Disaster Assistance: FEMA Should Take Additional Actions to Strengthen Fraud Risk Management for Public Assistance Emergency Work Grants
The Federal Emergency Management Agency provided almost $10 billion through its Public Assistance grant program to states and territories for debris removal and other emergency work projects following the hurricanes and wildfires in 2017.
FEMA knew about some of the fraud risks to the program, such as overstated claims for debris removal and kickbacks. But there are several leading practices for fraud risk assessments that could help FEMA identify even more risks and mitigate them.
We made 5 recommendations, including that FEMA assess fraud risks to this program and provide antifraud training to grant recipients and program staff.
Residential Debris from Hurricane Harvey in Texas in 2017
What GAO Found
The Federal Emergency Management Agency (FEMA) has identified some risks to Public Assistance (PA) emergency work grants—funds provided to applicants such as states and territories—for debris removal and other emergency measures. FEMA also has ongoing or planned efforts that could inform fraud risk assessments. However, the agency has not comprehensively assessed fraud risks to these grants as called for by leading practices in GAO's Fraud Risk Framework. Fraud risks include those from debris removal schemes—such as misrepresenting the amount, source, or type of items removed—or associated with procurement and contracting, such as bribery, collusion, and false invoicing. According to officials, FEMA manages fraud risks to PA emergency work grants through its existing grants-management and program-integrity efforts. However, absent regular fraud risk assessments, including identifying inherent fraud risks and examining the suitability of existing controls, FEMA lacks reasonable assurance that these efforts effectively address the most significant fraud risks facing PA emergency work grants.
Residential Debris Awaiting Pickup in Texas Following Historic Flooding Caused by Hurricane Harvey in 2017
FEMA provides resources to help PA applicants meet their responsibilities for managing risks, but opportunities exist for the agency to improve communication. Specifically, GAO found that FEMA communicated some information that could help applicants manage fraud risks, but key resources did not provide information on known areas of fraud risk. According to GAO's Fraud Risk Framework, a leading practice is to provide fraud-awareness training for external stakeholders—such as PA applicants—with responsibility for implementing aspects of the program. Further, a leading practice for implementing effective fraud-awareness initiatives is to convey information about risks and how to identify fraud schemes. According to FEMA officials, the agency generally does not use the term “fraud” because FEMA's focus is on ensuring compliance and eligibility. However, the deceptive nature of fraud makes it harder to detect than nonfraudulent errors, such as compliance and eligibility issues, and potentially requires control activities designed to prevent and detect criminal intent. Updating key resources for applicants to ensure these resources consistently communicate information on the highest fraud risks to emergency work grants would help ensure applicants are better able to identify and address potential fraud earlier in the process.
Why GAO Did This Study
FEMA has obligated over $10 billion in PA grants for emergency work to applicants in the three states and two territories recovering from hurricanes and wildfires in 2017. FEMA faces challenges balancing the need to quickly deliver disaster funds while minimizing the risk of fraud—challenges increased by the size and scope of the 2017 disasters and the complexity of the PA grant program. Fraud schemes have included false documentation for debris removal.
GAO was asked to review a range of disaster response and recovery issues following the 2017 disaster season. This report addresses the extent to which (1) FEMA's efforts to assess fraud risks to PA emergency work grants align with leading practices, and (2) FEMA helps ensure PA applicants are able to meet their responsibilities for managing fraud risks. GAO assessed FEMA's procedures against leading practices in the Fraud Risk Framework. GAO interviewed FEMA officials responsible for the PA grant program and its training and fraud risk management. GAO conducted site visits to California and Texas, selected partly for variation in disaster type, and interviewed selected PA applicants.
Recommendations
GAO makes five recommendations, including that FEMA plan and conduct fraud risk assessments of PA emergency work grants and that it consistently communicate information to PA applicants on the highest fraud risks. The Department of Homeland Security stated that it concurred with GAO's recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Federal Emergency Management Agency | The Administrator of FEMA should plan and conduct regular fraud risk assessments of PA emergency work grants to determine a fraud risk profile that aligns with leading practices as provided in the Fraud Risk Framework. Specifically, this process should include (1) identifying inherent fraud risks to PA grant funds, (2) assessing the likelihood and impact of inherent fraud risks, (3) determining fraud risk tolerance, (4) examining the suitability of existing fraud controls, and (5) documenting the fraud risk profile. (Recommendation 1) |
According to FEMA officials, the program review branch of FEMA's Fraud and Internal Investigations Division completed its review of PA debris removal in September 2022. In addition, according to FEMA officials, the Fraud and Internal Investigations Division completed a preliminary assessment of PA emergency protective measures in September 2022, with an estimated completion date for the review of June 2023. We will continue to monitor FEMA's progress in this area.
|
| Federal Emergency Management Agency |
Priority Rec.
The Administrator of FEMA should designate one entity as the lead entity with responsibility for providing oversight of agency-wide efforts to manage fraud risks to PA emergency work grants, including managing the fraud risk assessment process, consistent with leading practices. (Recommendation 2) |
In its comments on the draft report, DHS concurred and noted that FEMA has taken a multi-directorate approach to proactively address fraud risk within the PA program. Specifically, DHS noted that different FEMA entities have responsibilities for managing fraud risks and that FEMA believes combining these functions into one office would potentially cause conflicts of interest. DHS requested that we consider the recommendation implemented. In March 2022, we reiterated the leading practices from the Fraud Risk Framework regarding the designated antifraud entity. As of January 2023, FEMA maintains that its division of responsibilities in managing fraud risks is consistent with sound practices and combining these functions would violate best practices. We continue to believe that FEMA would benefit from designating responsibility to a dedicated entity for providing oversight of efforts to manage fraud risks.
|
| Federal Emergency Management Agency | The Administrator of FEMA should update key training and guidance documents for the PA grant program to include information on where and how to report suspected fraud, and direct PA recipients to include such information in key training and guidance documents they provide to subrecipients. (Recommendation 3) |
FEMA updated several, but not all, key training and guidance documents for the PA grant program to include information on where and how to report suspected fraud. For example, from late 2020 through spring 2021, FEMA added this information to its procurement trainings and website for PA applicants and to various other training materials, including internal and external webinars, on-demand videos, and a fact sheet on managing fraud risks. In addition, in its procurement trainings, FEMA encourages recipients to include information on reporting fraud in key training and guidance documents provided to subrecipients. Further, FEMA added language on where and how to report fraud to training guidance documents for PA staff. However, FEMA has not updated the Public Assistance Program and Policy Guide (PAPPG)--a key source of information on the PA grant program for applicants--to include this information. In January 2023, FEMA officials stated that FEMA plans to issue the newer version of the PAPPG by the end of 2023 and plans to include information on how and where to report suspected fraud in that version of the guide.
|
| Federal Emergency Management Agency | The Administrator of FEMA should update key resources, such as training and guidance documents, FEMA makes available to PA applicants to ensure these resources consistently communicate information on the highest fraud risks to PA emergency work grant funds and applicants' responsibilities for managing those risks. The highest fraud risks may include risks related to procurement and debris removal, and other risks FEMA identifies through fraud risk assessments. (Recommendation 4) |
According to FEMA officials, as of January 2023, FEMA's PA Division and the Procurement Disaster Assistance Team (PDAT) had received the Fraud and Internal Investigation Division's fraud risk profile for PA debris removal and were working to update program-specific antifraud training and guidance materials for PA applicants. Specifically, according to FEMA officials, the PA Division and PDAT planned to update these resources with information on the highest fraud risks to PA debris removal identified in the risk profile by June 2023 and September 2023, respectively. In addition, according to FEMA officials, the PA Division and PDAT planned to update program-specific antifraud training and guidance materials with information on the highest fraud risks to PA emergency protective measures in Spring 2024, after the Fraud and Internal Investigations Division completed its review of PA emergency work. We will continue to monitor FEMA's progress in this area.
|
| Federal Emergency Management Agency | The Administrator of FEMA should implement program-specific antifraud training for PA staff who work directly with PA applicants; this training should include information on the highest fraud risks to PA emergency work grants. The highest fraud risks may include risks related to procurement and debris removal, and other risks FEMA identifies through fraud risk assessments. (Recommendation 5) |
According to FEMA officials, as of January 2023, FEMA's PA Division and the Procurement Disaster Assistance Team (PDAT) had received the Fraud and Internal Investigation Division's fraud risk profile for PA debris removal and were working to update program-specific antifraud training and guidance materials for PA staff who work directly with PA applicants. Specifically, according to FEMA officials, the PA Division and PDAT planned to update these resources with information on the highest fraud risks to PA debris removal identified in the risk profile by June 2023 and September 2023, respectively. In addition, according to FEMA officials, the PA Division and PDAT planned to update program-specific antifraud training and guidance materials with information on the highest fraud risks to PA emergency protective measures in Spring 2024, after the Fraud and Internal Investigations Division completed its review of PA emergency work. We will continue to monitor FEMA's progress in this area.
|