripts, and case file documentation, consistent with USCIS policy, at two of the sites we visited. Further, all six of the officers that we met with stated that supervisors conducted the required supervisory case file review during their circuit rides and the four supervisory officers we met with were aware of the requirements and stated that they conducted the supervisory reviews. USCIS also provides specialized training to all officers who adjudicate applications abroad, but we found that USCIS could provide additional training for officers who work on a temporary basis. According to USCIS policy, all USCIS officers who adjudicate refugee applications must complete specialized training, and the training varies based on the USCIS division of the officer. However, temporary officers receive a condensed (or shortened) version of the trainings received by full time refugee officers and do not receive infield training. Although temporary officers receive training prior to conducting in-person interviews with refugee applicants, we found that they sometimes face challenges adjudicating refugee applications. Specifically, we reviewed 44 summary trip reports USCIS supervisors completed following officers’ trips overseas to interview USRAP applicants from the fourth quarter of 2014 through the third quarter of 2016 that included adjudications by temporary officers. In 15 of the 44 reports, the supervisors noted that temporary officers faced challenges adjudicating refugee applications. Standards for Internal Control in the Federal Government state that management should demonstrate a commitment to recruit, develop, and retain competent individuals. The standards also note that competence is the qualification to carry out assigned responsibilities, and requires relevant knowledge, skills, and abilities, which are gained largely from professional experience, training, and certifications. To the extent that USCIS uses temporary officers on future circuit rides, providing them with additional training, such as in-field training, would help better prepare them to interview refugees and adjudicate their applications, increase the quality and efficiency of their work, and potentially reduce the supervisory burden on those who oversee temporary officers. In addition to training, USCIS has developed guidance documents and tools to help officers identify USRAP applicants with potential national security concerns. However, we found that USCIS could strengthen its efforts by developing and implementing a plan for deploying officers with national security expertise on selected circuit rides. USCIS provides a number of resources to officers to help them identify and address potential national security-related concerns in USRAP applications. In addition, USCIS’s national security policies and operating procedures require that cases with national security concerns be placed on hold by interviewing officers. These cases are then reviewed by USCIS headquarters staff who have additional specialized training and expertise in vetting national security issues. While USCIS has training and guidance to adjudicate cases with national security-related concerns, USCIS trip reports we analyzed and officers we interviewed indicated that it can be challenging to adjudicate such applications. USCIS officials identified several reasons why it is challenging to provide training and guidance on how to adjudicate cases with potential national security concerns. For example, according to RAD and IO headquarters officials, indicators of national security concerns and the country conditions that give rise to them evolve and change; as a result, USCIS guidance on how to address those concerns also changes over time. To further help interviewing officers adjudicate cases with national security concerns, in 2016, USCIS completed a pilot program that included sending officers with national security expertise overseas to support interviewing officers in some locations. USCIS determined the pilot was successful and has taken steps to formalize it; however, USCIS has not developed and implemented a plan for deploying these additional officers, whose expertise could help improve the efficiency and effectiveness of the adjudication process. In light of the evolving and significant nature of national security concerns, developing and implementing a plan to deploy additional USCIS officers with national security expertise on circuit rides—including timeframes for deployment and how USCIS will select circuit rides for deployment—would better ensure that USCIS provides interviewing officers with the resources needed to efficiently and effectively adjudicate cases with national security concerns. We also found that USCIS has not regularly assessed the quality of refugee adjudications, which help ensure that case files are completed accurately and that decisions by USCIS officers are well-documented and legally sufficient. USCIS conducted a quality assurance review of refugee adjudications in fiscal year 2015, which included a sample of applications adjudicated by RAD and IO during one quarter of the fiscal year. The 2015 quality assurance review found that most cases in the sample were legally sufficient. However, the review indicated that there were differences between RAD and IO adjudications. Specifically, the review rated 69 of 80 RAD case files (86 percent) as good or excellent, and rated 36 of 73 IO case files (49 percent) as good or excellent. Two of 80 RAD case files (less than 3 percent) in the review and 17 of 73 IO case files (23 percent) were rated as not legally sufficient. USCIS developed action items to address identified deficiencies and has taken steps to implement them. Among cases rated not legally sufficient, the most common deficiency identified was that interviewing officers did not fully develop the interview record with respect to possible inadmissibilities. Other deficiencies reported included interview records not being fully developed with respect to well-founded fear of persecution, improper documentation and analysis of terrorism-related inadmissibility concerns, incorrect hold determination, and required sections of the assessment leading to the adjudication decision that were incomplete. Although there have been major changes in the refugee caseload in the past 2 years (such as an increase in Syrian refugees), an increased use of temporary staff to conduct refugee adjudications in fiscal year 2016, and the difference in quality between RAD and IO adjudications noted in the 2015 quality assurance review, USCIS did not conduct quality reviews in 2016 and had no plans to conduct them in 2017. Standards for Internal Control in the Federal Government states that management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. In addition, standard practices for program management state that program quality should be monitored on a regular basis to provide confidence that the program will comply with the relevant quality policies and standards. USCIS officials stated that supervisors continue to review each refugee case file for legal sufficiency and completeness at the time of the interview. While supervisory review is an important quality control step, it does not position USCIS to identify systematic quality concerns, such as those identified in the fiscal year 2015 quality assessment results. Conducting such reviews would help ensure that case files are completed accurately and that decisions by USCIS officers are well-documented and legally sufficient. According to State officials we interviewed for our July 2017 report, staff fraud at RSCs occurs infrequently, but instances of staff fraud have taken place in recent years, such as RSC staff soliciting bribes from applicants in exchange for promises of expediting applicants through RSC processing. State and RSCs reported instituting a number of activities to combat the risk of fraud committed by RSC staff. Many of these activities correspond with leading practices identified in GAO’s Fraud Risk Framework which identifies leading antifraud practices to aid program managers in managing fraud risks that affect their program. For instance, State and RSCs reported that they have taken steps to commit to an organizational culture and structure to help manage staff fraud risks and established collaborative relationships with both internal and external partners to share information. Officials from all nine RSCs stated that they assign staff fraud risk management responsibilities to designated individuals. In addition, State and RSCs reported that RSCs have designed control activities to address staff fraud risk. State officials identified two key guidance documents containing control activities: RSC SOPs and the Program Integrity Guidelines. The Program Integrity Guidelines are a list of 87 measures designed to prevent and mitigate staff fraud at RSCs. The measures were developed by State and provided to RSCs in response to a staff fraud incident in 2013 that resulted in the termination of two RSC staff. These measures include control activities addressing issues such as background checks, interpreter assignment, antifraud training, office layout, case file reviews, electronic data management, and reporting and responding to instances of suspected fraud. State required RSCs to comply with the original Program Integrity Guidelines by October 2014; however, our review of RSC documents found that RSCs reported complying with most, but not all, of the required measures applicable to their operations. Reported compliance with required, applicable measures at individual RSCs ranged from 86 percent to 100 percent. For 53 of the 72 measures, compliance was reported by all RSCs for which the measure was applicable. Some RSCs have reported that they face challenges in fully implementing certain controls. State officials told us that they work to ensure that each RSC complies with all required controls in the Program Integrity Guidelines. If an RSC reports that it does not yet fully comply with a measure listed in the Program Integrity Guidelines, State expects the RSC to report its progress toward compliance to State. While this reporting assists State in its implementation efforts, we found that gaps remain. Full compliance with these measures could help RSCs ensure the integrity of their operations and guard against staff fraud. In addition, State has taken some steps to assess the risks posed by staff fraud to RSC operations; however, we found that not all RSCs have conducted staff fraud risk assessments that follow leading practices identified in the Fraud Risk Framework, including (1) conducting assessments at regular intervals or when the program experiences changes, (2) tailoring assessments to the program and its operations, and (3) examining the suitability of existing fraud controls. State officials told us that not all RSCs had conducted staff fraud risk assessments because State’s Program Integrity Guidelines recommend but do not require these assessments. Without State requiring RSCs to conduct regular staff fraud risk assessments tailored to their specific operations, staff fraud risk assessments conducted by individual RSCs have varied. Further, we found that State and most RSCs have not examined the suitability of existing fraud controls. For example, while one RSC has regularly assessed the suitability of its existing staff fraud controls by conducting regular staff fraud risk assessments that examine the likelihood and impact of potential fraudulent activity and related fraud controls, the remaining eight RSCs have not done so. State officials told us that because State does not require RSCs to conduct risk assessments, information needed to assess the suitability of existing controls is not available from all RSCs. As the number of refugees accepted varies each year by RSC, internal control systems may need to be changed to respond to the potential increased fraud risk. Without requiring RSCs to conduct regular staff fraud risk assessments that are tailored to their specific operating environments and reviewing these assessments to examine the suitability of existing fraud controls, State may lack necessary information about staff fraud risks and therefore not have reasonable assurance that existing controls effectively reduce these risks. Information from such risk assessments could help State and RSCs revise existing controls or develop new controls to mitigate the staff fraud risks faced by the program, if necessary. Fraud can occur in the refugee process in a number of ways, and State, RSCs, and USCIS have implemented certain mechanisms to help detect and prevent fraud by USRAP applicants. USCIS officers can encounter indicators of fraud while adjudicating refugee applications, and State has suspended USRAP programs in the past because of fraud. To detect and prevent applicant fraud in USRAP, State, RSCs, and USCIS have put mechanisms in place such as DNA testing for certain applicants; training on applicant fraud trends for USCIS officers; and procedures at RSCs to require, where possible, that different interpreters be involved in different stages of the USRAP application process to decrease the likelihood that applicants collude with interpreters. However, State and USCIS have not jointly assessed applicant fraud risks program-wide. The Fraud Risk Framework calls for program managers to plan and conduct regular fraud risk assessments. In addition, Standards for Internal Control in the Federal Government states that management should consider the potential for fraud when identifying, analyzing, and responding to risks, and analyze and respond to identified fraud risks, through a risk analysis process, so that they are effectively mitigated. Although State and USCIS perform a number of fraud risk management activities and have responded to individual instances of applicant fraud, we found that these efforts do not position the agencies to assess fraud risks program-wide for USRAP or know if their controls are appropriately targeted to the areas of highest risk in the program. State and USCIS officials told us that each agency has discrete areas of responsibility in the refugee admissions process, and each agency’s antifraud activities are largely directed at their portions of the process. Because the management of USRAP involves several agencies, without jointly and regularly assessing applicant fraud risks and determining the fraud risk tolerance of the entirety of USRAP, in accordance with leading practices, State and USCIS do not have comprehensive information on the inherent fraud risks that may affect the integrity of the refugee application process and therefore do not have reasonable assurance that State, USCIS, and other program partners have implemented controls to mitigate those risks. Moreover, regularly assessing applicant fraud risks program-wide could help State and USCIS ensure that fraud prevention and detection efforts across USRAP are targeted to those areas that are of highest risk, in accordance with the program’s fraud risk tolerance. In our July reports, we made several recommendations to State and DHS. Specifically, we recommended that State take the following actions in GAO-17-706: develop outcome-based indicators for RSC, as required by State monitor RSC performance against such indicators on a regular basis; And we recommended that State take the following actions in GAO-17-737: actively pursue efforts to ensure that RSCs comply with required, applicable measures in the Program Integrity Guidelines; update guidance, such as the Program Integrity Guidelines, to require each RSC to conduct regular staff fraud risk assessments that are tailored to each RSC’s specific operations; and regularly review RSC staff fraud risk assessments and use them to examine the suitability of existing staff fraud controls and revise controls as appropriate. We recommended that USCIS take the following actions in GAO-17-706: provide additional training for any temporary officers who adjudicate develop and implement a plan to deploy officers with national security conduct regular quality assurance assessments of refugee application adjudications across RAD and IO. We also recommended that State and USCIS conduct regular joint risk assessments of applicant fraud risk across USRAP. State and USCIS concurred with all of our recommendations and have actions underway to address them. For example, State noted that it has developed new guidance to enhance the monitoring of RSCs, which outlines roles, responsibilities, and tools for program officers and refugee coordinators. In addition, USCIS provided documentation that USCIS officials conducted a quality assurance assessment of refugee adjudications in July 2017. Moreover, in July 2017, USCIS provided documentation indicating that it instituted additional headquarters and overseas training for temporary officers consistent with our recommendation. Therefore, we closed this recommendation as implemented. Chairman Labrador, Ranking Member Lofgren, and Members of the Subcommittee, this completes my prepared statement. I would be pleased to respond to any questions that you may have. For further information regarding this testimony, please contact Rebecca Gambler, Director, Homeland Security and Justice at (202) 512-8777 or gamblerr@gao.gov, or Thomas Melito, Director, International Affairs and Trade at (202) 512-9601 or melitot@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. GAO staff who made key contributions to this testimony are David Alexander, Ashley Alley, Kathryn Bernet, Anthony Costulas, Martin De Alteriis, Brian Hackney, Paul Hobart, Thomas Lombardi, and Elizabeth Repko. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: According to UNHCR, as of June 2017, more than 21 million people were refugees worldwide. State manages the U.S. Refugee Admissions Program (USRAP) and coordinates with UNHCR, which refers the most applicants to USRAP, and USCIS, which adjudicates refugee applications. Deterring and detecting fraud is essential to ensuring the integrity of USRAP and an increase in the number of applicants approved for resettlement in the United States from countries where terrorists operate has raised questions about the adequacy of applicant screening. This statement addresses (1) how State works with UNHCR to ensure program integrity in the UNHCR resettlement referral process; (2) the extent to which State and RSCs have policies and procedures on refugee case processing and State has overseen RSC activities; (3) the extent to which USCIS has policies and procedures for adjudicating refugee applications; and (4) the extent to which State, USCIS, and their partners follow leading practices to reduce the risk of staff and applicant fraud in USRAP. This statement is based on GAO's July 2017 reports regarding USRAP. To conduct that work, GAO analyzed State, USCIS, and UNHCR policies; interviewed relevant officials; conducted fieldwork in 2016 at selected UNHCR offices, as well as at RSCs in Austria, Jordan, Kenya, and El Salvador, where GAO observed a nongeneralizable sample of refugee screening interviews (selected based on application data and other factors). The Department of State (State) and the United Nations High Commissioner for Refugees (UNHCR) have worked together on measures designed to ensure integrity in the refugee resettlement referral process and have established a framework to guide their partnership. Working with State, UNHCR has implemented standard operating procedures and other guidance that, according to UNHCR officials, provides baseline requirements throughout the referral process. UNHCR also uses databases to help verify the identities of, and manage information about, refugees. State and the nine worldwide Resettlement Support Centers (RSC) have policies and procedures for processing refugee applications. Overseen by State, the organizations that operate RSCs hire staff to process and prescreen applicants who have been referred for resettlement consideration. GAO observed 27 prescreening interviews conducted by RSC caseworkers in four countries and found that, for example, RSCs generally recorded key information and submitted any required security checks. However, State has not established outcome-based performance indicators to evaluate whether RSCs were consistently and effectively prescreening applicants and preparing case files—key RSC activities that have important implications for timely and effective adjudication and security checks. Developing outcome-based performance indicators would better position State to determine whether RSCs are meeting their responsibilities. The Department of Homeland Security's U.S. Citizenship and Immigration Services (USCIS) has policies and procedures for adjudicating refugee applications for resettlement in the United States, including how officers are to conduct interviews and adjudicate applications. GAO observed 29 USCIS interviews and found that officers completed all parts of the required assessment. USCIS also provides guidance to help officers identify national security concerns in applications, which can be challenging to identify as country conditions evolve. In 2016, USCIS determined that its pilot to send officers with national security expertise overseas to support interviewing officers was successful. USCIS has taken steps to fill these positions, but it has not yet developed a plan for deploying these additional officers, whose expertise could help improve the effectiveness of the adjudication process. State, USCIS, and their partners have implemented antifraud measures to reduce the risk of staff and applicant fraud—both of which have occurred—but could further assess fraud risks. Officials from all nine RSCs stated that they assign staff fraud risk management responsibilities to designated individuals. However, not all RSCs reported complying with all required program integrity measures—reported compliance at individual RSCs ranged from 86 to 100 percent. State has also not required RSCs to conduct regular staff fraud risk assessments tailored to each RSC or examined the suitability of related controls. Without taking additional steps to address these issues, State and RSCs may face challenges in identifying new staff fraud risks or gaps in the program's internal control system and implementing new control activities to mitigate them. Further, State and USCIS have not jointly assessed applicant fraud risk program-wide. Doing so could help them ensure that fraud detection and prevention efforts across USRAP are targeted to those areas that are of highest risk. GAO made recommendations to State and USCIS to strengthen the implementation of USRAP. State and USCIS agreed with GAO's recommendations and have begun taking actions to address them.