We identified three key factors that affect delivery of humanitarian assistance to people inside Syria. First, the increasingly violent and widespread Syrian conflict has hindered effective delivery of humanitarian assistance. Based on our analysis of monthly UNSG reports on the situation inside Syria, as well as interviews with officials providing assistance to Syria based both inside and outside of the country, humanitarian assistance is routinely prevented or delayed from reaching its intended target due to shifting conflict lines, attacks on aid facilities and workers, an inability to access besieged areas, and other factors related to active conflict (see fig. 1). Second, administrative procedures put in place by the Syrian government have delayed or limited the delivery of humanitarian assistance, according to UNSG reports. These reports detail multiple instances of unanswered requests for approvals of convoys, denial or removal of medical supplies from convoys, difficulty obtaining visas for humanitarian staff, and restrictions on international and national NGOs’ ability to operate. As of May 2016, the UNSG reported that 4.6 million people inside Syria are located in hard-to-reach areas and more than 500,000 of those remain besieged by Islamic State of Iraq and Syria, the government of Syria, or non-State armed opposition groups. The UN further reported that in 2015, only 10 percent of all requests for UN interagency convoys to hard-to-reach and besieged areas were approved and assistance delivered. In addition, according to implementing partner officials based in Damascus, Syria, even when these convoys were approved, the officials participating in delivering the assistance were subjected to hours-long delays. Third, due to restrictions, USAID and State staff manage the delivery of humanitarian assistance in Syria remotely from neighboring countries. The U.S. government closed its embassy in Damascus, Syria, in 2012 due to security conditions and the safety of personnel, among other factors. In the absence of direct program monitoring, USAID and State officials noted that they utilize information provided by implementing partners to help ensure effective delivery of assistance and to help their financial oversight, including mitigating risks such as fraud, theft, diversion, and loss. However, USAID officials in the region explained to us that while partners provide data and information, their inability to consistently access project sites—due to factors such as ongoing fighting, bombing raids, and border closures—limited the extent to which partners could obtain and verify progress. Past audit work has shown challenges to such an approach, including cases of partners not fully implementing monitoring practices, resulting in limited project accountability. Further, USAID Office of Inspector General (OIG) has reported that aid organizations providing life-saving assistance in Syria and the surrounding region face an extremely high-risk environment, and that the absence of adequate internal controls, among other challenges, can jeopardize the integrity of these relief efforts and deny critical aid to those in need. State, USAID, and their implementing partners have assessed some types of risk to their programs inside Syria, but most partners have not assessed the risk of fraud. Risk assessment involves comprehensively identifying risks associated with achieving program objectives; analyzing those risks to determine their significance, likelihood of occurrence, and impact; and determining actions or controls to mitigate the risk. In the context of Syria, such risks could include theft and diversion; fraud; safety; security; program governance; and implementing partner capacity risks. Most of the implementing partners in our sample have conducted formal risk assessments for at least one type of risk, especially security risk, and several maintain risk registers that assess a wide variety of risks (see table 1). However, few implementing partners have conducted risk assessments for the risk of fraud (four of nine), or for the risk of loss due to theft or diversion (four of nine). According to GAO’s A Framework for Managing Fraud Risks in Federal Programs, effective fraud risk management involves fully considering the specific fraud risks the agency or program faces, analyzing the potential likelihood and impact of fraud schemes, and prioritizing fraud risks. In addition, risk assessment is essential for ensuring that partners design appropriate and effective control activities. Control activities to mitigate the risk of fraud should be directly connected to the fraud risk assessments and, over time, managers may adjust the control activities if they determine that controls are not effectively designed or implemented to reduce the likelihood or impact of an inherent fraud risk to a tolerable risk level. Although most of the implementing partners in our sample did not conduct assessments of the risk of fraud, there are elevated risks for fraud in U.S. funded humanitarian assistance projects for people inside Syria. According to officials at USAID OIG, they have four ongoing investigations of allegations of fraud and mismanagement related to programs for delivering humanitarian assistance to people inside Syria. Two of the investigations involve allegations of procurement fraud, bribery, and product substitution in USAID funded humanitarian cross- border programs related to procurements of non-food items. One of these investigations found that the subawardee of the implementing partner failed to distribute nonfood items in southern Syria, instead subcontracting the distribution to another organization, but nevertheless billed USAID for the full cost of the project. Additionally, the subawardee was reliant on one individual to facilitate the transfer of materials and salaries, and this individual was involved in the alteration and falsification of records related to the distribution of the nonfood items. According to the USAID OIG, senior leadership at the subawardee was aware of these facts. Further, in May 2016, USAID OIG reported the identification of bid- rigging and multiple bribery and kickback schemes related to contracts to deliver humanitarian aid in Syria, investigations of which resulted in the suspension of 14 entities and individuals involved with aid programs from Turkey. Without documented risk assessments, implementing partners may not have all of the information needed to design appropriate controls to mitigate fraud risks, and State and USAID may not have visibility into areas of risk, such as fraud and loss due to theft and diversion. We found that partners in our sample had implemented controls to mitigate certain risks of delivering humanitarian assistance inside Syria. For instance, many partners in our sample implemented controls to account for safety and security risks to their personnel and beneficiaries receiving assistance. Some partners identified aerial targeting of humanitarian aid workers and beneficiaries at distribution points as a major vulnerability and implemented controls to mitigate this risk, such as distributing goods to beneficiaries on overcast days and making door-to- door deliveries of aid packages. In addition, partners in our sample implemented controls to mitigate risks of fraud and loss within their operations. For example, officials from two implementing partners we interviewed in Amman, Jordan, stated that they conducted spot checks of assistance packages in warehouses to confirm the quantity of the contents and ensure that the quality of the items complied with the terms of the contract. According to another implementing partner, officials from its organization visit the vendor warehouses before signing contracts to verify that U.S. government commodity safety and quality assurance guidelines are met. However, the majority of controls to mitigate risks of fraud and loss were not informed by a risk assessment (see table 2). State and USAID have taken steps to oversee partner programs delivering humanitarian assistance inside Syria; nevertheless, opportunities to assess and mitigate the potential impact of fraud risks remain. U.S. officials cited a variety of oversight activities. For instance, State officials in the region conduct quarterly meetings with partners and collect information on programmatic objectives and on partner programs. State also has enhanced monitoring plans in place with its implementing partners to augment quarterly reporting with information on risks of diversion of assistance. Similarly, USAID officials in Washington, D.C., told us they screen proposals from partners to identify risk mitigation activities and USAID officials in the region noted they maintain regular contact with partners, attend monthly meetings with them, conduct random spot-checks of aid packages at warehouse facilities, and coordinate activities among partners to reduce or eliminate duplication or overlap of assistance. Moreover, according to USAID officials, the USAID OIG has conducted fraud awareness training for officials in the region to improve their ability to detect fraud, such as product substitution, when they conduct spot-checks of aid packages at warehouse facilities. Further, in October 2015, USAID’s Office of U.S. Foreign Disaster Assistance hired a third party monitoring organization to review its projects in Syria. By February 2016, field monitors had conducted site visits and submitted monitoring reports to USAID, providing information on the status of projects and including major concerns that field monitors identified. We found that fraud oversight could be strengthened. Based on our analysis, USAID’s third party monitoring contract and supporting documentation contain guidelines for verifying the progress of activities in Syria; however, they do not clearly instruct field monitors to identify potential fraud risks as they conduct site assessments of projects in Syria. Furthermore, the monitoring plan and site visit templates do not contain specific guidance on how to recognize fraud, and field monitors have not received the USAID OIG fraud awareness training, according to USAID officials. Leading practices in fraud risk management suggest evaluating outcomes using a risk-based approach and adapting activities to improve fraud risk management. This includes conducting risk-based monitoring and evaluation of fraud risk management activities with a focus on outcome measurement and using the results to improve prevention, detection, and response. The monitoring plan associated with the contract contains guidelines for field monitors to document their assessment of the project at the completion of a site visit. However, it lacks specific guidelines to identify potential fraud risks during site visits. Additionally, the templates created by the third party monitoring organization to document site visits instruct monitors to verify the presence or absence of supplies and their quality, among other instructions, but lack specific fraud indicators to alert field monitors to collect information on and identify potential fraud. Furthermore, the monitoring plan contains a training curriculum for field monitors, which has several objectives designed to familiarize them with the protocols, procedures, and instruments used for data collection and reporting. However, the curriculum does not have specific courses for recognizing potential or actual instances of fraud that may occur on site.