Prevention is the most effective and efficient way to minimize fraud, waste, and abuse in any federal program, including disaster assistance, and is also a key element described in the Standards for Internal Control in the Federal Government. The most crucial element of fraud prevention is to substantially diminish the opportunity for fraudulent access into the system through front end controls. Figure 2 displays how preventive controls fit within a larger fraud, waste, and abuse prevention program. Fraud prevention can be achieved by requiring that registrants provide information in a uniform format, and validating that information against external sources. In the current environment, agencies have at their disposal a large number of data sources that they can use to validate the identity and address of registrants. However, our work related to FEMA’s management of the IHP program for hurricanes Katrina and Rita found that their limited use of a third-party validation process left room for substantial fraud. Effective fraud prevention controls require that agencies enter into data-sharing arrangements with organizations to perform validation. System edit checks are also key to identifying and rejecting fraudulent registrations before payments are disbursed. In addition, an effective fraud prevention system is not complete without adequate fraud awareness training of all personnel involved in the distribution of relief. Finally, any new systems or processes need to be field tested to ensure that the system is working properly prior to implementation. Prior to a disaster registrant gaining access to relief payments, key registrant information must be validated. For this program, data such as names, social security numbers (SSN), primary residences, citizenship status, and any other information which determines eligibility must be validated upfront, prior to agencies accepting the registration, or at least prior to disbursements being made. Obtaining releases from registrants which allow an agency to validate data with other sources such as social security records, tax records, and other information is an important step that can facilitate effective validation of data. Depending on the turnaround time needed for a payment, agencies can chose to validate records with federal government databases, or validate information with third-party contractors who can confirm key information with publicly available data from credit reports and other sources almost instantaneously. When using these third-party sources it is also important to at least periodically authenticate the data within the program with the source of the information such as Social Security Administration (SSA) or Internal Revenue Service (IRS) records. Regardless of the sources used, all key data concerning a registration has to be validated to minimize the risks to acceptable levels prior to the registrant being accepted in the program. For example, because FEMA lacked basic identity validation controls, they accepted thousands of IHP registrations from registrants who provided social security numbers that had never been issued or belonged to deceased individuals. In addition, because FEMA failed to validate damaged address information, we found thousands of dollars were paid to individuals for bogus damaged addresses. For data to be properly validated, it should be recorded in a uniform format. Once key data elements relating to disaster relief eligibility are determined, our work has shown that it is important to record the information in a format that will facilitate data validation with external sources. Otherwise, agencies may be faced with thousands or tens of thousands of registrations being rejected or placed in a manual review status because data was not recorded accurately. This is also particularly important when recording names, identity information, and addresses in order to prevent registrants from getting multiple payments by changing the spelling of their address or name. For example, data collected by hotels providing lodging that was paid for by FEMA did not record occupant’s SSN or FEMA registration ID numbers. Thus, there were no common data elements that could be used to ensure people already staying at FEMA paid hotels did not also improperly receive rental assistance. Within the federal government, many organizations such as SSA, United States Postal Service (USPS), and IRS maintain information on disaster assisted registrants. These are all data sources that we have used in prior forensic work to identify fraudulent and improper payments. However, proactive actions are necessary on the part of agencies responsible for providing disaster assistance to enter into data-sharing agreements with organizations that own the data. Agreements have to be in place prior to any disaster occurring for agencies to take advantage of data-validation sources. Also for tax information, consent must be requested from the registrant at the time of registration. Finally, whenever possible, registration data and specific loss claims should be validated by a physical inspection of the disaster damage prior to payment. In some cases, as with the massive destruction caused by Hurricane Katrina, physical inspections in a timely manner are not possible, and therefore acceptance of data must be done through electronic verification. However, within the FEMA IHP program we found significant fraud related to expedited assistance payments that were made prior to any physical inspection being performed. In the cases we found, many fraudulent registrations could have been identified and rejected if inspections were performed because they would have seen that properties did not even exist, as we found when performing our own inspections. For example, FEMA failed to perform physical inspections on our undercover registrations, which used completely bogus property addresses and vacant lots. Had a physical inspection been performed, FEMA could have identified the fraudulent information and denied the expedited and rental assistance payments. Disaster relief programs must also have a network of system pre-payment edit checks in place to ensure that obviously false or duplicate information is not used to receive disaster relief payments. System edit checks can be performed before or after a registration is accepted into the system, but to be an effective preventive control, they must be performed prior to the distribution of a payment. Edit checks should include items such as ensuring that the same SSN was not used on multiple registrations, or that the registrant provides a verifiable physical address for which the disaster damaged is based on. In the case of FEMA’s IHP program, we found the lack of effective system edit checks allowed numerous individuals to fraudulently register numerous times and receive multiple payments using the same name, social security number, or address. In one case, the lack of controls allowed an individual to register eight times using the same name and SSN and receive multiple disaster assistance payments. In addition, accepting applications with obviously inaccurate data exposed FEMA to the risk that disbursements would be made based on obviously false data. For example, we found during our work that FEMA paid millions of dollars in IHP payments to individuals who used a Post Office Box as their damaged physical address in order to receive assistance. In those cases system edits should have identified the Post Office Box as an invalid physical address and forced the applicant to provide a valid street address for the damage property in order to be considered for disaster assistance. Results of our work also showed that agencies must follow through and accurately implement—and not short-change—existing system edit checks to provide assurance that the program is protected. We found in the course of our work that FEMA had designed controls that may have prevented some fraudulent payments. However, our work also indicated that these controls were circumvented, for example, when FEMA designed scripts to override system edit checks that had identified registrations as potential duplicates, in an effort to disburse funds as quickly as possible. Adhering to existing control procedures is therefore also crucial when maintaining effective fraud prevention. Beyond the uniform recording and validation of data, other controls, including a well-trained work force that is aware of the potential for fraud, can help prevent fraud. Personnel involved in a disaster program, including government employees and call center and inspection contractors, should receive training about the potential for fraud within the program and the likely types of fraud they could encounter. Fraud awareness training with frontline personnel is crucial because they are part of the first line of defense and therefore play a key role in fraud prevention. If the personnel accepting registrations and performing physical inspections of properties and documents are aware of fraud indicators and suspicious activities, they will help to identify potentially fraudulent activity as soon as it occurs. Where possible, incentives can be provided to contractors not just to process registrations and claims quickly, but also to prevent fraud. In addition, when implementing any new controls, it is important to field test all systems prior to putting them in place. As stated in a recent testimony on the IHP program, FEMA acknowledged that they had instituted several new processes that had not been tested. Weaknesses in these new processes, including the lack of validation controls over key data elements, resulted in our findings of approximately $1 billion dollars in potential fraud in the IHP program. On top of reducing the risk of untested controls allowing substantial fraud, field-testing also helps to ensure that new controls do not improperly deny benefits to valid registrants. A safety net for those registrants who are wrongly denied disaster relief due to preventive controls should always be in place to ensure they receive assistance. This process should include staff who are adequately trained to expeditiously handle exceptions. Even with effective preventive controls, there is substantial residual risk that fraudulent registrants are likely to gain access to a disaster relief program and begin to receive payments. Therefore, after a registrant has successfully passed through upfront controls and begun to receive payments, our work at FEMA illustrated that agencies must continue their efforts to monitor the execution of the disaster relief program. Detection and monitoring efforts are addressed in the Standards for Internal Control in the Federal Government and include such activities as data-mining registrations, which have received payments, ensuring accountability over funds and monitoring how the disaster assistance is being spent, and establishing mechanisms to identify the existence of fraud. Figure 3 provides a perspective on how these controls fit into an overall fraud prevention program. Data-mining of registration data within the program should be done to look for suspicious information after payments have been made. Along with data-mining efforts, proper accountability controls over the distribution of funds and the monitoring of fund usage is key to obtaining reasonable assurance that relief payments are being used to mitigate the effects of a disaster.