Title XXVI of the Omnibus Budget Reconciliation Act of 1981 established LIHEAP to assist low-income households, particularly those with the lowest incomes that pay a high proportion of household income for home energy, in meeting their immediate home energy needs. States, territories, Indian tribes, and tribal organizations that wish to assist low-income households in meeting the costs of home energy may apply for a LIHEAP block grant. These grantees operate their LIHEAP programs by paying qualified households or energy service providers for a range of covered home heating and cooling services. LIHEAP benefits are provided to eligible beneficiaries up to the maximum eligible payment for that beneficiary as determined by the grantee. Grant funds are distributed in this manner until the annual grant has been entirely expended or the program year has ended. Although LIHEAP is 100 percent federally funded with no required state match, states and other entities may contribute supplemental funds. While the federal government establishes overall guidelines, each grantee operates its own program. For example, federal law provides that an eligible household’s income must not exceed the greater of 150 percent of the poverty level or 60 percent of the state median income (75 percent in fiscal years 2009 and 2010). Grantees may not set their maximum income threshold below 110 percent of the poverty level, but they may give priority to those households with the highest home energy costs or needs in relation to income. Under the law, LIHEAP grantees have the flexibility of serving households having at least one member who also receives assistance under any of the following federal programs: Temporary Assistance for Needy Families (TANF), Supplemental Security Income (SSI), Supplemental Nutrition Assistance Program (SNAP), and certain needs-tested Veteran Benefits. LIHEAP grantees may also set additional LIHEAP eligibility criteria, such as passing an assets test; living in nonsubsidized housing; having a household member who is elderly, disabled, or a young child; or having received a utility disconnection notice. Our analysis of LIHEAP data revealed that the program is at risk of fraud and providing improper benefits in all seven of our selected states. About 260,000 applications—9 percent of households receiving benefits in the selected states—contained invalid identity information, such as Social Security numbers, names, or dates of birth. Many applications may have inaccuracies due to simple errors such as typos or incomplete sections, making it impossible to determine whether these cases involve fraud. For example, about a third of the applications had Social Security numbers that were blank or obviously invalid (e.g., all zeros). Nonetheless, these applications pose a higher risk of fraud because there is no complete electronic record of beneficiaries’ identities. These benefits totaled some $116 million for the year we reviewed. Our previous work, such as our audit of the Federal Emergency Management Agency’s management of the Individuals and Households Program for hurricanes Katrina and Rita, found that limited or nonexistent use of a third-party validation process left assistance programs vulnerable to substantial fraud. As we will discuss later, LIHEAP generally does not have this third-party validation process for the seven selected states that we reviewed. As described in the bullets below, thousands of cases show strong indications of fraud and improper benefits. But because of the invalid identity information noted above—a lack of a valid Social Security number makes it impossible to fully investigate such cases—these numbers are understated. Deceased individuals. The identities of over 11,000 deceased individuals were used as applicants or household members for LIHEAP benefits. Our analysis matching LIHEAP data to the SSA’s death master file found these individuals were deceased before the LIHEAP application date. Benefits involved with these applications totaled about $3.9 million for the year we reviewed. Incarcerated individuals. For the four states that provided reliable incarceration data, we found 725 instances where the identities of individuals incarcerated in state prisons were used as applicants or household members. These identities were associated with about $370,000 of LIHEAP benefits even though these individuals were in prison at the time of the application and thus ineligible for benefits. Federal employees exceeding income thresholds. Matching LIHEAP data with federal civilian payroll records, we identified about 1,100 federal employees whose federal salary exceeded the maximum income threshold at the time of their application. The benefit payments associated with those applications totaled $671,000. Because LIHEAP is a block grant program, the potential fraudulent and improper activities associated with these thousands of cases have an adverse effect on the program. Specifically, these fraudulent and improper activities will either reduce the amount of energy assistance provided to recipients or prevent legitimate recipients from receiving the energy assistance because the funds have been used. We identified and further investigated 20 cases that demonstrate how fraudulent or improper activity was perpetrated. Thirteen cases concern applications with invalid identity information, deceased individuals, incarcerated individuals, or federal employees receiving LIHEAP benefits. Seven cases are examples of other types of improper and potentially fraudulent activity, including individuals in residential facilities being used to improperly receive benefits and households receiving duplicate LIHEAP benefits. We are referring all 20 cases to the HHS Office of Inspector General (OIG) for further investigation. See table 1 for case details. Further, we identified several instances of LIHEAP program funds being disbursed to individuals who may have met the income threshold but had significant assets. Specifically, we identified several beneficiaries living in million-plus dollar houses in Potomac, Maryland, and the Chicago suburbs. Because neither state considers the amount of a household’s assets in determining whether to provide energy assistance, owning high-dollar assets cannot be considered fraud or improper activity of the program in those states. Without access to bank and tax records, our investigations could not determine whether these individuals met the LIHEAP maximum income threshold. However, in one case, a beneficiary conducted her counseling service from her residence, according to an insurance company Web site. She lives in a $2 million home in a wealthy Chicago suburb and owns a late 2000s Mercedes. She also won a multimillion dollar settlement in the mid 2000s that is currently under appeal. The applicant refused to speak with our investigators or the local police about her LIHEAP application. Finally, our proactive testing further demonstrated LIHEAP’s vulnerability to fraud. Posing as low-income residents, we used bogus addresses and fabricated energy bills, pay stubs, and other supporting documents to apply for energy assistance in West Virginia and Maryland. For three of the five cases, the LIHEAP payments were made to our fictitious energy company to pay the low-income resident’s energy bills. Our investigators created this energy-related company to receive the energy assistance payments. For the other two cases, the low-income residents “lived” in a rental house where the landlord paid the energy assistance benefits as a part of the rent. For these two cases, the investigators created fictitious landlords who received the energy assistance payments. All five claims were processed and the energy assistance payments issued and mailed to our fake company and landlords (see fig. 1). LIHEAP’s internal controls framework has several key weaknesses at both the federal and state levels, as shown by GAO’s fraud prevention model. At the federal level, HHS has not provided specific guidance to states and other grantees for preventing fraud and abuse of LIHEAP. While grantees are primarily responsible for preventing fraud in LIHEAP, the LIHEAP statute establishes a number of oversight and enforcement responsibilities for HHS to ensure that grantees are properly applying the funds, including requiring the issuance of regulations to prevent waste, fraud, and abuse in LIHEAP. HHS has issued regulations that require grantees to establish appropriate systems and procedures to prevent, detect, and correct waste, fraud, and abuse by clients, vendors, and administering agencies, but it has not provided any additional detailed guidance to the states or other grantees on how to develop an effective fraud prevention system. In addition, the selected states do not have an effective design for a comprehensive fraud prevention framework. In fact, the states are lacking key efforts in all three crucial elements of a well-designed fraud prevention system: preventive controls, detection and monitoring, and investigations and prosecutions. Preventive controls. States lack essential preventive controls, which are the most efficient and effective means to minimize fraud, waste, and abuse. Social Security numbers are a key element in the identification of a person’s identity. Our analysis of 1 year of LIHEAP data found that for the selected states about 100,000 individuals’ records contained a blank or obviously invalid Social Security number. HHS’s prior interpretation of the Privacy Act prohibited states from requiring recipients to provide Social Security numbers in applying for LIHEAP benefits. However, 42 U.S.C. § 405 allows states to require that individuals disclose their Social Security numbers for “the administration of any tax, general public assistance, driver’s license, or motor vehicle registration law within its jurisdiction.” We believe that LIHEAP falls within the scope of this statute. In response to our draft report, HHS revised its interpretation, and strongly suggested that states require Social Security numbers. Under HHS’ prior interpretation, the states were not be able to validate individuals’ identities and, without this basic control, we believe it cannot have an effective fraud prevention program. The selected states do not have other measures that we believe are key to preventing fraud, as we discovered from our discussions with state officials (table 2). We believe that these are key preventive control measures that states should integrate in their application processes as long as the costs of these controls do not outweigh the benefits. Officials from five of the states said they did not validate applicant and household member information with SSA, which can verify a person’s Social Security number, name, and date of birth against its records.