Audit work we performed on FEMA’s IHP payments and DHS’s purchase card program identified widespread fraud, waste, and abuse. Findings from these audits and our related investigations show the result of ineffective preventive controls. As shown by our IHP work, ineffective preventive controls can result in hundreds of millions or potentially billions of dollars in improper and fraudulent payments. In addition, our work on DHS purchase cards showed that control weaknesses in government purchasing programs can also result in fraud, waste, and abuse. Between February and December 2006, we testified on three different occasions that potentially improper and fraudulent activities related to the IHP program are significant. Our February 2006 testimony focused on control weaknesses that resulted in FEMA making thousands of Expedited Assistance (EA) payments that were based on bogus registration data. Specifically, we found that FEMA made millions of dollars in payments on registrations containing Social Security numbers that had never been issued or belonged to deceased individuals. In addition, we also found that numerous registrations we selected for investigation contained bogus damaged address. We also successfully submitted fictitious registrations and received payments using bogus identities and addresses. Our second testimony in June 2006 discussed breakdowns in internal controls, in particular the lack of controls designed to prevent bogus registrations. These breakdowns resulted in an estimated 16 percent or $1 billion in payments made through February 2006 based on invalid registrations. The statistical sample testing used to reach this estimate found payments made on registrations that contained invalid identities, bogus addresses, addresses which the registrant did not live in at the time of the disaster, and duplicate registrations. Our data mining also found that FEMA paid millions of dollars on over 1,000 registrations containing the names and Social Security numbers of individuals incarcerated in federal or state prisons during the hurricanes, and paid millions of dollars in IHP payments to individuals who claimed a Post Office box as their damaged physical address in order to receive assistance. In our December 2006 testimony we found additional instances of IHP fraud, waste, and abuse, including duplicate housing assistance provided to thousands of individuals living in FEMA-provided housing. Specifically FEMA paid registrants rental assistance money while at the same time providing rent-free housing in apartments and FEMA trailers. We also found that FEMA provided about $20 million dollars in potentially duplicate payments to individuals who registered and received assistance twice using the same Social Security number and damaged address. These individuals registered once for Hurricane Katrina and then again for Hurricane Rita using the same Social Security number and damaged address. FEMA also paid several million more dollars worth of IHP payments to registrants who were ineligible nonqualified aliens. Based on data we received from several universities in the area, we identified that FEMA made IHP payments to more than 500 ineligible foreign students, despite receiving, in some cases, evidence clearly showing that they were not eligible for IHP benefits. The December 2006 testimony also pointed to the small amount of money that FEMA had been able to collect from improper payments as of November 2006. Specifically, in contrast to the $1 billion in potentially improper and/or fraudulent payments we estimated through February 2006, FEMA had detected, as of November 2006, about $290 million in improper payments, and had collected only $7 million. Our work on DHS purchase card controls found weak accountability over FEMA computers, printers, Global Positioning System (GPS) units, and other items bought for hurricane relief efforts using government purchase cards. Thirty-four percent of items obtained with purchase cards that we investigated could not be located and are thus presumed lost or stolen. As of October 2006, more than 40 computers, 10 printers, 20 GPS units, and 2 flat-bottom boats are missing. In addition, 18 other flat-bottom boats purchased by FEMA were in its possession, but FEMA did not own title to any of them. Based on these findings, and the findings on the IHP program, we have made recommendations to FEMA to develop effective systems and controls to minimize the opportunity for fraud, waste, and abuse in the future. FEMA has generally concurred with most of our recommendations and has reported on actions to improve prevention of fraud, waste, and abuse for the future. The results of our work serve to emphasize the overall lesson learned that fraud prevention is the most effective and efficient means to minimize fraud, waste, and abuse. It also demonstrates that the establishment of effective fraud prevention controls over the registration and payment process, fraud detection and monitoring adherence to those controls, and the aggressive pursuit and prosecution of individuals committing fraud are crucial elements of an effective fraud prevention program over any assistance programs with defined eligibility criteria, including disaster assistance programs. The very nature of the government’s need to quickly provide assistance to individuals adversely affected by disasters makes assistance payments more vulnerable to applicants attempting to obtain benefits that they are not entitled to receive. However, it is because of these known vulnerabilities that federal and state governments need to have effective controls in place to minimize the opportunities for individuals to defraud the government. Figure 1 provides an overview of how preventive controls help to screen out the majority of fraud, waste, and abuse, and how detection controls and prosecution can help to further minimize the extent to which a program is vulnerable to fraud. Preventive controls are a key element on an effective fraud prevention program and are also described in the Standards for Internal Control in the Federal Government. The most crucial element of effective fraud prevention controls is a focus on substantially diminishing the opportunity for fraudulent access into the system through front-end controls. Preventive controls should be designed to include, at a minimum, a requirement for data validation, system edit controls, and fraud awareness training. Finally, prior to implementing any new preventive controls, and well in advance of any disaster, agencies must adequately field test the new controls to ensure that controls are operating as intended and that legitimate victims are not denied benefits. Fraud prevention can be achieved by requiring that registrants provide information in a uniform format, and validating these data against other government or third-party sources to determine whether registrants provided accurate information on their identity and place of residence. Effective fraud prevention controls require that agencies enter into data- sharing arrangements with organizations to perform validation. In the current environment, agencies have at their disposal a large number of data sources that they can use to validate the identity and address of registrants. However, our work related to FEMA’s management of the IHP program for hurricanes Katrina and Rita found that its limited—or sometimes nonexistent—use of a third-party validation process left disaster assistance programs vulnerable to substantial fraud. For example, FEMA’s failure to implement preventive controls to validate the identity of individuals who applied using the telephone resulted in FEMA making millions of dollars in payments to individuals who used Social Security numbers that had never been issued or belonged to deceased individuals. Another method of data validation is through physical inspection of the disaster damage prior to payment. While physical inspections in a timely manner may not be possible to prevent all fraudulent and improper payments, our work found that FEMA continued to make payments without a valid physical inspection of our undercover registration’s bogus addresses, months after the hurricanes had occurred. System edit checks designed to identify problem registrants and claims (e.g., duplicates) before payments are made are also a crucial lesson learned with respect to ensuring that obviously false or duplicate information is not used to receive disaster relief payments. System edit checks are most effective if performed before distribution of a payment. Edit checks should include ensuring that (1) the same Social Security number was not used on multiple registrations and (2) the registrant provides a verifiable physical address on which the disaster damage is based. In the case of FEMA’s IHP program, ineffective edit checks resulted in millions paid to registrants who claimed the same damages twice, once for Hurricane Katrina and once for Hurricane Rita, and registrants who submitted multiple registrations using the same name, Social Security number, or address. Ineffective edit checks also resulted in payments being made based on obviously false data, including payments of millions of dollars to individuals who used a Post Office box as their damaged physical address in order to receive assistance. Beyond validation and edits, lessons learned show that other controls, including a well-trained work force that is aware of the potential for fraud, can help prevent fraud. Fraud awareness training with frontline personnel—specifically on the potential for fraud within the program and the likely types of fraud they could encounter—is crucial to stopping fraud before it gains access into the program. In addition, when implementing any new controls, it is important to field test all systems prior to putting them in place. On top of reducing the risk of untested controls allowing substantial fraud, field testing also helps to ensure that new controls do not improperly deny benefits to valid registrants. A safety net for those registrants who are wrongly denied disaster relief due to preventive controls should always be in place to ensure they receive assistance. Even with effective preventive controls, there is substantial residual risk that fraudulent and improper disaster relief payments can occur. Our work has shown that agencies must continue their efforts to monitor fraud and improper payment vulnerabilities in the execution of disaster relief programs, even if these efforts are more costly and less effective than preventive controls. Detection and monitoring efforts are addressed in the Standards for Internal Control in the Federal Government and include data-mining for fraudulent and suspicious transactions and reviews to establish the accountability of funds. Also, control weaknesses identified through detection and monitoring should be used to make improvements to preventive controls to reduce the risk for fraud, waste, and abuse in the future. The data-mining we performed to search for anomalies in registrant data and purchase card transactions show how important constant monitoring and detection can be. Through data-mining, we found rental assistance payments to individuals who were residing in FEMA-provided hotel rooms, trailers, and apartments and payments to ineligible, nonqualified aliens.