FEMA has a substantial challenge in balancing the need to get money out quickly to those who are actually in need and sustaining public confidence in disaster programs by taking all possible steps to minimize fraud and abuse. Nevertheless, FEMA could reasonably be expected to have mature, fully tested processes, along with business partners in the federal, state, and private sector, that can provide it with real time access to the data required to validate identities and addresses for those seeking disaster assistance. Once fraudulent registrations are made and money is disbursed, detecting and pursuing those who committed fraud in a comprehensive manner is costly and may not result in recoveries. Further, many of those fraudulently registered in the FEMA system already received expedited assistance and will likely receive more money, as each registrant can receive as much as $26,200 per registration. Another key element to preventing fraud in the future is to ensure there are consequences for those that commit fraud. We are referring the fraud cases that we are investigating to the Katrina Fraud Task Force for further investigation and, where appropriate, prosecution. We believe that prosecution of individuals who have obtained disaster relief payments through fraudulent means will send a message for future disasters that there are consequences for defrauding the government. We recommend that the Secretary of the Department of Homeland Security (DHS) direct the Director of the Federal Emergency Management Agency to take six actions to address the weaknesses we identified in the administration of IHP. These six recommendations relate only to the limited scope of work that we have completed to date and will not prevent all types of improper and fraudulent IHP payments. Consequently, we will continue to audit and investigate the assistance provided by FEMA in the aftermath of hurricanes Katrina and Rita and we will issue further recommendations designed to create a more comprehensive fraud prevention program for IHP. To address the concerns raised in our February 13, 2006, testimony, we recommend that DHS and FEMA do the following: Establish an identity verification process for Individuals and Households Program (IHP) registrants applying via both the Internet and telephone, to provide reasonable assurance that disaster assistance payments are made only to qualified individuals. Within this process establish detailed criteria for registration and provide clear instructions to registrants on the identification information required, create a field within the registration that asks registrants to provide their name exactly as it appears on their Social Security Card in order to prevent name and Social Security Number (SSN) mismatches, fully field test the identity verification process prior to ensure that call center employees give real-time feedback to registrants on whether their identities have been validated, and establish a process that uses alternative means of identity verification to expeditiously handle legitimate applicants that are rejected by identity verification controls. Develop procedures to improve the existing review process of duplicate registrations containing the exact same SSN and to identify the reasons why registrations flagged as invalid or as potential duplicates have been overridden and approved for payment. Establish an address verification process for IHP registrants applying via both the Internet and telephone, to provide reasonable assurance that disaster assistance payments are made only to qualified individuals. Within this process create a uniform method to input street names and numbers and apartment numbers into the registration, institute procedures to check IHP registration damaged addresses against publicly available address databases so that payments are not made based on bogus property addresses, fully field test the address verification process prior to ensure that call center employees can give real time feedback to registrants on whether addresses have been validated, and establish a process that uses alternative means of address verification to expeditiously handle legitimate applicants that are rejected by address verification controls. Explore entering into an agreement with other agencies, such as the Social Security Administration, to periodically authenticate information contained in IHP registrations. Establish procedures to collect duplicate expedited assistance payments or to offset these amounts against future payments. Such duplicate payments include the payments made to IHP recipients who improperly received the $2,000 debit cards and an additional $2,000 EA check or Electronic Funds Transfer (EFT) and the thousands of duplicate EA payments made to the same IHP registration number. Ensure that any future distribution of IHP debit cards includes instructions on the proper use of IHP funds, similar to those instructions provided to IHP check and EFT recipients, to prevent improper usage. In written comments on a draft of this report, which are reprinted in appendix II, DHS and FEMA made a number of observations that were not related to any specific recommendation, concurred fully with four of our six recommendations, and partially concurred with the remaining two recommendations. In general comments, FEMA and DHS stated that they could benefit more from the report if information sharing between GAO and FEMA had been reciprocal. We believe that we employed such an arrangement throughout this engagement. We regularly briefed DHS and FEMA concerning the progress of the audit. For example, we notified FEMA management immediately after we detected that duplicate EA payments were made to individuals who had received debit cards, and worked closely with FEMA’s Disaster Finance Center to resolve other issues related to payments that appeared to exceed the $26,200 limit for specific recipients. DHS and FEMA also expressed concern over the objectivity and fairness of our report. Specifically, DHS and FEMA noted that our selection of 248 registrations was not a representative sample and was geared specifically toward identifying and reporting on registrations that had problems. Our testimony clearly states that the case studies we used were intended to demonstrate the type of fraud and abuse that occurred because of weak or nonexistent controls over the registration process and did not represent a statistical sample of registrations. The primary findings of our work relate to weak or nonexistent controls that leave the government vulnerable to substantial fraud and abuse in the IHP. Furthermore, as represented at the February 13, 2006, hearing, we are continuing our work in this area. Specifically, we have taken a statistical sample of IHP payments so that we can statistically estimate the magnitude of improper and potentially fraudulent claims. We have nearly completed this work and plan to report our findings later this month. FEMA and DHS also found problems with our assertion that EA payments were the gateway to future IHP payments. Specifically, FEMA and DHS noted that future IHP payments are subjected to additional scrutiny. We did not test this additional scrutiny as part of our February 13, 2006, testimony. However, we continue to believe that accepting registrations for individuals using invalid identity and damaged property information subjects the federal government to a high risk of fraud and abuse beyond EA payments. We believe that our ongoing audit and investigative work sheds further light on whether the additional scrutiny that FEMA asserts does in fact prevent fraudulent and improper payments related to rental assistance and other covered losses. FEMA and DHS further noted that we made several references to isolated incidents where debit cards were used for purchases that did not appear to be for disaster needs, and FEMA questioned whether highlighting those examples was appropriate. We specifically noted in each reference to these purchases that they were isolated and were not representative of the general breakdown of known debit card usage. We also clearly stated that over 60 percent of debit card transactions were used to obtain cash and could not be tracked further to identify the final use of the IHP funds. We identified the non-disaster-related purchases to highlight the fact that FEMA did not provide any instruction to debit card recipients on the appropriate use of IHP funds. With regard to specific recommendations, FEMA and DHS concurred fully that FEMA (1) improve procedures to review registrations containing the same SSNs and other duplicate information; (2) subject all registration addresses to verification during the registration process; (3) explore entering into agreements with other agencies, such as the Social Security Administration, to periodically authenticate IHP information; and (4) issue proper instructions to any future debit card recipients. FEMA and DHS stated that they have already taken actions to address these recommendations. These actions include instituting an Internet application process that will prevent all duplicate registrations from the Internet, implementing procedures so that call centers will no longer accept duplicate registrations with the same SSN in the same disaster, and conducting conference calls and conducting data sharing tests with SSA. In addition, DHS and FEMA stated that, starting in June 2006, all registration addresses (even phone-in) will be subjected to an online verification during the registration process. While these are steps in the right direction, we will follow up on whether the actions taken fully address our recommendations. FEMA and DHS partially concurred with our recommendation concerning duplicate payments. FEMA and DHS took exception with our categorization of some payments as being potential duplicates, and with our assessment that they should initiate actions to collect duplicate EA payments or offset these amounts in the future, stating that it was unclear whether some of the of the payments were in fact valid due to the “separated households” policy instituted for hurricanes Katrina and Rita. With respect to duplicate registrations, we maintain that these registrations are very likely duplicates because the payments were made to several individuals with the same last names, same damaged addresses, and the same current addresses; FEMA’s own database clearly indicates that these were not separated households. For all our case study examples, we conducted further investigative work to confirm that the payments were made to actual duplicates, not covered by the separated household policy, and were therefore improper payments. As for initiating actions to collect duplicate payments, DHS and FEMA stated that they had processed for recoupment nearly all the payments they believed were duplicates as of April 1, 2006. While we have not assessed the effectiveness of FEMA’s recoupment process, we continue to believe that FEMA should attempt to recoup as many dollars of improper payments as possible, including those duplicate payments that we identified that FEMA questioned.