GAO-23-106567: Fraud Risk Management: Key Areas for Federal Agency and Congressional Action

Summary

GAO-23-106567, Fraud Risk Management: Key Areas for Federal Agency and Congressional Action, an April 2023 report to congressional committees by the U.S. Government Accountability Office. It states that GAO's prior work found five areas in which federal agencies need to take additional actions to manage fraud risks consistent with the Fraud Risk Framework published in July 2015. It cites a December 2022 GAO estimate that fraud in DOL's Unemployment Insurance programs during the pandemic totaled over $60 billion. From July 2015 through December 2022, GAO made 142 recommendations to over 40 agency or program offices related to the five areas; as of January 2023, 74 had not been fully implemented. Actions listed for Congress include reinstating agency reporting on antifraud controls and establishing a permanent analytics center of excellence.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Cite this document

“GAO-23-106567: Fraud Risk Management: Key Areas for Federal Agency and Congressional Action.” Original at www.gao.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/gao-23-106567-fraud-risk-management-key-areas-for-federal-agency-and-c-a54f9a631e/, SHA-256 f4a86fcb253f715c46f71829e87aaa0d7d8f964de4abd8aed9bd8f7b458a7a2b.

Full text

United States Government Accountability Office
Report to Congressional Committees

FRAUD RISK
April 2023

MANAGEMENT

Key Areas for Federal
Agency and
Congressional Action

GAO-23-106567
April 2023

FRAUD RISK MANAGEMENT
Key Areas for Federal Agency and Congressional
Action
Highlights of GAO-23-106567, a report to
congressional committees

Why GAO Did This Study What GAO Found
Fraud poses a significant risk to the GAO’s prior work has highlighted five areas in which federal agencies need to
integrity of federal programs and take additional actions to help ensure they are effectively managing fraud risks,
erodes public trust in government. The consistent with leading practices in GAO’s A Framework for Managing Fraud
increased flow of federal funds Risks in Federal Programs (Fraud Risk Framework).
associated with the COVID-19
pandemic has increased opportunities Federal Agencies Need to Improve Fraud Risk Management Efforts in Five Areas
for fraud. While the extent of fraud
associated with COVID-19 relief
programs has not yet been fully
determined, available information
indicates substantial levels of fraud
and potential fraud occurred. For
example, in December 2022, GAO
reported that estimated fraud in DOL’s
Unemployment Insurance programs
during the pandemic totaled over $60
billion. GAO has recently made several recommendations to, for example, the
Department of Labor (DOL) to improve fraud risk management in the
To help federal program managers Unemployment Insurance programs, including recommendations to assess fraud
strategically manage their fraud risks risks and to design and implement an antifraud strategy. DOL has begun taking
during both normal operations and
steps to implement these recommendations, but its work remains incomplete.
emergencies, GAO published the
Completing these efforts would help DOL manage Unemployment Insurance
Fraud Risk Framework in July 2015. It
provides a comprehensive set of
fraud risks more effectively.
leading practices that serve as a guide GAO’s prior work has also identified actions that Congress can take to
for agency managers to use when strengthen fraud risk management practices across the government.
developing efforts to combat fraud.
Since 2015, GAO has issued over 70 • Reinstating the requirement for agencies to report on their antifraud
reports with numerous controls and fraud risk management efforts in agency financial reports.
recommendations to help federal In March 2022, GAO recommended that Congress amend the Payment
agencies manage their fraud risks. Integrity Information Act of 2019 to reinstate certain reporting requirements.
Requiring agencies to report annually on their antifraud controls and fraud
This report highlights areas where
GAO’s prior work has shown that risk management efforts will help facilitate congressional oversight and focus
federal agencies and Congress can agency attention on strategic fraud risk management—both during normal
take action to help ensure effective operations and in emergencies—and help align their efforts with leading
fraud risk management. practices.
• Establishing a permanent analytics center of excellence to aid the
What GAO Recommends oversight community in identifying improper payments and fraud.
From July 2015 through December Inspectors General did not have access to a government-wide analytical
2022, GAO made 142 capability to help identify fraud until more than a year after agencies began
recommendations to over 40 agency or distributing relief funds. Without permanent government-wide analytics
program offices related to one or more capabilities to assist the oversight community, agencies will have limited
of the five key areas. As of January resources to apply to nonpandemic programs to ensure robust financial
2023, 74 of the recommendations had stewardship, as well as to better prepare for applying fundamental financial
not been fully implemented. and fraud risk management practices to future emergency funding.
View GAO-23-106567. For more information,
contact Seto J. Bagdoyan at (202) 512-6722
or BagdoyanS@gao.gov.

United States Government Accountability Office
Contents

Letter 1
Background 4
Key Areas for Improving Fraud Risk Management 8

Appendix I Matters for Congressional Consideration 26

Appendix II GAO Contact and Staff Acknowledgments 28

Figures
Figure 1: The Fraud Risk Framework and Selected Leading
Practices 5
Figure 2: Legislation and Guidance Related to Fraud Risk
Management 6
Figure 3: Case Study Illustrating Aircraft-Related Criminal Activity
Risks 18
Figure 4: Examples of Fraud Risks and Possible Schemes
Targeting Government and Private Businesses and
Individuals during Emergencies 20

Page i GAO-23-106567 Fraud Risk Management
Abbreviations

CFO chief financial officer
CMS Centers for Medicare & Medicaid Services
DOE Department of Energy
DOL Department of Labor
EXIM Export-Import Bank of the United States
FAA Federal Aviation Administration
Fraud Risk Framework A Framework for Managing Fraud Risks in
Federal Programs
FRDAA Fraud Reduction and Data Analytics Act of
2015
Green Book Standards for Internal Control in the Federal
Government
OHS Office of Head Start
OMB Office of Management and Budget
PACE Pandemic Analytics Center of Excellence
PIIA Payment Integrity Information Act of 2019
PPP Paycheck Protection Program
PRAC Pandemic Response Accountability
Committee
SBA Small Business Administration
SSA Social Security Administration
UI Unemployment Insurance
USCIS U.S. Citizenship and Immigration Services

This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.

Page ii GAO-23-106567 Fraud Risk Management
Letter

441 G St. N.W.
Washington, DC 20548

April 13, 2023

The Honorable Gary C. Peters
Chairman
The Honorable Rand Paul, M.D.
Ranking Member
Committee on Homeland Security and Governmental Affairs
United States Senate

The Honorable James Comer
Chairman
The Honorable Jamie Raskin
Ranking Member
Committee on Oversight and Accountability
House of Representatives

Fraud poses a significant risk to the integrity of federal programs and
erodes public trust in government. 1 It contributes to financial and
nonfinancial risks that waste taxpayer dollars, threaten national security,
or put consumers at risk. Additionally, fraud—which involves obtaining
something of value through willful misrepresentation—continues to add to
the improper payments made by the government. 2

The public health crisis, economic instability, and increased flow of
federal funds associated with the COVID-19 pandemic have expanded
opportunities for fraud. The extent of fraud associated with COVID-19
relief programs has not yet been fully determined. However, available
measures and estimates indicate substantial levels of fraud and potential

1Whether an act is fraudulent is determined through the judicial or other adjudicative
system and is beyond management’s professional responsibility for assessing risk. GAO,
Standards for Internal Control in the Federal Government, GAO-14-704G (Washington,
D.C.: Sept. 10, 2014).
2An improper payment is defined as any payment that should not have been made or that
was made in an incorrect amount (including overpayments and underpayments) under
statutory, contractual, administrative, or other legally applicable requirements. It includes
any payment to an ineligible recipient, any payment for an ineligible good or service, any
duplicate payment, any payment for a good or service not received (except for such
payments where authorized by law), and any payment that does not account for credit for
applicable discounts. While not all improper payments are the result of fraud, all payments
made as a result of fraudulent activities are considered to be improper payments.

Page 1 GAO-23-106567 Fraud Risk Management
fraud occurred. For example, in December 2022, we reported that
extrapolating the lower bound of the Department of Labor’s (DOL)
estimated national fraud rate for the regular Unemployment Insurance
(UI) program for performance year 2021—which covers July 1, 2020
through June 30, 2021—to total spending across all UI programs during
the pandemic would suggest over $60 billion in fraudulent UI payments. 3
Further, based on findings from our prior work and other audits, we added
three programs that account for a large portion of COVID-19 funding to
our High-Risk List in March 2021 and June 2022, namely

• the Small Business Administration’s (SBA) emergency loans for small
businesses issued under the Paycheck Protection Program (PPP),
• SBA’s COVID-19 Economic Injury Disaster Loan program, and
• DOL’s UI program.
Managers of federal programs may perceive a conflict between their
priorities to fulfill the program’s mission, such as quickly and efficiently
disbursing funds or providing services to beneficiaries, and taking actions
to safeguard taxpayer dollars from improper use. However, proactively
managing fraud risks can help facilitate the program’s mission and
strategic goals by ensuring that taxpayer dollars and government services
serve their intended purposes.

The heightened fraud risks and prevalence of fraud in various relief
programs during the COVID-19 pandemic underscore the imperative for
federal agencies to manage fraud risks strategically. To help federal
program managers strategically manage their fraud risks during both
normal operations and emergencies, we published A Framework for
Managing Fraud Risks in Federal Programs (Fraud Risk Framework) in
July 2015. 4 In June 2016, the Fraud Reduction and Data Analytics Act of
2015 (FRDAA) required the Office of Management and Budget (OMB) to
establish guidelines for federal agencies to create controls to identify and
assess fraud risks and to design and implement antifraud control
activities. The act further required OMB to incorporate the leading

3GAO, Unemployment Insurance: Data Indicate Substantial Levels of Fraud during the
Pandemic; DOL Should Implement an Antifraud Strategy, GAO-23-105523 (Washington,
D.C.: Dec. 22, 2022). It should be noted that such an extrapolation may be substantially
understated and has inherent limitations and should be interpreted with caution.
4GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP
(Washington, D.C.: July 28, 2015).

Page 2 GAO-23-106567 Fraud Risk Management
practices from the Fraud Risk Framework in the guidelines. 5 In March
2020, the Payment Integrity Information Act of 2019 (PIIA) repealed
FRDAA but maintained the requirement for OMB to provide guidance to
agencies in implementing the Fraud Risk Framework. 6

Since we issued the Fraud Risk Framework in July 2015, we have issued
over 70 reports with recommendations to federal agencies to align their
efforts to manage fraud risks with leading practices from the Fraud Risk
Framework or the fraud risk principle of Standards for Internal Control in
the Federal Government (Green Book). 7

We prepared this report under the authority of the Comptroller General to
conduct work to assist Congress with its oversight responsibilities. This
report highlights areas where our prior work has shown that federal
agencies and Congress can improve fraud risk management efforts.

To address our objective, we identified GAO reports issued from July
2015 through December 2022 that assessed agency efforts against one
or more leading practices from the Fraud Risk Framework or the Green
Book’s fraud risk principle. We reviewed these reports to identify
recommendations made to align agency efforts with these criteria. We
determined the status of relevant recommendations as of January 2023.
We analyzed the content of the recommendations to identify broad areas
in which federal agency actions to manage fraud risks could be improved.
We also reviewed the reports for examples of federal agencies meeting
leading practices from the Fraud Risk Framework.

In addition to recommendations to various agencies, we identified
recommendations to OMB and Matters for Congressional Consideration
that could help improve federal fraud risk management efforts.

This report is based upon work we previously conducted in accordance
with generally accepted government auditing standards. Those standards
require that we plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions

5Pub. L. No. 114-186, 130 Stat. 546 (2016).

6The Payment Integrity Information Act of 2019 requires these guidelines to remain in
effect, subject to modification by OMB as necessary and in consultation with GAO. Pub. L.
No. 116-117, § 2(a), 134 Stat. 113, 131-132 (2020), codified at 31 U.S.C. § 3357.
7Principle 8 states that management should consider the potential for fraud when
identifying, analyzing, and responding to risks. GAO-14-704G.

Page 3 GAO-23-106567 Fraud Risk Management
based on our audit objectives. We believe that the evidence obtained
provides a reasonable basis for our findings and conclusions based on
our audit objectives.

Background
Fraud Risk Framework The objective of fraud risk management is to help ensure program
integrity by continuously and strategically mitigating both the likelihood
and effects of fraud. When fraud risks can be identified and mitigated,
fraud may be less likely to occur. 8 Although the occurrence of fraud
indicates there is a fraud risk, a fraud risk can exist even if actual fraud
has not yet occurred or been identified. Effectively managing fraud risk
helps to ensure that federal programs’ services fulfill their intended
purpose, funds are spent effectively, and assets are safeguarded.
Executive branch agency managers are responsible for managing fraud
risks and implementing practices for combating those risks.

As discussed previously, in July 2015, we issued the Fraud Risk
Framework to serve as a guide for agency managers—during normal
operations, as well as during emergencies—when developing or
enhancing efforts to combat fraud in a strategic, risk-based way. 9 The
Fraud Risk Framework is also aligned with Principle 8 (“Assess Fraud
Risk”) of the Green Book. As depicted below in figure 1, the Fraud Risk
Framework describes leading practices within four components: commit,
assess, design and implement, and evaluate and adapt.

8Fraud and “fraud risk” are distinct concepts. Fraud—obtaining something of value
through willful misrepresentation—is a determination to be made through the judicial or
other adjudicative system, and that determination is beyond management’s professional
responsibility. Fraud risk exists when individuals have an opportunity to engage in
fraudulent activity, have an incentive or are under pressure to commit fraud, or are able to
rationalize committing fraud.
9GAO-15-593SP.

Page 4 GAO-23-106567 Fraud Risk Management
Figure 1: The Fraud Risk Framework and Selected Leading Practices

Legislation and Guidance Legislation and guidance have increasingly focused on the need for
program managers to take a strategic approach to managing risks,
including fraud (see fig. 2).

Page 5 GAO-23-106567 Fraud Risk Management
Figure 2: Legislation and Guidance Related to Fraud Risk Management

a
GAO, Standards for Internal Control in the Federal Government, GAO-14-704G (Washington, D.C.:
Sept. 10, 2014).
b
GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP (Washington,
D.C.: July 28, 2015).
c
Pub. L. No. 114-186, 130 Stat. 546 (2016).
d
Pub. L. No. 116-117, § 2(a), 134 Stat. 113, 131-132 (2020), codified at 31 U.S.C. § 3357.

Page 6 GAO-23-106567 Fraud Risk Management
e
OMB, Management’s Responsibility for Enterprise Risk Management and Internal Control, OMB
Circular A-123 (Washington, D.C.: July 15, 2016).
f
OMB, Establishing Financial and Administrative Controls to Identify and Assess Fraud Risk, CA-23-
03 (Washington, D.C.: Oct. 17, 2022). Enterprise risk management is a decision-making tool that can
assist federal leaders to anticipate and manage risks across their portfolios. Prior to implementing
enterprise risk management, risk management focused on traditional internal control concepts for
managing risk exposures. Beyond traditional internal controls, enterprise risk management promotes
risk management by considering its effect across the entire organization and how it may interact with
other identified risks.

Congress enacted FRDAA to improve federal agency controls and
procedures to assess and mitigate fraud risks, and to improve agencies’
development and use of data analytics for the purpose of identifying,
preventing, and responding to fraud. As mentioned, FRDAA required
OMB to establish guidelines for federal agencies to create controls to
identify and assess fraud risks and to design and implement anti-fraud
control activities. The act further required OMB to incorporate the leading
practices from the Fraud Risk Framework in the guidelines. In addition,
FRDAA required agencies to annually report to Congress on their
progress in implementing the act for each of the first 3 fiscal years after its
enactment.

To comply with FRDAA, OMB updated existing guidelines for agencies to
establish financial and administrative controls to manage fraud risks.
Specifically, OMB incorporated guidelines to meet FRDAA requirements
into its July 2016 update of Circular A-123, Management’s Responsibility
for Enterprise Risk Management and Internal Control. This particular
update of Circular A-123 introduced requirements for agencies to
implement enterprise risk management and integrate with existing internal
control capabilities to improve mission delivery, reduce costs, and focus
corrective actions on key risks. 10 The update to Circular A-123 also
included a discussion of the Fraud Risk Framework and aligned internal
control processes with the 2014 update to the Green Book—such as the
reference to the fraud risk principle (Principle 8).

10Enterprise risk management is a decision-making tool that can assist federal leaders to
anticipate and manage risks across their portfolios. Prior to implementing enterprise risk
management, risk management focused on traditional internal control concepts for
managing risk exposures. Beyond traditional internal controls, enterprise risk management
promotes risk management by considering its effect across the entire organization and
how it may interact with other identified risks.

Page 7 GAO-23-106567 Fraud Risk Management
In March 2020, PIIA repealed FRDAA but required the OMB guidelines to
remain in effect, subject to modification by OMB as necessary, and in
consultation with GAO.

In October 2022, in response to one of our recommendations in this area,
OMB issued a Controller Alert to clarify the distinction between
FRDAA/PIIA requirements to establish fraud-related financial and
administrative controls and enterprise risk management to ensure fraud
risks are appropriately managed. 11 The Controller Alert reminds agencies
that they should adhere to leading practices in GAO’s Fraud Risk
Framework as part of their efforts to effectively design, implement, and
operate an internal control system that addresses fraud risks—including
fraud risks that do not rise to the level of enterprise-wide risks.

The Controller Alert also reminds agencies that the dollar thresholds
established in 31 U.S.C. § 3352 by PIIA for “significant” improper
payments are for the purposes of improper payment reporting and not for
managing fraud risks pursuant to 31 U.S.C. § 3357. As such, all programs
regardless of their improper payment risks or rates should be strategically
managing their fraud risks. Clarifying these requirements for fraud risk
management will help ensure that agencies are better positioned to
improve controls and procedures to assess and mitigate fraud risks in
federal programs.

Our prior work has highlighted five areas in which federal agencies need
Key Areas for to take additional actions to help ensure they are effectively managing
Improving Fraud Risk fraud risks, consistent with leading practices in the Fraud Risk
Framework. 12 Specifically, agencies need to take additional actions
Management related to (1) designating an entity to lead fraud risk management, (2)
11In December 2018, we reported that the OMB guidelines were unclear on the
relationship between requirements for managing fraud risks and enterprise risk
management requirements and that uncertainty about the difference between enterprise
risk management and FRDAA requirements may have affected agencies’ implementation
of the requirements in the act. We recommended that OMB enhance the guidelines for
agencies to establish the controls required by FRDAA by clarifying the difference between
FRDAA and enterprise risk management requirements. As noted, OMB has since taken
action to address this recommendation. OMB, Establishing Financial and Administrative
Controls to Identify and Assess Fraud Risk, CA-23-03 (Washington, D.C., Oct. 17, 2022).
12The Fraud Risk Framework’s leading practices can be implemented at the agency level
or the program level. In some instances, prior work assessed fraud risk management
efforts at the agency level and in other instances prior work assessed efforts at the
program level. We generally use the term “agency” in this report to include agencies or
programs.

Page 8 GAO-23-106567 Fraud Risk Management
assessing fraud risks, (3) designing and implementing an antifraud
strategy, (4) using data analytics to manage fraud risks, and (5) managing
fraud risks in emergencies. From July 2015 through December 2022, we
made 142 recommendations to over 40 agency or program offices related
to one or more of these areas to align with leading practices from the
Fraud Risk Framework or the Green Book’s fraud risk principle. 13 As of
January 2023, agencies needed to take additional action to fully address
74 of these recommendations. 14 In addition, our prior work identified
opportunities for Congress to take action to focus agency attention on
strategic fraud risk management.

Federal Agencies Need to
Improve Fraud Risk
Management Efforts in
Five Areas

Designating an Entity to Lead The first component of the Fraud Risk Framework—commit—calls for
Fraud Risk Management agencies to designate an entity to lead fraud risk management activities.
Specifically, the Fraud Risk Framework calls for the designated antifraud
entity to have defined responsibilities and the necessary authority to
perform its role in managing the fraud risk assessment process (in the
second component) and coordinating antifraud initiatives, among other
things. We have consistently reported that leadership commitment is the
critical element for initiating and sustaining progress and making the
types of management and operational improvements required for
narrowing or removing areas from our list of programs and operations at
high risk of waste, fraud, abuse, or mismanagement, or in need of

13Some recommendations relate to more than one area. For example, we made a
recommendation to the Department of Health and Human Services’s Administration for
Children and Families to conduct a fraud risk assessment to provide a basis for the
documentation and development of an antifraud strategy for the Child Care and
Development Fund. This recommendation is included in the number of recommendations
related to assessing fraud risks and designing and implementing an antifraud strategy.
14Of the 142 recommendations, 67 were closed as implemented, one was closed as not
implemented, 11 were open but had been partially addressed, and 63 were open and had
not been addressed. We follow up on recommendations we have made and update the
status at least once per year. Experience has shown that it takes time for some
recommendations to be implemented. Of the 142 recommendations, 21 were made on or
after January 1, 2022, and 19 of the 21 remained open as of January 2023.

Page 9 GAO-23-106567 Fraud Risk Management
transformation. 15 Further, our prior work has shown that when agencies
formally designate an entity to design and oversee fraud risk
management activities, their efforts can be more visible across the
agency, particularly to executive leadership. 16

Our prior work has identified instances in which agencies have
designated an antifraud entity that aligns with leading practices from our
Fraud Risk Framework. For example, in April 2017, we reported that the
Social Security Administration (SSA) demonstrated a commitment to
antifraud efforts by conducting a study to evaluate its fraud risk
management approach and, shortly thereafter, by establishing a
dedicated antifraud office within the agency. 17 Specifically, SSA
established the Office of Anti-Fraud Programs in November 2014. The
office is responsible for coordinating antifraud efforts, developing
antifraud policies, and creating and implementing fraud mitigation plans
across SSA, among other things. We reported that these responsibilities
are consistent with leading practices and help SSA show commitment to
combating fraud and help ensure that antifraud initiatives are coordinated
across the agency.

Our prior work, however, has also identified instances in which federal
agencies need to take additional action related to designating an entity to
lead fraud risk management activities. Specifically, from July 2015
through December 2022, we made eight recommendations to federal
agencies in this area. This work includes recommendations to dedicate
an entity to oversee fraud risk management activities or to document the

15We designate federal programs and operations as “high risk” due to their vulnerabilities
to fraud, waste, abuse, and mismanagement, or because they need transformation. GAO,
High-Risk Series: Key Practices to Successfully Address High-Risk Areas and Remove
Them from the List, GAO-22-105184 (Washington, D.C.: Mar. 3, 2022).
16For example, see GAO, Medicare and Medicaid: CMS Needs to Fully Align Its Antifraud
Efforts with the Fraud Risk Framework, GAO-18-88 (Washington, D.C.: Dec. 5, 2017).
17GAO, SSA Disability Benefits: Comprehensive Strategic Approach Needed to Enhance
Antifraud Activities, GAO-17-228 (Washington, D.C.: Apr. 17, 2017).

Page 10 GAO-23-106567 Fraud Risk Management
fraud risk management responsibilities of the antifraud entity. Of the eight
recommendations, six remained open as of January 2023. 18

For example, in October 2021, we found that DOL had not clearly
assigned defined responsibilities to a dedicated antifraud entity. 19 We
recommended that DOL designate a dedicated antifraud entity with
clearly defined and documented responsibilities and authority, including
responsibility and authority for facilitating communication among
stakeholders about fraud-related issues. In February 2023, DOL told us it
designated its chief financial officer (CFO) as the dedicated entity
responsible for managing the process of assessing fraud risks to the
Unemployment Insurance program. However, it is still too early to tell
whether the CFO will perform this role in a manner that is consistent with
leading practices, such as by coordinating antifraud initiatives across the
agency and serving as the repository of knowledge on fraud controls,
among other things. As such, we will continue to monitor DOL’s progress
in implementing this recommendation. Until DOL and other agencies fully
establish a dedicated entity for managing fraud risks in a manner that is
consistent with leading practices, they will lack a critical element of
agency commitment to effective fraud risk management.

Assessing Fraud Risks The second component of the Fraud Risk Framework—assess—calls for
agencies to plan and conduct regular fraud risk assessments, including
identifying and assessing fraud risks and documenting the results in a
fraud risk profile. In particular, an effective antifraud entity tailors the
approach for carrying out a fraud risk assessment to the program.
Planning and conducting a fraud risk assessment can help managers to
fully consider fraud risks to their programs—including existing and
emerging risks—and to analyze their likelihood and impact, and prioritize
risks. Such an assessment can provide the detailed information and
insights needed to create a fraud risk profile, which, in turn, is the basis
for creating an antifraud strategy (in the third component). As a result,
fully assessing fraud risks can better position management to determine
the extent to which antifraud controls may no longer be relevant or cost

18Of the eight recommendations, two were closed as implemented, one was open but had
been partially addressed, and five were open and had not been addressed. As previously
noted, we follow up on recommendations we have made and update the status at least
once per year. Experience has shown that it takes time for some recommendations to be
implemented. Of the eight recommendations, two were made on or after January 1, 2022,
and both remained open as of January 2023.
19GAO, COVID-19: Additional Actions Needed to Improve Accountability and Program
Effectiveness of Federal Response, GAO-22-105051 (Washington, D.C.: Oct. 27, 2021).

Page 11 GAO-23-106567 Fraud Risk Management
effective and strengthen antifraud controls, by designing and
implementing the most-appropriate control activities to respond to the full
portfolio of fraud risks.

Our prior work has identified instances in which agencies have taken
steps to assess fraud risks in accordance with leading practices from our
Fraud Risk Framework. For example, in response to a recommendation
we made in 2017, the Centers for Medicare & Medicaid Services (CMS)
has taken steps to assess fraud risks in the Medicare and Medicaid
programs. Specifically, in December 2017, we found that CMS had taken
steps to identify some fraud risks to the Medicare and Medicaid
programs, but it had not conducted a fraud risk assessment for either
program. 20 We also found that CMS would be unable to design and
implement the most-appropriate control activities to respond to its full
portfolio of fraud risks by following its approach at the time of our 2017
report. At that time, CMS’s approach focused on addressing specific
vulnerabilities among provider groups that had shown themselves to be
particularly prone to fraud, waste, and abuse and did not fully consider
other sources of fraudulent behaviors, such as those posed by health-
insurance plans, contractors, or employees. We recommended that CMS
conduct fraud risk assessments for Medicare and Medicaid to include
fraud risk profiles and plans for regularly updating the assessments and
profiles.

In response to our recommendation, CMS provided us with
documentation of risk assessment frameworks for program areas within
Medicare and Medicaid. These frameworks include a standard format to
document vulnerabilities, risk levels, residual risks, and mitigation
strategies, among other topics. 21 CMS’s approach also includes regularly
re-examining vulnerabilities based on risk and environmental factors,
consistent with leading practices. We have continually designated
Medicare and Medicaid as high risk, partly due to their vulnerability to
fraud, waste, and abuse. Conducting risk assessments is an important
step that can better position CMS to develop an antifraud strategy with
specific control activities to address these substantial fraud risks.

Federal agencies, however, need to take additional action to implement
our other recommendations related to assessing fraud risks. Specifically,

20GAO-18-88.

21Residual risk is the risk that remains after inherent risks have been mitigated by existing
control activities.

Page 12 GAO-23-106567 Fraud Risk Management
from July 2015 through December 2022, we made 73 recommendations
to federal agencies related to assessing fraud risks. This includes
recommendations to plan and conduct regular fraud risk assessments,
revise or update existing fraud risk management activities to include a
fraud risk tolerance, or document a fraud risk profile. Of the 73
recommendations, 36 remained open as of January 2023. 22

For example, in September 2019, we found that the Office of Head Start
(OHS) had not conducted a comprehensive fraud risk assessment of the
Head Start program. 23 We also reported on vulnerabilities in some Head
Start centers’ controls for detecting potential fraud. Posing as fictitious
families, we attempted to enroll children at a nongeneralizable selection
of Head Start centers in metropolitan areas. For each of the 15 covert
tests we conducted, we provided incomplete or potentially disqualifying
information during the enrollment process, such as pay stubs that
exceeded income requirements. In five of 15 covert tests, we found
potential fraud. For example, in three of these five cases, documents we
later retrieved from the three Head Start centers showed that our
applications had been doctored to exclude income information we
provided, which would have shown the fictitious family to be ineligible. 24

During the course of that review, OHS officials told us they did not believe
the Head Start program was at a significant risk of fraud. However,
without a comprehensive fraud risk assessment, OHS cannot support this
determination. We recommended that OHS perform a fraud risk
assessment for the Head Start program, to include assessing the
likelihood and impact of the fraud risks it faces.

As of January 2023, OHS told us that its fraud risk assessment approach
is still under development and that a timeline for completing this work had
not been established. Completing a fraud risk assessment could help

22Of the 73 recommendations, 36 were closed as implemented, one was closed as not
implemented, three were open but had been partially addressed, and 33 were open and
had not been addressed. We follow up on recommendations we have made and update
the status at least once per year. Experience has shown that it takes time for some
recommendations to be implemented. Of the 73 recommendations, seven were made on
or after January 1, 2022, and all seven remained open as of January 2023.
23GAO, Head Start: Action Needed to Enhance Program Oversight and Mitigate
Significant Fraud and Improper Payment Risks, GAO-19-519 (Washington, D.C.: Sept. 13,
2019).
24To view selected video clips of these undercover enrollments, go to
https://www.gao.gov/products/GAO-19-519.

Page 13 GAO-23-106567 Fraud Risk Management
OHS better identify and address the fraud risk vulnerabilities we identified
and better position OHS to design and implement an effective antifraud
strategy for the Head Start program. Similarly, taking steps to address
recommendations in this area can help ensure other agencies with open
recommendations are best positioned to design and implement the most-
appropriate control activities to respond to their full portfolios of fraud
risks.

Designing and Implementing The third component of the Fraud Risk Framework—design and
an Antifraud Strategy implement—calls for agencies to determine risk responses and document
an antifraud strategy that describes the agency’s approach for addressing
the prioritized fraud risks identified during the fraud risk assessment. A
key element of an antifraud strategy is to describe the agency’s activities
for preventing, detecting, and responding to fraud, as well as monitoring
and evaluation, among other things. Developing and documenting an
antifraud strategy based on a fraud risk assessment can help agencies to
develop a coordinated approach to address the range of fraud risks and
to appropriately target and allocate resources to the most significant risks.
Entities that do not create an antifraud strategy based explicitly on a fraud
risk assessment and corresponding fraud risk profile might fail to address
fraud vulnerabilities that could affect their performance, undermine their
reputation, or impair their ability to fulfill their missions.

Our prior work has found instances in which agencies have taken steps to
design and implement an antifraud strategy. For example, in July 2018
we found that the Export-Import Bank of the United States (EXIM) had
instituted a number of antifraud controls, but it had not developed an
antifraud strategy based on a fraud risk profile, or implemented specific
control activities to achieve such a strategy. 25 We recommended that
EXIM develop and implement an antifraud strategy with specific control
activities, based on the results of fraud risk assessments and a
corresponding fraud risk profile. In response to our recommendation, in
2019 EXIM developed an antifraud strategy with specific control activities
based on the results of its fraud risk assessment and took steps to
implement the strategy. Developing and documenting an antifraud
strategy can help EXIM ensure it is strategically managing its fraud risks.

Federal agencies, however, need to take additional steps to design and
implement effective antifraud strategies. From July 2015 through

25GAO, Export-Import Bank: The Bank Needs to Continue to Improve Fraud Risk
Management, GAO-18-492 (Washington, D.C.: July 19, 2018).

Page 14 GAO-23-106567 Fraud Risk Management
December 2022, we made 21 recommendations in this area. This
includes recommendations to develop an antifraud strategy that aligns
with assessed fraud risks, document the antifraud strategy, or update an
existing antifraud strategy. Of the 21 recommendations, 11 remained
open as of January 2023. 26

For example, in March 2017, we reported that the Department of Energy
(DOE) had not implemented leading practices—including developing and
documenting a strategy to mitigate assessed fraud risks—to manage its
risk of fraud and improper payments. 27 According to DOE officials, they
did not implement leading practices for managing the department’s risk of
fraud because they consider the risk of fraud to be low. Because DOE
had not developed and documented an antifraud strategy that describes
its programs’ approaches for addressing fraud risks, DOE was missing an
opportunity to allocate resources more effectively to respond to fraud
risks. We recommended that DOE develop and document an antifraud
strategy that describes the programs’ approaches for addressing the
prioritized fraud risks identified during a fraud risk assessment.

At the time, DOE generally concurred with this recommendation but did
not provide plans to develop and document an antifraud strategy to
address the recommendation. Specifically, DOE stated that DOE believed
it had implemented the requirements of the 2016 update to OMB Circular
A-123 and believed it had embedded its antifraud strategy within its
internal control program. 28 However, DOE officials told us during the audit
that they had not developed or documented a DOE-wide antifraud
strategy or directed individual programs to develop program-specific

26Of the 21 recommendations, 10 were closed as implemented, two were open but had
been partially addressed, and nine were open and had not been addressed. As previously
noted, we follow up on recommendations we have made and update the status at least
once per year. Experience has shown that it takes time for some recommendations to be
implemented. Of the 21 recommendations, five were made on or after January 1, 2022, of
which three remained open as of January 2023.
27GAO, Department of Energy: Use of Leading Practices Could Help Manage the Risk of
Fraud and Other Improper Payments, GAO-17-235 (Washington, D.C.: Mar. 30, 2017).
28As discussed previously, we reported in December 2018 that OMB guidelines were
unclear on the relationship between requirements for managing fraud risks and enterprise
risk management requirements and that uncertainty about the difference between
enterprise risk management and FRDAA requirements may have affected agencies’
implementation of the requirements in the act. We recommended that OMB enhance the
guidelines for agencies to establish the controls required. OMB has since taken action to
address this recommendation.

Page 15 GAO-23-106567 Fraud Risk Management
strategies. In January 2021, we found that DOE was planning to develop
an antifraud strategy in fiscal year 2022. 29 As of February 2023, we are
continuing to monitor DOE’s progress in implementing this
recommendation. Until DOE and other agencies with open
recommendations in this area implement those recommendations, they
are missing an opportunity to organize and focus resources in a way that
would allow them to strategically mitigate the likelihood and impact of
fraud.

Using Data Analytics to The Fraud Risk Framework’s leading practices include managers
Manage Fraud Risks implementing data-analytics activities as part of an overall antifraud
strategy. According to the Fraud Risk Framework, data-analytics activities
can include a variety of techniques. For example, data-mining and data-
matching techniques can enable agencies to identify potential fraud or
improper payments that have already been awarded, thus assisting
agencies in recovering these dollars. Predictive analytics can identify
potential fraud before making payments. In particular, we have
highlighted the importance of data matching and other techniques to
verify self-reported information and other information necessary for
determining eligibility for enrolling in programs or receiving benefits.

Our prior work has identified instances in which agencies have used data
analytics in alignment with leading practices from our Fraud Risk
Framework. For example, in 2019 we reported that, according to U.S.
Citizenship and Immigration Services (USCIS) officials, the agency had
data-analytics capabilities that it used as part of its efforts to identify and
prevent fraud within immigration benefit programs. However, we found
that USCIS had not applied these capabilities as an antifraud tool
specifically for the self-petition program for foreign national victims of
battery or extreme cruelty committed by certain U.S. citizens or lawful
permanent residents. We recommended that USCIS develop and
implement data-analytics capabilities for the self-petition program as a
means to prevent and detect fraud as provided by GAO’s Fraud Risk
Framework.

In response to our recommendation, in December 2020 USCIS officials
provided us documentation of their analysis of self-petition application
data to identify populations of self-petitions vulnerable to fraud. USCIS
officials told us they plan to build on and improve their data-analysis tools

29GAO, Department of Energy Contracting: Improvements Needed to Ensure DOE
Assesses its Full Range of Contracting Fraud Risks, GAO-21-44 (Washington, D.C.: Jan.
13, 2021).

Page 16 GAO-23-106567 Fraud Risk Management
as a part of their ongoing annual fraud risk assessments. By employing
data analytics within the self-petition program, USCIS can improve its
efforts to detect and prevent potential fraud in self-petition filings, as well
as inform the self-petition program’s regular fraud risk assessments.

Federal agencies, however, need to take additional actions to implement
other recommendations in this area. Specifically, from July 2015 through
December 2022, we made 40 recommendations to federal agencies to
use data analytics in accordance with leading practices to help manage
fraud risks in their programs. This includes recommendations to design
and implement data-analytics activities to prevent and detect fraud, such
as using data matching to verify self-reported information. Of the 40
recommendations, 20 remained open as of January 2023. 30

For instance, in 2020 we determined that limitations in the Federal
Aviation Administration’s (FAA) use of data in its processes for registering
civil aircraft hindered FAA’s ability to prevent registry fraud and abuse.
Specifically, FAA’s registry is vulnerable to fraud and abuse when
applicants register aircraft using opaque ownership structures that afford
limited transparency into who is the actual beneficial owner (i.e., the
person who ultimately owns and controls the aircraft). Such structures
can be used to own aircraft associated with money laundering or other
illegal activities (see example in figure 3). We also reported that FAA has
an opportunity to develop data-analytics capabilities to detect indicators of
fraud and abuse in the registry.

30Of the 40 recommendations, 20 were closed as implemented, three were open but had
been partially addressed, and 17 were open and had not been addressed. We follow up
on recommendations we have made and update the status at least once per year.
Experience has shown that it takes time for some recommendations to be implemented.
Of the 40 recommendations, seven were made on or after January 1, 2022, and all seven
remained open as of January 2023.

Page 17 GAO-23-106567 Fraud Risk Management
Figure 3: Case Study Illustrating Aircraft-Related Criminal Activity Risks

To address these concerns, we made multiple recommendations,
including recommendations for FAA to collect and analyze data to identify
patterns of activity indicative of fraud or abuse, among other things. Since
our report, FAA has reported that it plans to take steps to address these
recommendations, including steps to partner with external government
agencies to identify ways to share data and verify eligibility. However,
these efforts have not been completed and, as of January 2023, the
recommendations remained open. Until FAA fully implements these
steps, it is limited in its ability to prevent fraud and abuse in aircraft
registrations, which enable aircraft-related criminal, national security, or
safety risks. Similarly, taking steps to address open recommendations in
this area can help ensure and enhance coordination efforts with other
agencies in effectively using data to prevent or detect fraud.

Managing Fraud Risks in During emergencies—such as natural disasters, public health
Emergencies emergencies, or economic crises—federal agencies must get relief funds
out quickly while ensuring appropriate financial and other safeguards are
in place. Recognizing fraud risks, and thoughtfully and deliberately
managing them in an emergency environment, can help federal
managers safeguard public resources while providing needed relief. The
leading practices from the Fraud Risk Framework apply during normal

Page 18 GAO-23-106567 Fraud Risk Management
operations, as well as during emergencies. We have previously reported
that emergency-related considerations and adjustments, such as the
heightened risk of fraud in an emergency environment and the need to
adjust risk tolerance in assessing fraud risks, facilitate fraud risk
management in an emergency environment. 31 Figure 4 shows illustrative
examples of fraud risks and schemes applicable to an emergency
environment.

31We also have ongoing work developing a framework to provide principles and practices
that can help federal managers mitigate improper payments in emergency assistance
programs. Specifically, the framework will incorporate standards for internal controls and
for financial and fraud risk management practices as well as requirements from relevant
laws and guidance on improper payments. This work will highlight aspects of managing
improper payments that arise in the context of emergency assistance, which may
necessitate special considerations. This framework is also intended as a resource for
Congress to use when designing new programs or appropriating additional funding in
response to emergencies.

Page 19 GAO-23-106567 Fraud Risk Management
Figure 4: Examples of Fraud Risks and Possible Schemes Targeting Government and Private Businesses and Individuals
during Emergencies

Page 20 GAO-23-106567 Fraud Risk Management
Note: These fraud risks and variations on the schemes may also be present during nonemergency
conditions. Some categories and examples may overlap.
a
While fraud is by definition a criminal act, fraud by criminal organizations refers to nefarious activities
associated with deliberate, organized, and sometimes large-scale schemes to liquidate credit
accounts, launder money, or fraudulently obtain government benefits. Criminals use these large-scale
schemes to fund organized crime, terrorism, and other illicit activities.

We expressed concern in March 2022 about the pace and extent to which
agencies have implemented controls to prevent, detect, and respond to
fraud in a manner consistent with leading practices since FRDAA was
enacted in 2016. 32 Had agencies already been strategically managing
their fraud risks, they would have been better positioned to identify and
respond to the heightened risks that emerged during the COVID-19
pandemic. For example, we reported in September 2020 that
implementing our 2019 recommendation that the Office of Head Start
perform a fraud risk assessment for the Head Start program could help
provide assurances that the $750 million in funding received under the
Coronavirus Aid, Relief, and Economic Security Act will be used by
grantees as intended. 33 As discussed previously, that recommendation
remains open.

Similarly, we expressed concerns that SBA’s initial approach to managing
fraud risks in PPP and the COVID-19 Economic Injury Disaster Loan
program, as well as in its longstanding programs, has not been strategic.
For example, when SBA developed its fraud risk assessments for the
programs in October 2021, PPP had already stopped accepting new
applications, and the COVID-19 Economic Injury Disaster Loan program
would stop at the end of that year. As we mentioned in prior work, fraud
risk assessments are most helpful in developing preventive fraud controls
to avoid costly and inefficient “pay-and-chase” activities. For example,
while the PPP fraud risk assessment can help SBA identify potential fraud
as it continues to review the PPP loans for forgiveness, it could not be
used to identify potential fraud during the application process.

32GAO, Emergency Relief Funds: Significant Improvements Are Needed to Ensure
Transparency and Accountability for COVID-19 and Beyond, GAO-22-105715
(Washington, D.C.: Mar. 17, 2022).
33Pub. L. No. 116-136, 134 Stat. 281, 558 (2020). GAO, COVID-19: Federal Efforts Could
be Strengthened by Timely and Concerted Actions, GAO-20-701 (Washington, D.C.: Sept.
21, 2020).

Page 21 GAO-23-106567 Fraud Risk Management
From July 2015 through December 2022, we made 40 recommendations
to federal agencies to implement changes to align with leading practices
for managing fraud risks in emergency situations or programs. 34 This
includes recommendations related to the themes discussed previously,
such as designating dedicated antifraud entities for emergency programs,
assessing fraud risks to emergency programs, and implementing
antifraud strategies for emergency programs. Of the 40
recommendations, 29 remained open as of January 2023. 35

For example, we have made several recommendations to DOL to
improve fraud risk management in the UI programs, including
recommendations to assess fraud risks and to design and implement an
antifraud strategy to guide its actions. 36 DOL told us it has begun taking
steps to implement these recommendations, such as developing a fraud
risk management process and a fraud risk profile for the UI program.
According to DOL, the UI antifraud strategy we recommended would then
be based on the fraud risk profile, consistent with leading practices. As of
February 2023, DOL planned to finalize its fraud risk profile, including an
examination of existing fraud controls, by the end of calendar year 2023.
Until DOL completes these efforts, it cannot ensure that it is effectively
addressing fraud risks, some of which may persist in the regular UI
program beyond the pandemic. Similarly, addressing open
recommendations in this area can help ensure that federal managers
safeguard public resources while providing needed relief during
emergencies.

Congressional Actions Our prior work has identified actions that Congress can take to strengthen
Can Improve Fraud Risk fraud risk management practices across the government. Specifically, in
March 2022, we identified two matters for congressional consideration
Management
34This includes recommendations related to standing programs and activities to address
emergency situations, such as Federal Emergency Management Agency programs and
use of contracting and purchase cards in disaster response, as well as recommendations
related to programs created or expanded in response to specific disasters or
emergencies, such as the SBA’s Paycheck Protection Program.
35Of the 40 recommendations, 11 were closed as implemented, five were open but had
been partially addressed, and 24 were open and had not been addressed. We follow up
on recommendations we have made and update the status at least once per year.
Experience has shown that it takes time for some recommendations to be implemented.
Of the 40 recommendations, 10 were made on or after January 1, 2022, and all 10
remained open as of January 2023.
36GAO-22-105051 and GAO-23-105523.

Page 22 GAO-23-106567 Fraud Risk Management
that can help improve federal agencies’ fraud risk management efforts
across the five areas we identified. 37 These matters remained open as of
January 2023.

Reinstate the requirement for agencies to report on their antifraud
controls and fraud risk management efforts in agency financial
reports. We previously reported that Congress’s ability to oversee
agencies’ efforts to manage fraud risks is hindered by the lack of fraud-
related reporting requirements. The Fraud Reduction and Data Analytics
Act of 2015 and the Payment Integrity Information Act of 2019 required
agencies to report on their antifraud controls and fraud risk management
efforts in their annual financial reports. However, the requirement to
report such information ended with the fiscal year 2020 annual financial
report. Since then, there has been no similar requirement for agencies to
report on their efforts to manage fraud risks. 38

In March 2022, we recommended that Congress amend the Payment
Integrity Information Act of 2019 to reinstate reporting requirements. 39
Requiring agencies to report annually on their antifraud controls and fraud
risk management efforts will help facilitate congressional oversight and
focus agency attention on strategic fraud risk management—both during
normal operations and emergencies—and help align their efforts with
leading practices. In turn, this may help ensure agencies put sound
controls in place and build payment integrity controls upfront to avoid
costly pay-and-chase activities.

Establish a permanent analytics center of excellence to aid the
oversight community in identifying improper payments and fraud.
Responsibilities for planning and implementing fraud risk management

37In addition to the two actions to improve fraud risk management described here, we
identified eight additional actions Congress can take to strengthen internal controls and
financial management practices across the government and to increase transparency and
accountability of emergency relief funding. See GAO-22-105715. See app. I for a list of
the 10 matters for congressional consideration. These matters were reiterated in a
February 2023 testimony before the House Committee on Ways and Means and a
February 2023 testimony before the House Committee on Oversight and Accountability.
GAO, Unemployment Insurance: DOL Needs to Address Substantial Pandemic UI Fraud
and Reduce Persistent Risks, GAO-23-106586 (Washington, D.C.: Feb. 8, 2023) and
Emergency Relief Funds: Significant Improvements Are Needed to Address Fraud and
Improper Payments, GAO-23-106556 (Washington, D.C.: Feb. 1, 2023).
38GAO-22-105715.

39GAO-22-105715.

Page 23 GAO-23-106567 Fraud Risk Management
and detection activities start with agency management officials; however,
the oversight community plays a critical role in identifying and
investigating suspected fraud. The importance of this role in
nonemergency periods is heightened during emergencies, such as the
COVID-19 pandemic, as agencies work to implement large-scale relief
efforts quickly.

At the outset of the pandemic, there was no permanent, government-wide
analytical capability to help federal agencies identify fraud. 40 In March
2021, the American Rescue Plan Act of 2021 appropriated $40 million to
the Pandemic Response Accountability Committee (PRAC), which
subsequently established the Pandemic Analytics Center of Excellence
(PACE). The role of PACE is to help oversee the trillions of dollars in
federal pandemic-related emergency spending. According to the PRAC,
the goal of PACE is to build an “affordable, flexible, and scalable analytics
platform” to support Offices of Inspectors General during their pandemic-
related work, including beyond the organization’s sunset date in 2025.

However, PACE was not established until more than a year after
agencies began distributing relief funds. The delayed establishment of the
center resulted in the loss of valuable time for Offices of Inspectors
General to help program officials understand fraud risks and identify
potential fraud. In addition, the center is focused on pandemic programs
only and is time-limited.

In March 2022, we recommended that Congress consider establishing a
permanent analytics center of excellence to aid the oversight community

40Previously, this type of analytical capability had existed within the Recovery Operations
Center, established by the Recovery Accountability and Transparency Board. The board,
composed of agency inspectors general, was created by the American Recovery and
Reinvestment Act of 2009 to oversee funds appropriated under the act. We previously
recommended that Congress and the Department of the Treasury preserve the Recovery
Operations Center’s functions, given its proven value in ensuring federal spending
accountability. Congress and the Department of the Treasury did not implement our
recommendations to make such a center permanent, and the Recovery Board and
Recovery Operations Center’s activity terminated at the end of September 2015. See
GAO-22-105715 and GAO, Federal Spending Accountability: Preserving Capabilities of
Recovery Operations Center Could Help Sustain Oversight of Federal Expenditures,
GAO-15-814 (Washington, D.C.: Sept. 14, 2015).

Page 24 GAO-23-106567 Fraud Risk Management
in identifying improper payments and fraud. 41 Without permanent
government-wide analytics capabilities to assist the oversight community,
agencies will have limited resources to apply to nonpandemic programs
to ensure robust financial stewardship, as well as better prepare for
applying fundamental financial and fraud risk management practices to
future emergency funding.

We are sending copies of this report to the appropriate congressional
committees and other interested parties. In addition, the report is
available at no charge on the GAO website at https://www.gao.gov.

If you or your staff have any questions about this report, please contact
Seto Bagdoyan at (202) 512-6722 or BagdoyanS@gao.gov. Contact
points for our Offices of Congressional Relations and Public Affairs may
be found on the last page of this report. GAO staff who made key
contributions to this report are listed in appendix II.

Seto J. Bagdoyan
Director, Forensic Audits and Investigative Service

41GAO-22-105715. In a March 2023 fact sheet, the White House outlined a multipart
proposal to address pandemic fraud. The proposal would establish a permanent antifraud
data and analytics capability analogous to PACE for the inspector general community to
be positioned to oversee future disaster relief and emergencies. The White House, “Fact
Sheet: President Biden’s Sweeping Pandemic Anti-Fraud Proposal: Going After Systemic
Fraud, Taking on Identity Theft, Helping Victims” (Washington, D.C.: Mar. 2, 2023),
accessed March 22, 2023, https://www.whitehouse.gov/Pandemic_Anti-Fraud_Proposal.

Page 25 GAO-23-106567 Fraud Risk Management
Appendix I: Matters for Congressional
Appendix I: Matters for Congressional
Consideration

Consideration

In a March 2022 testimony before the Senate Committee on Homeland
Security and Governmental Affairs, we recommended the following 10
matters for congressional consideration: 1

• Congress should pass legislation requiring the Office of Management
and Budget (OMB) to provide guidance for agencies to develop plans
for internal control that would then immediately be ready for use in, or
adaptation for, future emergencies or crises and requiring agencies to
report these internal control plans to OMB and Congress. (Matter for
Congressional Consideration 1)
• Congress should amend the Payment Integrity Information Act of
2019 to designate all new federal programs making more than $100
million in payments in any one fiscal year as “susceptible to significant
improper payments” for their initial years of operation. (Matter for
Congressional Consideration 2)
• Congress should amend the Payment Integrity Information Act of
2019 to reinstate the requirement that agencies report on their
antifraud controls and fraud risk management efforts in their annual
financial reports. (Matter for Congressional Consideration 3)
• Congress should establish a permanent analytics center of excellence
to aid the oversight community in identifying improper payments and
fraud. (Matter for Congressional Consideration 4)
• Congress should clarify that (1) chief financial officers (CFO) at CFO
Act agencies have oversight responsibility for internal controls over
financial reporting and key financial management information that
includes spending data and improper payment information; and (2)
executive agency internal control assessment, reporting, and audit
requirements for key financial management information, discussed in
an existing matter for congressional consideration in our August 2020

1GAO, Emergency Relief Funds: Significant Improvements Are Needed to Ensure
Transparency and Accountability for COVID-19 and Beyond, GAO-22-105715
(Washington, D.C.: Mar. 17, 2022). In addition, these matters were reiterated in a
February 2023 testimony before the House Committee on Ways and Means and a
February 2023 testimony before the House Committee on Oversight and Accountability.
GAO, Unemployment Insurance: DOL Needs to Address Substantial Pandemic UI Fraud
and Reduce Persistent Risks, GAO-23-106586 (Washington, D.C.: Feb. 8, 2023) and
Emergency Relief Funds: Significant Improvements Are Needed to Address Fraud and
Improper Payments, GAO-23-106556 (Washington, D.C.: Feb. 1, 2023).

Page 26 GAO-23-106567 Fraud Risk Management
Appendix I: Matters for Congressional
Consideration

report, 2 include internal controls over spending data and improper
payment information. (Matter for Congressional Consideration 5)
• Congress should require agency CFOs to (1) submit a statement in
agencies’ annual financial reports certifying the reliability of improper
payments risk assessments and the validity of improper payment
estimates, and describing the actions of the CFO to monitor the
development and implementation of any corrective action plans; and
(2) approve any methodology that is not designed to produce a
statistically valid estimate. (Matter for Congressional Consideration 6)
• Congress should consider legislation to require improper payment
information required to be reported under the Payment Integrity
Information Act of 2019 to be included in agencies’ annual financial
reports. (Matter for Congressional Consideration 7)
• Congress should amend the DATA Act to extend the previous
requirement for agency inspectors general to review the
completeness, timeliness, quality, and accuracy of their respective
agency data submissions on a periodic basis. (Matter for
Congressional Consideration 8)
• Congress should amend the DATA Act to clarify the responsibilities
and authorities of OMB and Department of the Treasury for ensuring
the quality of data available on USAspending.gov. (Matter for
Congressional Consideration 9)
• Congress should amend the Social Security Act to accelerate and
make permanent the requirement for the Social Security
Administration to share its full death data with the Department of the
Treasury’s Do Not Pay working system. (Matter for Congressional
Consideration 10)

2GAO, Federal Financial Management: Substantial Progress Made since Enactment of
the 1990 CFO Act; Refinements Would Yield Added Benefits, GAO-20-566 (Washington,
D.C.: Aug. 6, 2020).

Page 27 GAO-23-106567 Fraud Risk Management
Appendix II: GAO Contact and Staff
Appendix II: GAO Contact and Staff
Acknowledgments

Acknowledgments

Seto J. Bagdoyan, (202) 512-6722 or BagdoyanS@gao.gov
GAO Contact
In addition to the contact named above, Jonathon Oldmixon (Assistant
Staff Director), Erin McLaughlin Villas (Analyst in Charge), Erin Buckley, and
Acknowledgments April Van Cleef made key contributions to this report. Other contributors
include Irina Carnevale, David Dornisch, Paulissa Earl, Colin Fallon,
Barbara Lewis, Flavio Martinez, Maria McMullen, and James Murphy.

Page 28 GAO-23-106567 Fraud Risk Management
The Government Accountability Office, the audit, evaluation, and investigative
GAO’s Mission arm of Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability of the
federal government for the American people. GAO examines the use of public
funds; evaluates federal programs and policies; and provides analyses,
recommendations, and other assistance to help Congress make informed
oversight, policy, and funding decisions. GAO’s commitment to good government
is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is
Obtaining Copies of through our website. Each weekday afternoon, GAO posts on its website newly
GAO Reports and released reports, testimony, and correspondence. You can also subscribe to
GAO’s email updates to receive notification of newly posted products.
Testimony
Order by Phone The price of each GAO publication reflects GAO’s actual cost of production and
distribution and depends on the number of pages in the publication and whether
the publication is printed in color or black and white. Pricing and ordering
information is posted on GAO’s website, https://www.gao.gov/ordering.htm.
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card, MasterCard,
Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Connect with GAO Subscribe to our RSS Feeds or Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.

Contact FraudNet:
To Report Fraud,
Website: https://www.gao.gov/about/what-gao-does/fraudnet
Waste, and Abuse in
Automated answering system: (800) 424-5454 or (202) 512-7700
Federal Programs
A. Nicole Clowers, Managing Director, ClowersA@gao.gov, (202) 512-4400, U.S.
Congressional Government Accountability Office, 441 G Street NW, Room 7125, Washington,
Relations DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
Public Affairs U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, DC 20548

Stephen J. Sanford, Managing Director, spel@gao.gov, (202) 512-4707
Strategic Planning and U.S. Government Accountability Office, 441 G Street NW, Room 7814,
External Liaison Washington, DC 20548

Please Print on Recycled Paper.

File and source

File: gao-23-106567.pdf
Size: 2,433,835 bytes
SHA-256: f4a86fcb253f715c46f71829e87aaa0d7d8f964de4abd8aed9bd8f7b458a7a2b
Our copy: gao-23-106567.pdf
Original: www.gao.gov