Disaster Assistance: FEMA Should Take Additional Actions to Strengthen Fraud Risk Management for Public Assistance Emergency Work Grants
Fast Facts
The Federal Emergency Management Agency provided almost $10 billion through its Public Assistance grant program to states and territories for debris removal and other emergency work projects following the hurricanes and wildfires in 2017.
FEMA knew about some of the fraud risks to the program, such as overstated claims for debris removal and kickbacks. But there are several leading practices for fraud risk assessments that could help FEMA identify even more risks and mitigate them.
We made 5 recommendations, including that FEMA assess fraud risks to this program and provide antifraud training to grant recipients and program staff.
Residential Debris from Hurricane Harvey in Texas in 2017
Highlights
What GAO Found
The Federal Emergency Management Agency (FEMA) has identified some risks to Public Assistance (PA) emergency work grants—funds provided to applicants such as states and territories—for debris removal and other emergency measures. FEMA also has ongoing or planned efforts that could inform fraud risk assessments. However, the agency has not comprehensively assessed fraud risks to these grants as called for by leading practices in GAO's Fraud Risk Framework. Fraud risks include those from debris removal schemes—such as misrepresenting the amount, source, or type of items removed—or associated with procurement and contracting, such as bribery, collusion, and false invoicing. According to officials, FEMA manages fraud risks to PA emergency work grants through its existing grants-management and program-integrity efforts. However, absent regular fraud risk assessments, including identifying inherent fraud risks and examining the suitability of existing controls, FEMA lacks reasonable assurance that these efforts effectively address the most significant fraud risks facing PA emergency work grants.
Residential Debris Awaiting Pickup in Texas Following Historic Flooding Caused by Hurricane Harvey in 2017
FEMA provides resources to help PA applicants meet their responsibilities for managing risks, but opportunities exist for the agency to improve communication. Specifically, GAO found that FEMA communicated some information that could help applicants manage fraud risks, but key resources did not provide information on known areas of fraud risk. According to GAO's Fraud Risk Framework, a leading practice is to provide fraud-awareness training for external stakeholders—such as PA applicants—with responsibility for implementing aspects of the program. Further, a leading practice for implementing effective fraud-awareness initiatives is to convey information about risks and how to identify fraud schemes. According to FEMA officials, the agency generally does not use the term “fraud” because FEMA's focus is on ensuring compliance and eligibility. However, the deceptive nature of fraud makes it harder to detect than nonfraudulent errors, such as compliance and eligibility issues, and potentially requires control activities designed to prevent and detect criminal intent. Updating key resources for applicants to ensure these resources consistently communicate information on the highest fraud risks to emergency work grants would help ensure applicants are better able to identify and address potential fraud earlier in the process.
Why GAO Did This Study
FEMA has obligated over $10 billion in PA grants for emergency work to applicants in the three states and two territories recovering from hurricanes and wildfires in 2017. FEMA faces challenges balancing the need to quickly deliver disaster funds while minimizing the risk of fraud—challenges increased by the size and scope of the 2017 disasters and the complexity of the PA grant program. Fraud schemes have included false documentation for debris removal.
GAO was asked to review a range of disaster response and recovery issues following the 2017 disaster season. This report addresses the extent to which (1) FEMA's efforts to assess fraud risks to PA emergency work grants align with leading practices, and (2) FEMA helps ensure PA applicants are able to meet their responsibilities for managing fraud risks. GAO assessed FEMA's procedures against leading practices in the Fraud Risk Framework. GAO interviewed FEMA officials responsible for the PA grant program and its training and fraud risk management. GAO conducted site visits to California and Texas, selected partly for variation in disaster type, and interviewed selected PA applicants.
Recommendations
GAO makes five recommendations, including that FEMA plan and conduct fraud risk assessments of PA emergency work grants and that it consistently communicate information to PA applicants on the highest fraud risks. The Department of Homeland Security stated that it concurred with GAO's recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Federal Emergency Management Agency | The Administrator of FEMA should plan and conduct regular fraud risk assessments of PA emergency work grants to determine a fraud risk profile that aligns with leading practices as provided in the Fraud Risk Framework. Specifically, this process should include (1) identifying inherent fraud risks to PA grant funds, (2) assessing the likelihood and impact of inherent fraud risks, (3) determining fraud risk tolerance, (4) examining the suitability of existing fraud controls, and (5) documenting the fraud risk profile. (Recommendation 1) |
Closed – Implemented
As of December 2023, based on supporting documentation provided and discussions with FEMA officials, we determined that FEMA's efforts address our recommendation to plan and conduct regular fraud risk assessments of PA emergency work grants to determine a fraud risk profile. For example, the program review branch of FEMA's Fraud Investigations and Inspections Division completed its review of PA debris removal in September 2022. It completed its review of PA emergency protective measures-focusing on a specific area based on its risk matrix calculation-in July 2023. These program reviews resulted in Fraud Risk Profile Reports. FEMA plans to identify additional debris removal and emergency protective measures risk areas for further review or re-review utilizing the risk matrix process. These fraud risk management activities will help ensure that FEMA's oversight efforts address areas most at risk for fraud in PA emergency work grants.
|
| Federal Emergency Management Agency |
Priority Rec.
The Administrator of FEMA should designate one entity as the lead entity with responsibility for providing oversight of agency-wide efforts to manage fraud risks to PA emergency work grants, including managing the fraud risk assessment process, consistent with leading practices. (Recommendation 2) |
Closed – Implemented
In August 2023, FEMA provided a copy of its updated directive for fraud prevention and investigation in FEMA programs. This directive outlines the Office of Chief Security Officer's Fraud Investigations and Inspections Division's (FIID) responsibilities for managing and coordinating agency-wide efforts to prevent, detect, deter, investigate, and report fraud, waste, and abuse. For example, FIID conducts reviews of FEMA programs and grant actions-including the Public Assistance (PA) program-to ensure internal controls are established to prevent or mitigate fraud, waste, and abuse. FIID's reports include observations, best practices, and relevant recommendations to improve internal controls to prevent fraud, waste, and abuse. One of the cited results of these reviews is a fraud risk profile which, among other things, identifies fraud vulnerabilities and risks, identifies established controls activities to mitigate risk, and reviews risk tolerance. All FEMA personnel are required to comply with the directive and FIID instructions and requests for assistance. Designating a lead entity for fraud risk management efforts and documenting these responsibilities will help ensure that FEMA is managing its fraud risks and that its efforts address areas most at risk for fraud in PA emergency work grants.
|
| Federal Emergency Management Agency | The Administrator of FEMA should update key training and guidance documents for the PA grant program to include information on where and how to report suspected fraud, and direct PA recipients to include such information in key training and guidance documents they provide to subrecipients. (Recommendation 3) |
Open – Partially Addressed
FEMA updated several, but not all, key training and guidance documents for the PA grant program to include information on where and how to report suspected fraud. For example, from late 2020 through spring 2021, FEMA added this information to its procurement trainings and website for PA applicants and to various other training materials, including internal and external webinars, on-demand videos, and a fact sheet on managing fraud risks. In addition, in its procurement trainings, FEMA encourages recipients to include information on reporting fraud in key training and guidance documents provided to subrecipients. Further, FEMA added language on where and how to report fraud to training guidance documents for PA staff. However, FEMA has not updated the Public Assistance Program and Policy Guide (PAPPG)--a key source of information on the PA grant program for applicants--to include this information. In May 2023, FEMA officials stated that FEMA plans to issue the newer version of the PAPPG by the end of 2023 and plans to include information on how and where to report suspected fraud in that version of the guide. We will continue to monitor FEMA's progress in this area.
|
| Federal Emergency Management Agency | The Administrator of FEMA should update key resources, such as training and guidance documents, FEMA makes available to PA applicants to ensure these resources consistently communicate information on the highest fraud risks to PA emergency work grant funds and applicants' responsibilities for managing those risks. The highest fraud risks may include risks related to procurement and debris removal, and other risks FEMA identifies through fraud risk assessments. (Recommendation 4) |
Open
According to FEMA officials, as of May 2023, FEMA's PA Division and the Procurement Disaster Assistance Team (PDAT) had received the Fraud Investigations and Inspections Division's fraud risk profile for PA debris removal and were working to update program-specific antifraud training and guidance materials for PA applicants. Specifically, according to FEMA officials, the PA Division and PDAT planned to update these resources with information on the highest fraud risks to PA debris removal identified in the risk profile by June 2023 and September 2023, respectively. In addition, according to FEMA officials, the PA Division and PDAT planned to update program-specific antifraud training and guidance materials with information on the highest fraud risks to PA emergency protective measures in Spring 2024, after the Fraud Investigations and Inspections Division completed its review of PA emergency work. We will continue to monitor FEMA's progress in this area.
|
| Federal Emergency Management Agency | The Administrator of FEMA should implement program-specific antifraud training for PA staff who work directly with PA applicants; this training should include information on the highest fraud risks to PA emergency work grants. The highest fraud risks may include risks related to procurement and debris removal, and other risks FEMA identifies through fraud risk assessments. (Recommendation 5) |
Open
According to FEMA officials, as of May 2023, FEMA's PA Division and the Procurement Disaster Assistance Team (PDAT) had received the Fraud and Internal Investigation Division's fraud risk profile for PA debris removal and were working to update program-specific antifraud training and guidance materials for PA staff who work directly with PA applicants. Specifically, according to FEMA officials, the PA Division and PDAT planned to update these resources with information on the highest fraud risks to PA debris removal identified in the risk profile by June 2023 and September 2023, respectively. In addition, according to FEMA officials, the PA Division and PDAT planned to update program-specific antifraud training and guidance materials with information on the highest fraud risks to PA emergency protective measures in Spring 2024, after the Fraud and Internal Investigations Division completed its review of PA emergency work. We will continue to monitor FEMA's progress in this area.
|