The New York City Department of Social Services Should Enhance Its Fraud Risk Management Practices (January 6, 2026)
Summary
Audit report 2026-LA-1001 of the Office of Inspector General, U.S. Department of Housing and Urban Development, dated January 6, 2026, evaluating the fraud risk management practices of the New York City Department of Social Services (DSS) for its ESG CARES Act funded activities. The audit found that DSS had several antifraud activities but had not developed a comprehensive and formal fraud risk management framework, and that its fraud risk management maturity was between the initial and operational levels. DSS was authorized more than $383 million in ESG CARES Act program funds, a 2,518 percent funding increase from its formula ESG allocation for fiscal year 2020. The report recommends that DSS evaluate and enhance its fraud risk management activities and obtain training or technical assistance.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“The New York City Department of Social Services Should Enhance Its Fraud Risk Management Practices (January 6, 2026).”
Original at www.oversight.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2026-01-06-the-new-york-city-department-of-social-services-should-enha-3d35e896ee/
, SHA-256 6d12d3ddf95238d08abb68aba97de79e574bc05677e0e0ab6c8a455c815b1610.Full text
The New York City Department of
Social Services Should Enhance
Its Fraud Risk Management
Practices for its ESG CARES Act
Funding
Audit Report Number: 2026-LA-1001
January 6, 2026
Office of Audit and Evaluation | Office of Inspector General
U.S. Department of Housing and Urban Development
Highlights
New York City Department of Social Services Should Enhance Its Fraud
Risk Management Practices for Its ESG CARES Act Funding | 2026-LA-
1001
What We Audited and Why
We audited New York City (NYC) Department of Social Services (DSS) with the objective of evaluating DSS’
fraud risk management practices for its Emergency Solutions Grants Coronavirus Aid, Relief, and Economic
Security Act (ESG CARES Act) funded activities and assessed the maturity of its efforts to prevent, detect,
and respond to fraud. Fraud within activities funded by the ESG CARES Act can lead to significant financial
losses, reputational damage to the grantee and the United States Department of Housing and Urban
Development (HUD), breach of fiduciary duty, and most importantly, loss of funding assistance for
individuals and families who are homeless or receiving homeless assistance or other homelessness
prevention activities. A robust antifraud program will help ensure that pandemic grant funds, as well as
grant funds allocated through annual appropriations, are put toward their intended uses, and that funds
are spent effectively, and assets are safeguarded.
Congress provided $4 billion for the ESG CARES Act program, which represented a 1,379 percent increase
to the regular 2020 annual ESG appropriation. Given the influx of funding, we initiated a series of audits
examining ESG CARES Act grantees’ fraud risk management practices and evaluated whether selected ESG
CARES Act grantees were adequately prepared to prevent, detect, and respond to fraud. The DSS was
selected because it was authorized more than $383 million in ESG CARES Act program funds, a 2,518
percent funding increase from its formula ESG allocation for fiscal year 2020.
What We Found
New York City Department of Social Services can improve its fraud risk management practices for ESG
CARES Act funded activities. We found that DSS did have several antifraud activities that could be
expanded to include ESG CARES Act funded activities; however, it had not developed a comprehensive and
formal fraud risk management framework to include a complete fraud risk assessment, development of a
fraud risk profile, an antifraud strategy, and establishment of a monitoring and evaluation process to
assess the effectiveness of its antifraud activities. Based on the Chief Financial Officers Council’s Antifraud
Playbook, we determined that DSS’ fraud risk management maturity, as it related to its ESG CARES Act
funds, was between the initial and operational maturity levels, which is lower than the goal state for
organizations who have high fraud exposure. This occurred because DSS believed its fraud risk
management practices generally followed the GAO’s Framework, that these practices were embedded into
its existing policies and procedures, and were sufficient.
HUD relies on its grantees to implement fraud risk activities and antifraud controls to protect the funding
provided to carry out its programs. Without maturing its fraud risk management practices, DSS cannot
effectively protect the $383 million of HUD’s ESG CARES Act and ESG annual funding against fraud risks. If
DSS were to incorporate best practices, it could achieve a higher maturity level which would better protect
the funds used to provide critical assistance that vulnerable beneficiaries rely on as well as protect against
negative effects that fraud can have on an agency.
What We Recommend
We recommend that the Director of HUD’s New York City Office of Community Planning and Development
require DSS to (1) evaluate and enhance its fraud risk management activities by incorporating fraud risk
management practices, and (2) obtain training or technical assistance on the implementation of fraud risk
management practices.
Table of Contents
Background and Objectives ...................................................................................... 1
Results of Audit ............................................................................................................. 5
New York City Department of Social Services Should Enhance Its Fraud Risk Management Practices ... 5
Scope and Methodology ............................................................................................. 17
Appendixes ..................................................................................................................... 18
Appendix A – Management Response .................................................................................................... 18
Background and Objectives
On March 11, 2020, the World Health Organization characterized the outbreak of the coronavirus disease
2019 (COVID-19) as a pandemic. In response, Congress provided $4 billion in the Coronavirus Aid, Relief,
and Economic Security Act (CARES Act) for the Emergency Solutions Grants (ESG) program to use to
“prevent, prepare for, and respond to coronavirus, among individuals and families who are homeless or
receiving homeless assistance and to support additional homeless assistance and homelessness
prevention activities to mitigate the impacts created by coronavirus” in two rounds of funding, as follows:
• Round 1: $1 billion allocated under the ESG formula to grant recipients.
• Round 2: $2.96 billion allocated under a formula targeted towards communities with a high
incidence of sheltered and unsheltered homeless and those at most risk for homelessness.
The U.S. Department of Housing and Urban Development (HUD) moved quickly to make COVID-19 relief
funding available to communities across the nation. The CARES Act provided additional funding for
annual ESG grantees. In October 2020, HUD awarded the City of New York $383,410,970 in ESG CARES
Act funds (see Table 1). In 2020, DSS received its annual ESG funding of $14 million so the ESG CARES Act
funding was a 2,518 percent increase from its usual ESG allocation. DSS continues to receive an annual
ESG grant allocation of $14 million.
Table 1: Funding allocated to DSS between 2020 and 2022 (as of April 5, 2024)
ESG CARES Act
Allocation Total disbursed Balance expenditure
Allocation Contract date
amount deadline
ESG CARES November 6, September 30,
$50,507,036 $50,507,306 -
Act1 2020 2023
ESG CARES November 6, September 30,
331,859,870 331,859,870 -
Act2 2020 2023
ESG CARES Act September 21, -
1,044,064 1,044,064 June 30, 2024
Reallocation 2022
Total ESG
383,410,970 383,410,970 -
CARES Act
New York City Department of Social Services
The Department of Social Services (DSS) in New York City includes the Human Resources Administration
(HRA) and the Department of Homeless Services (DHS). The HRA assists vulnerable New Yorkers through
the administration of more than 12 programs. DHS implements programs and projects designed to
address the needs of persons who are experiencing homelessness, such as shelters and street outreach.
DSS uses multiple streams of funding to operate these programs and projects including ESG CARES Act
funds. DSS includes functions for audit and quality assurance, compliance, contracting, finance, and an
Accountability Office (AO). The AO supports the integrity of social service programs administered by DSS
Office of Audit and Evaluation | Office of Inspector General Page | 1
by ensuring DSS complies with statutory, regulatory, and contractual standards. These specialized
functions work together within DSS to administer ESG CARES Act funds.
Fraud Risk Management
Fraud risk is the vulnerability within an entity’s processes and controls that could be exploited to obtain
something of value through willful misrepresentation. Fraud risk management helps ensure program
integrity by continuously and strategically mitigating both the likelihood and effects of fraud. When fraud
risks can be identified and mitigated, fraud may be less likely to occur. Although the occurrence of fraud
indicates there is a fraud risk, a fraud risk can exist even if actual fraud has not yet occurred or been
identified. A fraud risk management framework can assist agencies in accomplishing these goals.
The COVID-19 pandemic significantly changed the operating landscape of Federal, State, and local
governments. The substantial increase in funding (more than 2,500 percent for DSS) associated with the
CARES Act funds also increased opportunities for fraud. Therefore, agencies must proactively react in
kind through improving or revamping their processes and overall governance structure to keep pace.
Building, designing, and implementing a robust fraud risk management framework will aid in mitigating
risks and decreasing the likelihood of fraud. Effectively managing fraud risk helps to ensure that grant
funds are put toward their intended uses, funds are spent effectively, and assets are safeguarded.
Fraud risk management practices are applicable not only to CARES Act funds, but should also be practiced
portfolio-wide since grantees use Federal funds from HUD as well as other Federal agencies.
Implementing these practices will put grantees’ fraud risk management in a better position for
unforeseen future events.
The U.S. Chief Financial Officers Council and the U.S. Department of the Treasury developed Program
Integrity: The Antifraud Playbook in October 2018 for use by the entire financial management
community, including Federal, State, and local agencies. The Playbook contains a maturity model
designed to help agencies assess and identify the current state and goal state of their antifraud program
and related efforts. The maturity model includes four progressive levels of fraud risk maturity, which are
defined below from the lowest level to the highest desired goal state.
Ad hoc – Fraud risk management processes are disorganized, even chaotic, and antifraud
efforts are undocumented and in a state of dynamic change, tending to be driven in an ad hoc,
uncontrolled, and reactive manner. This is not a goal state for agencies with fraud exposure.
Initial – The agency is aware of the need for a more formal fraud risk management approach,
and repeatable processes have been developed. Risks are still managed largely in a reactive
way.
Operational – Fraud risk management activities across the organization are aligned with
controls, and information on fraud risks is aggregated and analyzed and is easily available to
the necessary individuals. The goal state for agencies with low fraud risk exposure is an initial
to operational maturity level.
Leadership – The agency’s focus is on continually improving fraud risk management through
both incremental and innovative changes or improvements. Risks are managed largely in a
Office of Audit and Evaluation | Office of Inspector General Page | 2
proactive way. The goal state for agencies with high fraud exposure is an operational to
leadership maturity level.
Further, the Playbook organizes fraud risk management into four phases: (1) create a culture, (2) identify
and assess, (3) prevent and detect, and (4) insight into action.
According to the Committee of Sponsoring Organizations’ (COSO) Internal Control-Integrated
Framework, 1 assessing the risk of fraud is one of many principles for establishing an effective internal
control system. In addition, due to the importance of this principle, COSO published a fraud risk
management guide with the intention to support organizations in following this principle. The U.S.
Government Accountability Office (GAO) and COSO make it clear that for a system of internal control to
be effective, each of the principles, including “assessing the risk of fraud,” must be present, functioning,
and operating together in an integrated manner.
GAO’s Framework states, “[f]raud poses a significant risk to the integrity of federal programs and erodes
public trust in government.” The primary audience of the Framework is managers in the U.S. Federal
Government, but the leading practices and concepts described in the Framework may also be applicable
to State and local government agencies, as well as nonprofits that are responsible for fraud risk
management. The Framework encompasses control activities to prevent, detect, and respond to fraud
and divides them into four components – (1) commit, (2) assess, (3) design and implement, and (4)
evaluate and adapt – for effectively managing fraud risks.
HUD Fraud Risk Management
HUD is responsible for designing its programs such that there are sufficient controls to support robust
fraud risk management practices. The Payment Integrity Information Act of 2019 and implementing
guidance from OMB require HUD to establish financial and administrative controls to identify and assess
fraud risks. Office of Management and Budget (OMB) Circular A-123 specifically requires that
departments like HUD incorporate leading practices from GAO’s Green Book as well as the Fraud Risk
Framework. In turn, HUD policy implementing OMB A-123 guidance says that HUD managers have the
responsibility to design, implement, and operate processes with embedded internal controls that mitigate
the risk of fraud, waste, and abuse in HUD programs. It also says that to determine the effectiveness of
fraud risk management activities, HUD program and support managers will “routinely evaluate existing
fraud risk controls.”
Our October 2021 audit report, 2 “Fraud Risk Inventory for the CDBG and ESG CARES Act Funds,” noted
several opportunities for HUD to improve its fraud risk management practices in its ESG CARES Act
program. The report noted that HUD’s Office of Community Planning and Development (CPD) did have
controls that could detect fraud, such as monitoring reviews, but that they could be improved through
the implementation of a fraud risk checklist or other instrument during CPD’s monitoring activities. Many
1
According to 2 CFR (Code of Federal Regulations) 200.303, the non-Federal entity must establish and maintain
effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity
is managing the Federal award in compliance with Federal statutes, regulations, and terms and conditions of the
Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in
the Federal Government, issued by the Comptroller General of the United States, or the Internal Control
Integrated Framework, issued by COSO.
2
2022-FO-0801, Fraud Risk Inventory for CDBG and ESG CARES Act Funds, October 12, 2021
Office of Audit and Evaluation | Office of Inspector General Page | 3
of the fraud schemes discussed in the report include risks that are external to HUD, meaning they occur
at the grantee or subrecipient level that received HUD’s ESG CARES Act funds. Importantly, as stated in
the audit report, HUD expects its grantees to be proactive in the identification and remediation of fraud
risk, and that the responsibility for assessment and mitigation of fraud risk rested primarily with grantees.
DSS’ Fraud Risk Management
In May 2019, the City of New York’s Office of the Comptroller issued Directive #1: Principles of Internal
Control, which states that Directive #1 is consistent with the internal control framework adopted by COSO
in its Internal Control Integrated Framework. Portions relevant to our objective are 4.1 Control
Environment, 4.2 Risk Assessment, and 4.3 Control Activities.
Section 4.1, Control Environment, discusses the importance of an atmosphere of teamwork, integrity, and
ethical values and that staff should be trained to gain the knowledge and skills required for assignments.
Finally, it states that a “good internal control environment requires that the agency's organizational
structure clearly defines key areas of authority and responsibility and establishes appropriate lines of
reporting. The appointment of competent and respected staff management is vital as well as is proper
assigned management span of control with clearly defined lines of authority and responsibility.”
Section 4.2, Risk Assessment, describes the importance of this assessment and what is included;
specifically, that managers “comprehensively identify risks” and the “structuring of a plan to determine
how [identified] risks would be managed.”
Section 4.3, Control Activities, describes these activities as including policies and procedures but adds that
they should exist at all levels of an agency. It further states that these include “the creation and
maintenance of related records that provide evidence of the execution of these activities.”
Our objective was to assess New York City’s fraud risk management framework for its ESG CARES Act
program, which encompasses control activities to prevent, detect, and respond to fraud.
Office of Audit and Evaluation | Office of Inspector General Page | 4
Results of Audit
New York City Department of Social Services Should Enhance Its Fraud
Risk Management Practices
DSS’ fraud risk management practices should be enhanced to adequately prevent, detect, and respond to
fraud risks for its Emergency Solutions Grants CARES Act (ESG CARES Act) and annual ESG funds. DSS had
established a dedicated antifraud component and implemented several specific fraud controls and
activities but should include additional key best practices from the GAO’s Framework for Managing Fraud
Risks in Federal Programs and the Chief Financial Officers Council’s Antifraud Playbook that are necessary
to have an integrated fraud risk management framework. Specifically, DSS did not have a comprehensive
and formalized fraud risk assessment process, a response plan, and mechanisms in place to monitor and
evaluate the effectiveness of its fraud risk management activities as it related to ESG CARES Act funding.
Based on this deficiency, we determined that DSS’ overall fraud risk management maturity level was
between initial and operational. DSS did not consider it necessary to enhance its fraud risk management
activities or to implement a formalized fraud risk management program for its administration of ESG
CARES Act funds because it believed its fraud risk management practices generally followed the
Framework, were embedded into its policies and procedures, and were sufficient. However, not
completing these key best practices including consideration of ESG CARES Act funding fraud risks puts
these funds, and its annual ESG funding, at risk. Specifically, $383 million of HUD’s ESG CARES Act funds
were at an increased risk due to fraud, and DSS was not positioned to understand how to best improve its
fraud risk activities to detect fraud or potential fraud for activities funded with its ESG and ESG CARES Act
grants.
DSS Has Opportunities To Improve Its Fraud Risk Management Practices
and Antifraud Efforts
We assessed DSS’ fraud risk management practices for funds it was awarded under the ESG CARES Act
using the Antifraud Playbook’s Program Maturity Model, which organizes fraud risk management into
four phases: (1) create a culture, (2) identify and assess, (3) prevent and detect, and (4) insight into
action. 3 We determined that DSS’ overall fraud risk management practices were between the initial and
operational maturity levels and that there were opportunities to improve its antifraud efforts to better
identify and protect against fraud. Using the maturity model, we found that DSS has fraud risk control
practices and repeatable processes but it largely manages risks reactively and does not have an explicit,
formal fraud risk management framework to regularly identify, manage, and mitigate fraud risks,
particularly as it relates to ESG CARES Act funding. Further, based on DSS’ organization size, complexity,
number and size of issued payments, subrecipients, and contractors, along with the risk of improper
payment identified by HUD in the annual ESG program, 4 we determined that DSS had a high fraud
exposure. This means there is an elevated risk of experiencing fraudulent activity, for which the Antifraud
Playbook recommends a goal maturity level of operational or leadership. With high fraud exposure, in
order to achieve the highest maturity level DSS would need to follow the antifraud best practices as
3
The Chief Financial Officers Council’s and the U.S. Department of the Treasury’s Bureau of the Fiscal Service’s
Antifraud Playbook identifies 16 leading practices for effective fraud risk management, organized into 4 phases
of action. The results of our audit are aligned to match the Antifraud Playbook’s four-phased approach.
4
ESG is a formula grant. Eligible recipients generally consist of metropolitan cities, urban counties, territories, and
states.
Office of Audit and Evaluation | Office of Inspector General Page | 5
published by organizations such as GAO5 and COSO. 6 For example, agencies with high fraud exposure
need to provide fraud training to all staff, formalize and document a process to ensure that fraud risks
affecting the agency and the Federally funded programs it operates are regularly assessed, and establish
monitoring or other activities to determine the effectiveness of its fraud risk management controls.
The Green Book and COSO internal control frameworks both include principles to consider the potential
for fraud when assessing risks. The City of New York Office of the Comptroller’s Directive #1 states that it
is consistent with the internal control framework adopted by COSO in its Internal Control Integrated
Framework. Assessing the risk of fraud is a principle for establishing an effective internal control system.
GAO and COSO make it clear that for a system of internal control to be effective, each of the principles
must be present, functioning, and operating together in an integrated manner. If a principle or
component is not effective or the components are not operating together in an integrated manner, an
internal control system cannot be effective.
While DSS had implemented various fraud risk management activities, if DSS were to incorporate
additional measures and best practices, its ability to prevent and detect fraud would be improved and
position the organization to better understand program-specific risks, design corresponding controls to
prevent those risks, and evaluate their effectiveness to determine whether mitigation or enhancement
are needed. This would better protect the funds used to provide critical assistance that vulnerable
beneficiaries rely on as well as protect against negative effects that fraud can have on an agency.
Phase 1 – create a culture maturity level (operational): DSS created a fraud-aware culture and has a lead
antifraud entity to manage fraud risk activities.
The Antifraud Playbook encourages agencies to develop a fraud-aware culture and build a structure to
manage fraud risks. The Framework also encourages management to create a structure with a dedicated
entity to lead fraud risk activities. The antifraud entity serves as the repository of knowledge on fraud
risks and controls, manages fraud risk-assessment processes, leads or assists with training and other fraud
awareness activities, and coordinates antifraud initiatives across the program.
We assessed DSS’ fraud-aware culture to be at the operational maturity level, which means that its fraud
risk management activities across the organization were aligned with its controls and information on
fraud risk impacting DSS could be analyzed and was available for review. DSS’ current antifraud activities
and areas for improvement are listed in Figure 1.
5
To help managers combat fraud and preserve integrity in government agencies and programs, GAO identified
leading practices for managing fraud risks and organized them into a conceptual framework called the Fraud Risk
Management Framework.
6
COSO partnered with the Association of Certified Fraud Examiners in 2016 to update the Fraud Risk
Management Guide. The joint report is designed to aid organizations in effectively establishing an overall fraud
risk management program.
Office of Audit and Evaluation | Office of Inspector General Page | 6
Figure 1: Create a Culture
Current Antifraud Activities Areas for Improvement
The DSS Accountability Office (AO) is the lead Hold regular, recurring fraud discussions and
antifraud entity. coordination with the Department of Investigation.
DSS has antifraud and fraud awareness training. Provide fraud awareness training to all staff within
the organization, not just those whose job
descriptions directly relate to fraud.
DSS has a lead antifraud entity, its AO, managed by its chief accountability officer (CAO). The CAO reports
directly to the DSS first deputy commissioner and is a member of the DSS Executive Team. The AO
consists of staff that includes fraud investigators, data analysts, contract monitors, and auditors. The AO
oversees antifraud policy, while each of DSS’ programs provide programmatic expertise. Within the AO
organization is Compliance. Compliance serves as the repository of knowledge for fraud risks and
controls and manages the fraud risk assessment process.
DSS had antifraud and fraud awareness training, but this training was only provided to staff whose job
descriptions directly related to fraud, such as staff in the Bureau of Fraud Investigation and welfare fraud
investigators. These units primarily focus on client fraud and did not include staff that perform day-to-
day activities in the administration of programs that used ESG CARES Act funds.
There was no specific fraud training for employees directly involved in ESG CARES Act-funded activities;
however, DSS had other fraud risk-related activities. These activities included an anti-fraud awareness
lecture given to some staff in February 2020 by NYC’s Department of Investigation (DOI), an employee
code of conduct signed during on-boarding, and a policy bulletin 7 on reporting suspected fraud and
employee noncompliance and misconduct. For DSS to bring its fraud risk maturity to the highest level,
leadership, it would take steps such as extending fraud training to most of its staff that are involved in the
day-to-day operations of its programs (regardless of their role). In addition, it could have regular and
recurring fraud discussions and coordination with the New York City Department of Investigation (DOI) to
identify known risks or fraud schemes that are occurring in the programs that are funded by ESG CARES
Act or other Federal government programs.
Phase 2 – identify and assess maturity level (initial): DSS’ risk assessment process did not occur at regular
intervals and was not comprehensive.
During phase 2, the focus is on identifying and assessing fraud risks. Through a fraud risk assessment, the
agency identifies its vulnerabilities to fraud, the fraud risks and schemes it is susceptible to, analyzes their
likelihood and potential impact, and prioritizes the fraud risks. Importantly, in this phase the agency also
establishes a plan for conducting a comprehensive, repeatable fraud risk assessment customized to the
agency's needs allowing for expansion as efforts progress. GAO’s Framework states that agencies with
effective antifraud practices (1) identify specific tools, methods, and sources for gathering information
about fraud risks in planning for their fraud risk assessments, (2) include stakeholders responsible for the
design and implementation of the agency’s fraud controls in the planning of fraud risk assessments or
7
DSS Policy Bulletin 2017-05
Office of Audit and Evaluation | Office of Inspector General Page | 7
those with knowledge about emerging fraud risks or responsibilities for specific control activities, and (3)
aim to thoroughly evaluate the unique fraud risks encountered by their agency or program, to include the
likelihood and impact of fraud schemes, and then document a prioritization of fraud risks.
Figure 2: Identify and Assess
Current Antifraud Activities Areas for Improvement
DSS conducted fraud risk assessments at variable Conduct risk assessments at regular intervals or
intervals and identified some fraud risks. when there are changes to the activities and include
activity-specific fraud risks.
DSS performed some assessments of identified risks. Fully document the risk assessment process,
consistently assess risks’ likelihood and impact,
determine fraud risk tolerance and prioritize
residual fraud risks.
DSS has several tools, methods, and sources Consider information from these sources during
available for gathering information about fraud risk. DSS’ fraud risk assessment process.
Our assessment of DSS’ maturity within this phase was at the initial maturity level. This means that the
agency was aware of the need for a more formal fraud risk management approach and repeatable
processes were developed and in place. However, fraud risks were still managed largely in a reactive
way.
DSS believed its fraud risk management practices generally followed the Framework, and had existing
fraud prevention activities embedded into its processes for the multiple funding sources that support its
activities that were sufficient. DSS explained that it had not “create[ed] separate, ad hoc, [frameworks or
risk assessments] for each of its individual funding streams.” DSS further explained that “DSS manages a
budget of $15 billion annually, including approximately 15 ongoing major [F]ederal and state revenue
funding streams as well as multiple competitive [F]ederal grants. Further, even conservatively, the HUD
ESG CARES Act represent[ed] approximately one percent of the annual DSS budget.” Therefore, it did not
consider it necessary to implement a formalized fraud risk management framework. While it may be
efficient to have antifraud controls that cover a multitude of activities, an agency should conduct an
assessment at a program level to make sure those controls address the specific fraud risks identified in
specific programs.
The City of New York Office of the Comptroller’s Directive #1 states that it is consistent with the internal
control framework adopted by COSO in its Internal Control Integrated Framework. Assessing the risk of
fraud is a principle for establishing an effective internal control system based on the COSO framework.
Therefore, by not performing a comprehensive fraud risk assessment, DSS is not fully implementing the
provisions of the fraud risk assessment principle. COSO makes it clear that for a system of internal
control to be effective, each of the principles must be present, functioning, and operating together in an
integrated manner. If a principle or component is not effective or the components are not operating
together in an integrated manner, an internal control system cannot be effective.
Office of Audit and Evaluation | Office of Inspector General Page | 8
DSS Conducted Fraud Risk Assessments but Not at Regular Intervals
GAO’s Framework states that effective antifraud organizations conduct fraud risk assessments at regular
intervals and when there are changes to the program or operating environment. While DSS did conduct
fraud risk assessments, they were not conducted at regular intervals or when there were significant
changes that could impact its programs’ activities; for example, the massive influx of ESG CARES Act
funds. DSS stated that the risk assessment process should occur every 2 years; however, HRA’s most
recent fraud risk assessments were in 2019 and 2023, while DHS’ most recent were in 2019 and 2022.
There was no assessment done in 2020 in response to HUD awarding DSS more than $380 million in ESG
CARES Act funding. As this was an increase of 2,518 percent over DSS’ annual ESG award, the GAO
Framework would have DSS assess fraud risks for activities that received this sudden funding influx. DSS
acknowledged that it wanted to update its fraud risk assessments more frequently and stated that it
planned to start a process that would include fraud risk assessment meetings with each program area
quarterly or at least twice each year. Generally, the more time that elapses between fraud risk
assessments increases the possibility that the agency will not identify new or emerging risks or gaps in
control activities. Although the Framework acknowledges that timing may vary, it states that effective
antifraud agencies plan assessments at regular intervals and when there are changes to their programs or
operating environment.
DSS’ Fraud Risk Assessments Did Not Identify Common Fraud Risks and Schemes
DSS identified its fraud risks in its risk assessments, but its identification of fraud risks and schemes did
not include many common ones that exist for any Federal grant program. Our audit report 8 identified 31
specific fraud risks and schemes for HUD’s ESG CARES Act program alone that HUD had not previously
identified. Some common fraud risks and schemes that were omitted from DSS’ risk assessments
included ghost beneficiaries, fictitious, overstated expenses, and bribery and kickbacks. These fraud risks
and schemes are universal to any agency managing a Federal grant program such as the ESG CARES Act.
DSS did not identify ESG CARES Act specific fraud risks because it used this funding along with other
funding sources to operate its homeless service activities and viewed the ESG CARES Act funds as a
funding source rather than a program. Further, DSS was not able to tell us or show us clear
documentation as to which of its specific programs were ESG CARES Act-funded so we were not able to
determine which or how many of the fraud risks DSS identified were related to programs that used ESG
CARES Act funds.
DSS Did Not Consistently Assess Identified Fraud Risk
Although DSS did not identify common fraud risks and schemes for its activities in its risk assessments, it
did perform some assessments of risks that it did identify. However, it did not consistently assess the
likelihood and impact of those risks, determine its fraud risk tolerance, examine the suitability of its
controls, or prioritize residual fraud risks in the HRA and DHS risk assessments. The HRA risk assessment
did (1) assess the likelihood and impact of its identified risks, (2) quantify its fraud risk tolerance, and (3)
prioritize its identified fraud risks’ likelihood, impact, and risk tolerance. The DHS risk assessment did not
(1) assess the likelihood and impact of its identified fraud risks, (2) quantify its fraud risk tolerance, or (3)
prioritize identified risks. Without assessing the likelihood and impact of identified fraud risks, DSS cannot
determine whether it had gaps in its controls that increase its fraud exposure.
8
2022-FO-0801, Fraud Risk Inventory for CDBG and ESG CARES Act Funds, October 12, 2021
Office of Audit and Evaluation | Office of Inspector General Page | 9
DSS Did Not Entirely Document Its Programs’ Fraud Risk Profiles
Fraud risk profiles are a summation of key findings and conclusions from the fraud risk assessment
process including analysis of the types of fraud risks, their perceived likelihood and impact, risk tolerance,
and the prioritization of fraud risks. We found that DSS had incomplete fraud risk profiles because it used
an underdeveloped risk assessment that failed to determine fraud risk tolerance and rank priority for
identified risks. This deficiency occurred because DSS lacked a fully documented risk assessment process,
including a lack of comprehensive risk identification procedures with documentation to be maintained
supporting the analysis performed. As a result, DSS was not fully informed of the most significant fraud
risks that impacted it and, therefore, could not develop an antifraud strategy to mitigate those risks. DSS
explained that it maintained a number of records and documents that documented its fraud risk
assessment process. Further, DSS said that it maintained working copies of risk assessments with updates
in a shared electronic folder as well as items meant to keep the risk assessment process going in the
future. However, without a complete fraud risk assessment process, DSS cannot create a complete fraud
risk profile that includes key risks affecting the agency. Our review of these records did not demonstrate
a complete and fully documented fraud risk profile. Complete fraud risk profiles play a crucial role in an
overarching antifraud strategy, guiding managers in designing and implementing specific control activities
that directly target and mitigate the most significant risks impacting the agency.
DSS Identified Its Tools, Methods, and Sources for Gathering Information About Fraud Risks
The GAO Framework states effective antifraud entities identify specific tools, methods, and sources for
gathering information about fraud risks in planning for their fraud risk assessments. This information
includes data on fraud schemes and trends from monitoring and detection activities. DSS could improve
its antifraud activities by using several tools, methods, and sources available to it for gathering
information about fraud risk related to its HRA and DHS programs, such as
• Data Analytics Reporting & Triage (DART) – DART used data matches and analytics to identify
waste, fraud, and abuse by detecting overpayments, ineligible clients and cases, and possible
fraud and abuse both by clients and vendors. DART continuously and regularly reviewed data to
identify possible instances of fraud schemes or trends by employees, clients, or vendors. DART
also managed a fraud reporting hotline.
• Vendor Management Committee (VMC) – The VMC met bi-weekly to discuss all things vendor
related and recurring issues, including potential fraud. Attendees included legal, finance,
program, audit, and compliance representatives. Meetings were led by the CAO or the
compliance and support deputy commissioner.
• Contracts Office Vendor Assessment Tool – This tool identified vendor risks that may warrant
further review. New vendors were entered into the tool for assessment. However, the Contracts
Office had not done a full top-down update of the tool and vendor entries since its development
in 2021.
DSS’ DART and VMC, combined with the Contracts Office’s vendor assessment tool, could provide
valuable information to be used in its fraud risk assessments. However, DSS did not use information from
these sources in its fraud risk assessment process.
Office of Audit and Evaluation | Office of Inspector General Page | 10
DSS Included Program Staff in Its Fraud Risk Assessment Process
The Framework also states that effective antifraud entities include those responsible for the design and
implementation of the programs’ fraud controls, the stakeholders, in the planning of fraud risk
assessments. DSS included individuals responsible for the design and implementation of its programs’
fraud controls in the risk assessment process. These individuals included a variety of internal
stakeholders from a total of 57 programs. DSS’ listing included its program offices and other offices, such
as legal, investigations, and information technology. DSS stated that of these 57 programs, 45 had input
to the HRA risk assessment, and 12 had input to the DHS risk assessment. DSS developed risk analysis
guidelines for HRA and DHS staff to use for risk identification and assessment in their respective areas.
These risks were then entered into the fraud risk assessments. However, DSS could not tell us which of
the 57 programs used ESG CARES Act funds. Without knowing which programs and activities used ESG
CARES Act funds, DSS could not ensure that all programs and activities using ESG CARES Act funds
provided input to the fraud risk assessments.
Phase 3 – prevent and detect maturity level (initial, nearing operational): DSS could strengthen its
response to fraud risks.
The Antifraud Playbook describes phase 3 as strengthening controls to mitigate fraud risks that were
identified and assessed during the previous phase. The fraud risk profile, with its key findings and
conclusions from assessment of fraud risks, provides the basis for deciding how the entity will address its
fraud risks; that is, its antifraud strategy. The Playbook adds that processes for financial reporting and
payment processing, as well as internal control functions, provide a foundation on which antifraud
activities may be built. In this phase, the strategy is communicated to employees and stakeholders, who
assist in its implementation.
The Framework adds that as part of the antifraud strategy, managers who effectively manage fraud risks
design and implement specific control activities – including data analytics activities, fraud-awareness
initiatives, reporting mechanisms, and employee-integrity activities – to prevent and detect potential
fraud.
Figure 3: Prevent and Detect
Current Antifraud Activities Areas for Improvement
Develop and implement an antifraud strategy and
DSS has internal controls 9 over its programs,
agencywide response plan to ensure controls
including controls that mitigate fraud risk.
adequately address risks.
DSS’ fraud controls are embedded within standard Evaluate existing controls to determine whether
significant risks are addressed and whether new risks
procedures.
and schemes are mitigated.
9
We did not assess the adequacy and effectiveness of DSS’ internal controls.
Office of Audit and Evaluation | Office of Inspector General Page | 11
Despite the gaps in the HRA and DHS risk assessments identified above, we assessed DSS’ maturity in this
phase at the initial, but nearing, the operational maturity level.
Since DSS did not have a comprehensive, regularly performed fraud risk assessment that included
consideration of activities funded by the ESG CARES Act and related fraud risks, it could not fully (1)
develop a fraud risk profile, (2) develop an antifraud strategy based on a complete fraud risk profile, (3)
design, implement, and link specific control activities to address the most significant fraud risks identified
in its fraud risk profile, and (4) develop a response plan to identify instances of potential fraud and
residual risks.
DSS stated that fraud controls were embedded within its standard procedures and that its antifraud
resources were allocated based on its understanding of its fraud risks. DSS had internal controls9 over its
programs and activities, including controls that mitigate fraud risks; however, without regularly
completing fraud risk assessments and a complete fraud risk profile, it could not determine whether
these controls addressed its most significant fraud risks or whether new fraud risks and schemes
impacting its programs and activities were mitigated by its controls. Additionally, without regularly
evaluating the existing controls against its most significant fraud risks, it could not identify any gaps in its
internal controls that needed to be addressed.
DSS did have specific control activities to prevent and detect fraud, such as
• DART – DART (discussed in phase 2) uses data analytics to identify fraud, waste, and abuse when it
occurs. Its data analytics functions could be expanded and maximized with predictive analytics, which
could identify known fraud attributes. For example, an analytic model could automatically reject a
payment when the existence of a number of known fraudulent characteristics was present.
Predictive analytics would generally stop payments rather than flagging transactions for investigation.
• Contract Office Vendor Assessment Tool (discussed in phase 2) – Through this tool, developed
specifically for human service providers, the would-be provider is assessed for certain fraud risk
factors. DSS uses this tool to assess each new vendor.
• Vendor responsibility determination - Before aligning itself with a new vendor, there is a review called
the vendor responsibility determination. This process involves searching for adverse information and
recent media articles, reports, and reviewing the most recent financial audit.
• Vendor Integrity Program – This program permits the DSS to continue contracts with companies that
might otherwise be precluded from doing business with the DSS because of integrity issues. Under
this program, such vendors may be awarded DSS contracts if they agree to monitoring, which is
reported to DOI, and if the vendor takes other steps to ensure that it has the requisite business
integrity.
• DHS Human Service Providers Fiscal Manual - This manual describes processes and procedures that
providers are expected to follow. It also includes sections on audits and examples of unallowable
expenses.
DSS had several methods of responding to identified instances of potential fraud. Potential client fraud is
referred to DSS’ Bureau of Fraud Investigation, potential employee fraud is referred to Special
Investigations Division, and potential vendor fraud is referred to the VMC (discussed in phase 2) and DOI
Office of Audit and Evaluation | Office of Inspector General Page | 12
with notices to the agency chief contracting officer and Contract Monitoring. Potential fraud identified by
DART is also referred to DOI. Findings of wrongdoing could lead to vendors being placed on corrective
action plans and monitoring by the Vendor Integrity Unit, while egregious cases are referred to the
District Attorney or other appropriate law enforcement agencies. DOI also issues policy and procedure
recommendations (PPRs) to improve processes and controls when it identifies vulnerabilities. DOI posts
these recommendations on a publicly available website.
Phase 4 – insight into action maturity level (initial): DSS did not comprehensively monitor and evaluate
the effectiveness of its fraud risk management framework and activities.
In phase 4, attention shifts to assessing the results of the fraud risk management activities conducted
during the prior two phases. This phase emphasizes devising strategies to address potential fraud
incidents and establishing mechanisms to monitor and evaluate the effectiveness of the fraud risk
management activities through outcome measurement.
The Antifraud Playbook encourages entities to prioritize potential incidents of fraud and fraud risks using
the insights gathered from phases 2 and 3 and to measure their outcomes. Measuring outcomes is a vital
step in effective and robust antifraud activities and can lead to significant return on investment. In
addition, the Playbook encourages repeated monitoring and periodic evaluations to provide insight into
the effectiveness of fraud risk management activities and help identify areas for improvement. Effective
management in this phase would involve managers’ monitoring and evaluating the effectiveness of
preventive activities, including fraud risk assessments, antifraud training, and analytics activities. Part of
this monitoring and evaluation process includes collecting and analyzing data from reporting
mechanisms, such as hotlines, and instances of detected fraud, through items such as the fraud risk
assessment, analytics activities, and Inspector General investigations.
GAO's Framework states that successful antifraud organizations assess outcomes using a risk-based
method and adjust activities to enhance fraud risk management. This process involves conducting risk-
based monitoring, evaluating activities, and measuring outcomes. Additionally, it includes gathering and
analyzing data from reports and detected fraud cases for ongoing monitoring of fraud trends. Finally,
organizations use monitoring, evaluations, and investigations' findings to enhance fraud prevention,
detection, and response efforts.
Figure 4: Insight Into Action
Current Antifraud Activities Areas for Improvement
VMC reviews results of monitoring, evaluation, and Develop and implement a formal process to monitor
and evaluate the effectiveness of fraud risk
corrective action plans.
management prevention and detection activities.
Develop a centralized listing of vendors with identified
Vendor Integrity Program monitors vendors with
integrity conflicts and identified fraud schemes along
integrity issues. with what the agency’s mitigating response was.
Office of Audit and Evaluation | Office of Inspector General Page | 13
Our assessment of DSS’ maturity within this phase was at the initial maturity level. The desired goal level
for agencies like DSS is leadership.
With fraud risk management practices that were not comprehensive and an incomplete fraud risk
assessment, DSS was not able to establish a formal monitoring and evaluation process to fully monitor or
evaluate the effectiveness of preventive activities, such as its fraud risk assessments, analytics activities,
and antifraud controls. DSS could not entirely monitor or evaluate processes which were not completely
designed or implemented. However, DSS did have the following fraud risk management activities in
place:
• The DOI had its policies, procedures, and recommendations process to formally recommend
improvements to strengthen DSS’ controls, including its fraud risk management. The
recommendations strengthened policy, procedural, and operational vulnerabilities identified
through DOI investigations and enhanced fraud prevention and detection.
• The Vendor Integrity Program described in phase 3 identified vendors to be monitored. Vendors
whose performance fell short of expectations could be placed on a corrective action plan and
monitored to determine progress toward meeting the terms of its contract.
• The VMC, described in phase 2, served as a forum to communicate the results of monitoring,
evaluation, and corrective action plans, and the VMC tracker documented these results.
Establishing a monitoring and evaluation process will identify the specific type of activities to be
implemented, define the scope and frequency for activities, and establish appropriate measurement
criteria. In addition, it will assist in evaluating the results of activities, remediating deficiencies identified
based on results and communicating the results to relevant stakeholders.
Office of Audit and Evaluation | Office of Inspector General Page | 14
Conclusion
The COVID-19 pandemic unintentionally exposed HUD, its grantees, and subrecipients to factors that
increased the risk of fraud to programs and activities that received ESG CARES Act funds. As the grantee,
DSS was responsible for ensuring that grant funds were used in accordance with the ESG CARES Act
requirements. Therefore, going forward it is prudent for DSS to incorporate fraud risk management
practices that proactively identify and respond to fraud risks and safeguard taxpayer funds. We
determined that DSS’ antifraud activities and controls were
between the initial and operational maturity levels. There
are opportunities for DSS to improve its fraud risk
management practices to prevent, detect, and respond to
fraud risks related to the ESG CARES Act and other Federally According to the Association of Certified
funded activities. While no antifraud program is completely Fraud Examiners: “One reason we can
foolproof, implementing a comprehensive antifraud program, likely expect more fraud to proliferate is the
including conducting regular fraud risk assessments,
massive changes in underlying fraud risks
documenting a fraud risk profile, establishing an antifraud
that have arisen since the onset of the
strategy, and establishing a monitoring program, is a
pandemic…business leaders need to treat
proactive way to make fraud less likely to occur. Even though
these changes as more than temporary and
DSS is now operating in a postpandemic environment, DSS’ incorporate them into their risk
management of fraud risks will improve if it develops a assessments and anti-fraud plans.”
comprehensive, formal, and regularly implemented fraud risk
management framework that aligns with best practices.
These actions will better protect the more than $383 million
of ESG CARES Act, DSS’ ESG annual grant, as well as other
Federal funds from fraud.
Recommendations
We recommend that the Director of HUD’s New York City Office of Community Planning and
Development require DSS to
1A. Evaluate and enhance its fraud risk management activities by incorporating fraud risk
management practices that are in alignment with the best practices identified in GAO’s A
Framework for Managing Fraud Risks in Federal Programs and Chief Financial Officers Council’s
Antifraud Playbook.
1B. Obtain training or technical assistance on the implementation of fraud risk management practices
consistent with the Internal Control Integrated Framework, issued by COSO.
Office of Audit and Evaluation | Office of Inspector General Page | 15
Management Response
DSS partially agreed with our first recommendation and believed our recommendations could help
improve its fraud risk mitigation strategies.
However, DSS disagreed with some of our assessment of its fraud prevention strategy and stated that our
report did not fully account for the nature of its anti-fraud efforts.
DSS stated that its fraud risk management activities were in alignment with the best practices identified in
GAO’s A Framework for Managing Fraud Risks in Federal Programs and the Chief Financial Officers
Council’s Antifraud Playbook, and that its compliance and fraud prevention framework were strong and
incorporated the Playbook’s components most relevant to their work.
DSS also believed that its activities demonstrated an established and forward-thinking approach to
managing fraud risk.
DSS will continue to improve its fraud risk management with a concentration on policies and training and
continue to focus on improving its compliance culture through education. It will also explore inclusion of
ESG-specific analysis into its risk assessment, increase the risk assessment’s frequency, its documentation,
and more formally capture risk remediation efforts.
DSS agreed with our second recommendation and have contacted COSO to obtain training on
implementation of fraud risk management practices.
Management’s response included a corrective action plan; their full comments are in Appendix A.
OIG Evaluation of Management Response
Management’s Responses were generally responsive to our recommendations. We have no changes to
our report.
DSS provided an action plan with its response but we did not include it in the report because it was
voluminous and contained sensitive information. We generally agree with DSS’ proposed corrective
action plan, but did not review or confirm that these actions address our recommendations. While DSS
believes its fraud risk management activities were in alignment with the best practices identified in GAO’s
A Framework for Managing Fraud Risks in Federal Programs and the Chief Financial Officers Council’s
Antifraud Playbook, we believe DSS can improve. Specifically, it can expand its existing antifraud activities
and develop a comprehensive and formal fraud risk management framework to include a complete fraud
risk assessment, development of a fraud risk profile, an antifraud strategy, and establishment of a
monitoring and evaluation process to assess the effectiveness of its antifraud activities. Doing so would
ensure stronger alignment with the best practices identified in GAO’s fraud risk framework and the Chief
Financial Officers Council’s Antifraud Playbook.
We acknowledge that DSS will explore inclusion of ESG-specific analysis into its risk assessment, increase
the risk assessment’s frequency, its documentation, and more formally capture risk remediation efforts.
We also acknowledge DSS contacted COSO to obtain training on the implementation of fraud risk
management practices.
During audit resolution, HUD can determine whether actions taken, including new policies and
procedures, are sufficient to address our recommendations or whether additional changes are needed.
Office of Audit and Evaluation | Office of Inspector General Page | 16
Scope and Methodology
We conducted our audit field work from April 2023 through May 2024 in New York City, NY, Los Angeles,
CA, and Greensboro, NC. The audit covered the period from March 27, 2020, through February 28, 2024.
Discussions, interviews, and meetings were conducted remotely via Microsoft TEAMs and during a site
visit to New York City in October 2023. Our audit focused on DSS’ administration of ESG CARES Act grant
funds.
To gain an understanding of the fraud risk management environment at DSS and adequately conduct our
assessment, we performed the following:
• Reviewed the City Comptroller’s Directive #1: Principles of Internal Control, GAO’s A Framework
for Managing Fraud Risks in Federal Programs, and the Chief Financial Officers Council’s Antifraud
Playbook.
• Interviewed DSS’ CAO; Audit & Quality Assurance Services’ deputy commissioner, Compliance &
Support’s deputy commissioner; director of accountability research and response; director of
data analytics, reporting, and triage; agency chief contracting officer; and finance executive
deputy commissioner.
• Also interviewed DHS’ budget assistant commissioner and adult services deputy commissioner,
DOI’s deputy commissioner-chief compliance & privacy officer, and two inspectors general.
• Reviewed DSS’ policies and procedures, descriptions of its fraud risk management practices,
relevant internal reports, and other relevant documentation.
• Compared DSS’ fraud risk management activities to those described in the Antifraud Playbook to
determine its antifraud maturity level.
We conducted our audit in accordance with generally accepted government auditing standards. Those
standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to
provide a reasonable basis for our finding and conclusion based on our audit objective(s). We believe
that the evidence obtained provides a reasonable basis for our findings and conclusions based on our
audit objective.
Office of Audit and Evaluation | Office of Inspector General Page | 17
Appendixes
Appendix A - Management Response
NYC
W-2-548
Rev. 05/23
Department of
Social Services
Human Resources
Administration
Department of
Homeless Services
DSS Accountability Office
Molly Wasow Park
Commissioner
Jill Berry
DSS First Deputy
Commissioner
Bedros Leon Boodanian
Chief Accountability Officer
151 West Broadway
New York, NY 10013
212 274 5600 tel November 28, 2025
boodanianb@dss.nyc.gov
Ms. Tanya Schulze
HUD Office of Inspector General, Office of Audit
300 North Los Angeles Street, Suite 4070
Los Angeles, CA 90012
Re: Agency Response to the Housing and Urban Development HUD Office of
Inspector General (OIG) Draft Report titled "The New York City Department of
Social Services Should Enhance Its Fraud Risk Management Practices for its ESG
CARES Act Funding" 2025-LA-100X
Dear Ms. Schultze,
This letter is in response to the HUD OIG’s Draft Report 2025-LA-100X, titled “The
New York City Department of Social Services Should Enhance Its Fraud Risk
Management Practices for its ESG CARES Act Funding.”
DSS appreciates the importance ofthe topic and the amount oftime and effort the HUD
OIG auditors spent studying our Agency processes. As discussed in more detail below,
as well as in the enclosed Corrective Action Plan (CAP) document, the Agency believes
HUD OIG’s recommendations could help improve our Agency fraud risk mitigation
strategies.
While we partially agree with HUD OIG’s recommendations, we respectfully disagree
with some of the Report’s characterizations of our existing fraud prevention strategies
and infrastructure. DSS has a strong compliance and fraud prevention framework. Our
work has included compliance training, targeted fraud-prevention initiatives, Agency-
wide communications, system-based fraud prevention controls, complex data analytics,
1
and the incorporation of risk management into oversight and daily operations. The
Agency believes these measures demonstrate an established and forward-thinking
approach to managing fraud risk.
It is also important to note that the Chief Financial Officers (CFO) Council’s Anti-
Fraud Playbook, which forms the basis of this Report, explicitly provides that:
“The playbook can and should be used as it bestfits your needs. You do
not have to implement the playbook as written. This is not a compliance
checklist, but rather a compilation of information to help you achieve
success in your antifraud initiatives. You arefree to select the plays that
are more useful or feasible for your agency... ”
That is precisely what DSS has done. The Agency has incorporated the Playbook’s
components which are most relevant to our work and maintains its risk assessments
within a larger suite of fraud-prevention mechanisms.
As a result of focusing so heavily on the DSS Risk Assessment, the Report does not
fully account for the nature of the Agency’s antifraud efforts. Because fraud is a
complex and evolving topic, discussions and strategies are not always developed or
implemented in the compartmentalized ways that auditors may expect. DSS’ approach
relies on integrating fraud-prevention strategies across multiple functions and forums.
The Agency approach is a deliberate, effective method of identifying and mitigating
fraud risk, and we believe it is wholly consistent with the Anti-Fraud Playbook.
That said, DSS is continuously striving for improvements. The Agency values the
Report’s recommendations and will work to enhance its processes accordingly. As
such, DSS will explore the inclusion of an ESG-specific analysis into its risk
assessment to strengthen fraud prevention. The Agency will also increase the frequency
of the risk assessment exercise, enhance the documentation of related activities, and
more formally capture risk remediation efforts, as described in the Report.
Please refer to the enclosed CAP, which contains detailed responses to the HUD OIG
recommendations.
We thank you again for your review and recommendations and look forward to
continued dialogue as we advance our shared goals of accountability, compliance, and
integrity.
2
Office of Audit and Evaluation | Office of Inspector General Page | 19
Ill
Should you have any questions regarding the enclosed, please contact Victoria Arzu,
Executive Director of the DSS External Audit Facilitation Team at 929-221-7067.
Yours sincerely,
B,ed ro.s L. B,oodci vcLet vc
Bedros L. Boodanian, Chief
DSS Accountability Office
Enclosures
3
Office of Audit and Evaluation Office of Inspector General
I Page 20
I
File and source
- File
- 2026-01-06-The-New-York-City-Department-of-Social-Services-Should-Enhance-Its-Fraud-Risk-Management-Practices.pdf
- Size
- 2,612,250 bytes
- SHA-256
- 6d12d3ddf95238d08abb68aba97de79e574bc05677e0e0ab6c8a455c815b1610
- Original
- www.oversight.gov