GAO-24-106565: Fraud Risk Management: Agencies Should Continue Efforts to Implement Leading Practices
Summary
GAO-24-106565, Fraud Risk Management: Agencies Should Continue Efforts to Implement Leading Practices, a Government Accountability Office Q&A report to congressional committees dated November 1, 2023. It reports results of a GAO survey of the 24 Chief Financial Officers Act of 1990 agencies on steps taken to manage fraud risks; for example, 20 agencies reported designating an entity responsible for fraud risk management. Agencies reported the availability of resources and tools for data analytics among challenges to managing fraud risks. It cites a September 2023 GAO estimate that fraud in the Department of Labor's Unemployment Insurance programs from April 2020 through May 2023 was likely between $100 billion and $135 billion.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“GAO-24-106565: Fraud Risk Management: Agencies Should Continue Efforts to Implement Leading Practices.”
Original at www.gao.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/gao-24-106565-fraud-risk-management-agencies-should-continue-efforts-t-0e2f571b43/
, SHA-256 1a4fef22d68a42a2aea15d89f162acacbe877dab9e3e6f219dfa7e68d6cfa3b0.Full text
U.S. Government Accountability Office
Fraud Risk Management: Agencies Should
Continue Efforts to Implement Leading
Practices
GAO-24-106565
Q&A Report to Congressional Committees
November 1, 2023
Why This Matters Fraud poses a significant risk to the integrity of federal programs and erodes
public trust in government. 1 It contributes to financial and nonfinancial risks that
waste taxpayer dollars, threaten national security, or put consumers at risk.
Additionally, fraud—which involves obtaining something of value through willful
misrepresentation—continues to add to the improper payments made by the
government. 2 The public health crisis, economic instability, and increased flow of
federal funds associated with the COVID-19 pandemic have expanded
opportunities for fraud. The extent of fraud associated with COVID-19 programs
has not yet been fully determined. However, available measures and estimates
indicate substantial levels of fraud occurred. For example, in September 2023,
we estimated that the fraud in the Department of Labor’s Unemployment
Insurance programs during the pandemic—from April 2020 through May 2023—
was likely between $100 billion and $135 billion. 3
In February 2023, the Comptroller General of the United States testified before
the Committee on Oversight and Accountability of the U.S. House of
Representatives that federal agencies’ lag in implementing fraud risk
management was a major factor that contributed to the substantial levels of fraud
in pandemic relief programs. 4 Specifically, he testified that two of the major
factors contributing to agencies’ exposure to fraud in COVID-19 relief programs
were that they (1) did not strategically manage fraud risks; and (2) lacked
appropriate internal controls to prevent, detect, and recover fraudulent and other
improper payments.
In this report, we are providing information on federal agencies’ current fraud risk
management status, including reported agency challenges and incentives to
managing fraud risks. To conduct this work, GAO analyzed results from a survey.
GAO also reviewed narrative responses to select illustrative examples provided
by the agencies to support their responses, as well as relevant prior work,
including the status of related GAO recommendations made from July 28, 2015,
through August 31, 2023. We prepared this report under the authority of the
Comptroller General to conduct work to assist Congress with its oversight
responsibilities.
Key Takeaways • We surveyed the 24 Chief Financial Officers Act of 1990 (CFO Act) 5
agencies on the reported steps taken to manage fraud risks. 6 For example,
20 agencies reported designating an entity to be responsible for fraud risk
management.
• Agencies described challenges that could impede their efforts to manage
fraud risks. For instance, agencies reported the availability of resources (such
Page 1 GAO-24-106565 Fraud Risk Management
as staff and funding) and tools for data analytics as being great or moderate
challenges.
• Agencies described factors that could motivate them to manage fraud risk.
For example, agencies cited the ability to counter reputational impacts as a
factor that would motivate their efforts a lot or somewhat.
• From July 2015 through August 2023, we made 173 recommendations to
over 40 agency or program offices related to certain areas aligned with
leading practices from GAO’s A Framework for Managing Fraud Risks in
Federal Programs (Fraud Risk Framework). 7 As of August 2023, agencies
needed to take additional action to fully address 95 of these
recommendations.
• Our prior work also identified two congressional actions that could strengthen
oversight of federal agencies’ fraud risk management efforts: (1) reinstating
the requirement for agencies to report on their antifraud controls and fraud
risk management efforts in agency financial reports and (2) establishing a
permanent analytics center of excellence to aid the oversight community in
identifying improper payments and fraud.
What resources and To help agencies and federal program managers strategically manage their fraud
recommendations has risks—both during normal operations and in emergencies—GAO published the
GAO issued to help Fraud Risk Framework in July 2015. The Fraud Risk Framework provides a
agencies manage fraud comprehensive set of leading practices—organized into four components—to
guide agency managers when developing efforts to combat fraud (see fig.1).
risks?
Figure 1: The Fraud Risk Management Framework
Additionally, the Fraud Reduction and Data Analytics Act of 2015 (FRDAA)
required the Office of Management and Budget (OMB) to incorporate the leading
practices from the Fraud Risk Framework into guidelines for federal agencies. 8 In
March 2020, the Payment Integrity Information Act of 2019 (PIIA) replaced
FRDAA but maintained the requirements for OMB to provide guidance to
agencies in implementing controls that incorporate the Fraud Risk Framework. 9
In January 2022, we issued our antifraud resource—an online interactive tool that
can help inform federal officials, Congress, the media, and the public about key
characteristics of fraud schemes and provide resources for combating them. 10
Page 2 GAO-24-106565 Fraud Risk Management
Our prior work has highlighted areas in which federal agencies need to take
additional actions to help ensure they are effectively managing fraud risks
consistent with leading practices, such as by designating an entity to lead fraud
risk management activities. Specifically, from July 2015 through August 2023, we
made 20 recommendations to federal agencies in this area. These include
recommendations to dedicate an entity to oversee fraud risk management
activities or to document the fraud risk management responsibilities of the
antifraud entity. Of the 20 recommendations, 18 had not been implemented as of
August 2023.
In addition, our prior work has included recommendations for agencies to use
data analytics to better manage fraud risk. Specifically, from July 2015 through
August 2023, we made 47 recommendations to federal agencies in this area.
These include recommendations to design and implement data-analytics
activities to prevent and detect fraud, such as using data matching to verify self-
reported information. Of the 47 recommendations, 25 had not been implemented
as of August 2023.
How many agencies Twenty of the 24 CFO Act agencies stated that they have an entity that is
have designated an responsible for fraud risk management activities (see fig. 2).
entity that is
Figure 2: Chief Financial Officers Act Agencies That Reported Designating an Entity to Be
responsible for Responsible for Fraud Risk Management Activities
managing fraud risks?
Of the four CFO Act agencies that responded that there is no entity responsible
for fraud risk management activities within their agency, one reported plans to
designate such an entity in the future.
As discussed in GAO’s Fraud Risk Framework, when agencies formally
designate an entity to design and oversee fraud risk management activities, their
efforts can be more visible across the agency, particularly to executive
leadership. Such an entity can demonstrate a senior-level commitment to
integrity and combating fraud.
Page 3 GAO-24-106565 Fraud Risk Management
What steps have CFO Act agencies reported their status in implementing other leading practices
agencies taken to from GAO’s Fraud Risk Framework, such as identifying and assessing risks to
implement other determine a fraud risk profile (see fig. 3).
leading practices from
Figure 3: Chief Financial Officers Act Agencies’ Reported Status in Implementing Other
GAO’s Fraud Risk Leading Practices from GAO’s Fraud Risk Framework
Framework?
Twenty of the 24 CFO Act agencies reported that they design and implement
specific control activities to prevent and detect fraud on a regular and ongoing
basis. For example, in response to our survey, the Department of Energy
reported that it has a Data Analytics Working Group that is implementing a data
analytics program to enhance the detection of fraud, payment integrity, and data-
driven decision-making. The Fraud Risk Framework cites data matching, data
mining, and other data analytics as examples of control activities that can help to
prevent and detect fraud. Such techniques also can enable agencies to identify
improper payments that have already been awarded, thus assisting agencies in
recovering these dollars.
What factors are CFO Act agencies’ survey responses indicated the following factors to be
important to agencies extremely or very important when managing fraud risks:
when managing fraud
risks? • Resources to dedicate to fraud risk management
• The amount lost to fraud
• Potential for bad publicity or reputational impact
Page 4 GAO-24-106565 Fraud Risk Management
Figure 4 shows additional information from CFO Act agencies about the
importance of various factors to the maturity of their fraud risk management
efforts.
Figure 4: Factors Chief Financial Officers (CFO) Act Agencies Reported as Important to the
Maturity of their Fraud Risk Management Efforts
aOne of the 24 CFO Act agencies did not provide a response for this factor within the survey.
What challenges do CFO Act agencies’ survey responses indicated the following factors as a great or
agencies face in moderate challenge to their fraud risk management efforts:
managing fraud risks?
• Having available staffing, funding, or other resources to conduct fraud risk
management activities
• Having and using tools and techniques for data analytics
• Having available expertise to conduct fraud risk management activities
Figure 5 shows additional information from CFO Act agencies about reported
challenges to their fraud risk management efforts.
Page 5 GAO-24-106565 Fraud Risk Management
Figure 5: Reported Challenges to Chief Financial Officers Act Agencies’ Fraud Risk
Management Efforts
As shown in figure 5, 21 of the 24 CFO Act agencies considered the factor
“having and using tools and techniques for data analytics” a great or moderate
challenge to managing fraud risks. For example, the National Aeronautics and
Space Administration stated it could benefit from investments in data analytics
tools and capabilities to identify current fraud schemes.
When we surveyed federal agencies in 2018, including the 24 CFO Act agencies,
the top challenges they reported generally related to staffing and resources.
Specifically, those agencies most frequently indicated the following factors as a
great or moderate challenge: (1) availability of resources, (2) limited tools and
techniques for data analytics, and (3) lack of available expertise. 11
Page 6 GAO-24-106565 Fraud Risk Management
What factors could CFO Act agencies’ survey responses indicated the following factors as highly or
strengthen an agency’s somewhat motivating to their fraud risk management efforts:
efforts to manage fraud
risks? • Congressionally directed prioritization of budget funds for program
integrity improvements
• Ability to counter reputational impacts if fraud is found
• Ability to demonstrate financial returns from fraud risk management
Figure 6 shows additional information about factors that the agencies reported.
Figure 6: Factors Chief Financial Officers Act Agencies Reported as Motivating to
Increasing the Maturity of Their Fraud Risk Management Efforts
As shown in figure 6, 19 of the 24 CFO Act agencies reported that the “ability to
counter reputational impacts if fraud is found” could motivate an agency’s fraud
risk management efforts a lot or somewhat. For example, the Department of
Homeland Security told us that it is driven to keep fraud to a minimum because
fraud, waste, and abuse would reduce the public’s confidence in the department.
Our prior work has also identified actions that Congress can take to strengthen
fraud risk management practices across the government. 12 The first would be to
reinstate the requirement for agencies to report on their antifraud controls and
fraud risk management efforts in agency financial reports. This can help facilitate
Page 7 GAO-24-106565 Fraud Risk Management
congressional oversight and focus agency attention on strategic fraud risk
management—both during normal operations and in emergencies—and help
align their efforts with leading practices. 13 The second would be to establish a
permanent analytics center of excellence to aid the oversight community in
identifying improper payments and fraud. Establishing such capability would
further aid the oversight community’s efforts to assess and identify fraud, as well
as to help agencies identify areas of potential fraud risks so that they can
implement preventive and detective controls or evaluate existing controls for
opportunities for improvement. Creating a permanent government-wide analytics
capability could also yield future financial benefits, both through identifying
potentially improper and fraudulent payments that the government could seek to
recover and by identifying vulnerabilities that the government could address to
prevent similar future payments.
Agency Comments We provided a draft of this report to OMB for review and comment. OMB did not
have any comments on the report.
How GAO Did This We surveyed the 24 CFO Act agencies for information on their fraud risk
Study management efforts, directing the survey to the CFO of each agency. We asked
that the CFOs, or their designee(s), answer the questionnaire at the agency-wide
level, relying on their perspective, as well as coordinating their responses with
appropriate agency staff. To develop the questionnaire, we reviewed the leading
practices from GAO’s Fraud Risk Framework and our 2018 survey on agencies’
status in implementing fraud risk management requirements. We incorporated
comments from internal and external reviewers, including our survey specialist
and OMB officials. We then pretested the questionnaire with five agencies, using
cognitive interviewing techniques, and modified the survey instrument based on
the comments we received.
We fielded the survey from April 25, 2023, through June 8, 2023. We received
questionnaire responses from all 24 agencies, for a response rate of 100
percent. Our survey results reflect the information provided by and the opinions
of the agency officials who participated in our survey. Our survey asked
questions at the departmental level. However, responses may reflect activities at
the program or operation level or for multiple programs or operations. Responses
do not necessarily reflect that CFO Act agencies are in alignment with leading
practices from GAO’s Fraud Risk Framework.
We also analyzed closed-end responses and reviewed narrative responses to
select illustrative examples provided by the agencies to support their responses.
In addition, we reviewed relevant GAO reports for (1) the status of related GAO
recommendations made from July 28, 2015, which coincides with the issuance of
the Fraud Risk Framework, through August 31, 2023; and (2) examples of steps
agencies have taken to implement fraud risk management activities, including
challenges and incentives to preventing, detecting, and responding to fraud. We
also interviewed OMB officials about these activities.
We conducted this performance audit from January 2023 to November 2023 in
accordance with generally accepted government auditing standards. Those
standards require that we plan and perform the audit to obtain sufficient,
appropriate evidence to provide a reasonable basis for our findings and
conclusions based on our audit objectives. We believe that the evidence
obtained provides a reasonable basis for our findings and conclusions based on
our audit objectives.
Page 8 GAO-24-106565 Fraud Risk Management
List of Addressees
The Honorable Gary C. Peters
Chairman
The Honorable Rand Paul, M.D.
Ranking Member
Committee on Homeland Security and Governmental Affairs
United States Senate
The Honorable James Comer
Chairman
The Honorable Jamie Raskin
Ranking Member
Committee on Oversight and Accountability
House of Representatives
GAO Contact For more information, contact: Rebecca Shea, Director, Forensic Audits and
Information Investigative Service, at (202) 512-6722 or SheaR@gao.gov.
Chuck Young, Managing Director, Public Affairs, YoungC1@gao.gov, (202) 512-
4800
A. Nicole Clowers, Managing Director, Congressional Relations,
ClowersA@gao.gov, (202) 512-4400
Staff Acknowledgments: Jonathon Oldmixon (Assistant Director), Paulissa Earl
(Analyst in Charge), David Dornisch, Colin Fallon, Kristina Hammon, Barbara
Lewis, Brooke Linsenbardt, Lydie Loth, Maria McMullen, James Murphy, Tina
Paek, Isaac Pavkovic, Noah Riley, Sylvia Simioni, and Erin Villas.
Connect with GAO on Facebook, Flickr, Twitter, and YouTube. Subscribe to our
RSS Feeds or Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.
This work of the United States may include copyrighted material, details at
https://www.gao.gov/copyright
Endnotes
1Whether an act is fraudulent is determined through the judicial or other adjudicative system and is
beyond management’s professional responsibility for assessing risk. GAO, Standards for Internal
Control in the Federal Government, GAO-14-704G (Washington, D.C.: Sept. 10, 2014).
2An improper payment is defined as any payment that should not have been made or that was
made in an incorrect amount (including overpayments and underpayments) under statutory,
contractual, administrative, or other legally applicable requirements. It includes any payment to an
ineligible recipient, any payment for an ineligible good or service, any duplicate payment, any
payment for a good or service not received (except for such payments where authorized by law),
and any payment that does not account for credit for applicable discounts. 31 U.S.C. § 3351(4).
While not all improper payments are the result of fraud, all payments made as a result of fraudulent
activities are considered to be improper payments. GAO, Fraud Risk Management: Key Areas for
Federal Agency and Congressional Action, GAO-23-106567 (Washington, D.C.: Apr. 13, 2023).
3GAO, Unemployment Insurance: Estimated Amount of Fraud during Pandemic Likely Between
$100 Billion and $135 Billon, GAO-23-106696 (Washington, D.C.: Sept. 12, 2023).
4GAO, Emergency Relief Funds: Significant Improvements Are Needed to Address Fraud and
Improper Payments, GAO-23-106556 (Washington, D.C.: Feb. 1, 2023).
5The 24 agencies listed in the Chief Financial Officers Act of 1990 (CFO Act), as amended, are the
Departments of Agriculture, Commerce, Defense, Education, Energy, Health and Human Services,
Homeland Security, Housing and Urban Development, the Interior, Justice, Labor, State,
Page 9 GAO-24-106565 Fraud Risk Management
Transportation, the Treasury, and Veterans Affairs, as well as the Agency for International
Development, Environmental Protection Agency, General Services Administration, National
Aeronautics and Space Administration, National Science Foundation, Nuclear Regulatory
Commission, Office of Personnel Management, Small Business Administration, and Social Security
Administration. Pub. L. No. 101-576, § 205, 104 Stat. 2838 (1990), codified as amended at 31
U.S.C. § 901(b). The CFO Act also established the CFO Council and designated the CFOs in the
act, as well as senior officials of the Office of Management and Budget (OMB) and the Department
of the Treasury, to work on such matters as consolidation and modernization of financial systems.
31 U.S.C. § 901 note.
6Survey Questions: Does your agency have a designated entity (or entities) that is responsible for
fraud risk management activities? What is your agency’s status in (a) creating an organizational
culture to combat fraud at all levels of the agency, (b) identifying and assessing risks to determine
the fraud risk profile for programs or operations, (c) designing and implementing specific control
activities to prevent and detect fraud, (d) monitoring fraud risk management activities for programs
and operations, (e) evaluating the monitoring process and overall outcomes of fraud risk
management activities, and (f) adapting fraud risk management activities based on the results of
your evaluations? How important, if at all, are the following to your agency’s fraud risk management
maturity level that you reported in the prior section? The “prior section” refers to the preceding
survey questions on the steps agencies have taken to implement leading practices from GAO’s
Fraud Risk Framework. How much of a challenge, if at all, does each factor pose to your agency’s
fraud risk management efforts? How much, if at all, would the following factors motivate your
agency to increase its maturity in fraud risk management efforts?
7GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP (Washington,
D.C.: July 28, 2015).
8Pub. L. No. 114-186, 130 Stat. 546 (2016).
9The Office of Management and Budget (OMB) incorporated guidelines to meet the requirements of
the Fraud Reduction and Data Analytics Act of 2015 into its July 2016 update of Circular A-123,
Management’s Responsibility for Enterprise Risk Management and Internal Control. OMB,
Management’s Responsibility for Enterprise Risk Management and Internal Control, OMB Circular
A-123 (Washington, D.C.: July 15, 2016). The Payment Integrity Information Act of 2019 requires
these guidelines to remain in effect, subject to modification by OMB as necessary and in
consultation with GAO. Pub. L. No. 116-117, § 2(a), 134 Stat. 113, 131-132 (2020), codified at 31
U.S.C. § 3357.
10GAO, “GAO Antifraud Resource” (Washington, D.C.: Jan. 10, 2022), accessed September 2023,
https://gaoinnovations.gov/antifraud_resource/. We developed GAO’s Antifraud Resource to help
federal officials and the public better understand and help combat federal fraud. The resource
includes GAO’s Conceptual Fraud Model, which was developed to determine the nature of known
fraud, both financial and nonfinancial, that affects federal programs and operations. The primary
intended users of GAO’s Antifraud Resource are managers in the U.S. federal government;
however, it may also be applicable to state, local, and foreign government agencies, as well as
nonprofit entities and others responsible for fraud risk management.
11In 2018, we found that agencies identified challenges with the Office of Management and
Budget’s (OMB) Fraud Reduction and Data Analytics Act of 2015 implementation guidelines, which
are incorporated into OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk
Management and Internal Control. GAO recommended that OMB enhance its agency guidelines for
establishing internal controls, and OMB did so. For this report, CFO Act agencies indicated within
their survey responses that the factor “sufficiency of OMB guidelines on implementing fraud risk
management” is less of a challenge when conducting their fraud risk management activities. GAO,
Fraud Risk Management: OMB Should Improve Guidelines and Working-Group Efforts to Support
Agencies’ Implementation of the Fraud Reduction and Data Analytics Act, GAO-19-34
(Washington, D.C.: Dec. 4, 2018).
12GAO, Emergency Relief Funds: Significant Improvements Are Needed to Ensure Transparency
and Accountability for COVID-19 and Beyond, GAO-22-105715 (Washington, D.C.: Mar. 17, 2022).
13The Fraud Reduction and Data Analytics Act of 2015 and the Payment Integrity Information Act of
2019 required agencies to report on their antifraud controls and fraud risk management efforts in
their annual financial reports. However, the requirement to report such information ended with the
fiscal year 2020 annual financial report and, since then, there has been no similar requirement for
agencies to report on their efforts to manage fraud risks. GAO-22-105715.
Page 10 GAO-24-106565 Fraud Risk Management
File and source
- File
- d24106565.pdf
- Size
- 652,342 bytes
- SHA-256
- 1a4fef22d68a42a2aea15d89f162acacbe877dab9e3e6f219dfa7e68d6cfa3b0
- Our copy
- d24106565.pdf
- Original
- www.gao.gov