Background

In an effort to mitigate the impact of the COVID-19 pandemic on the nation's public health and economy, Congress passed a series of emergency spending bills.¹ Enacted between March 2020 and March 2021, these bills provided more than $4.6 trillion to individuals, businesses, and domestic government bodies to prepare for and respond to the pandemic.² The largest categories of pandemic expenditures were payments to individuals (including tax credits and rebates); business loans; payments to state, local, tribal, and territorial governments; unemployment compensation; and public health and social services.³ While the federal COVID-19 Public Health Emergency declaration ended May 11, 2023,⁴ billions of dollars in pandemic funding remained unexpended months later.⁵

Improper Payments Requirements

Programs that receive pandemic funding, like all federal programs, are subject to the requirements of the Payment Integrity Information Act (PIIA, P.L. 116-117).⁶ PIIA mandates that agencies implement internal controls⁷ that mitigate the risk of improper payments.⁸ Among other things, PIIA requires agencies to

• establish pre- and post-payment review procedures that help prevent and detect improper payments,
• recover overpayments when cost-effective,
• assess the risk of significant⁹ improper payments for each program they manage,
• develop and report estimates of improper payments for programs deemed to be at risk,
• publish and implement corrective action plans to address weaknesses in payment integrity, and
• report improper payments estimates of less than 10% for each program.

PIIA specifies that federal agencies, as well as state governments and contractors that administer federal funds, must utilize the Department of the Treasury's Do Not Pay Initiative (DNP) prior to issuing payments or making awards. DNP allows a user to check multiple databases at one time to verify the eligibility or identity of a vendor, grantee, loan recipient, or beneficiary. Pre-payment reviews are generally considered essential internal controls, because identifying and attempting to recover improper payments after they are made—often referred to as the "pay and chase" approach—is inefficient and costly.¹⁰

Fraud Risk Management

The Fraud Reduction and Data Analytics Act of 2015 (FRDAA, P.L. 114-186), which was enacted in June 2016, mandated additional controls for reducing the risk of a particular subset of improper payments: fraud. Fraud occurs when applicants obtain funds by willfully misrepresenting themselves. The FRDAA required agencies to establish a fraud risk management framework that incorporated the standards and leading practices established by the Government Accountability Office (GAO) in its publication, "A Framework for Managing Fraud Risks in Federal Programs."¹¹ Under the framework, agencies must do the following:

• 1. Create an organizational structure and culture conducive to fraud risk management. In particular, each agency should designate an entity to lead fraud risk management activities and ensure it has the resources to do so.
• 2. Plan regular fraud risk assessments and assess risks to determine fraud risk profiles. The assessments should be tailored to each program and should consider the suitability of existing controls.
• 3. Design and implement strategies with specific control activities to mitigate assessed fraud risks and collaborate to help ensure effective implementation. Strategies should focus on preventive control activities and involve both subject matter and data analysis experts.
• 4. Evaluate outcomes using a risk-based approach and adapt activities to improve fraud risk management. Agencies should collect and analyze data on potential and detected fraud and use the results to improve fraud management activities. Data analytic tools should be employed to the maximum extent possible.

Leveraging Data for Payment Integrity¹²

The GAO framework emphasizes the need for fraud analytics. Analyzing data has long been viewed as a tool in both the prevention and the detection of improper payments. Over time, federal agencies have expanded the types of analytic methods used for this purpose to include data matching and data mining.¹³ These methods range from being used to detect "common fraud" to "organized fraud."¹⁴ The increasing volume of data available for analysis—including from electronic records, bank transfers, and electronic communications—may contribute to the use of artificial intelligence techniques in payment integrity efforts.¹⁵ In addition to machine learning and natural language processing, among other possible techniques, agencies may also use predictive analytics to prevent and detect improper payments.¹⁶

Data Matching

Since at least the 1970s, federal agencies have shared, "matched," and compared data to identify possible improper payments. Matching data in this context may assist in identifying inconsistencies or irregularities among separate sources of information. Various statutes require agencies to exchange and match data on individuals for specific purposes, such as determining eligibility for a federal benefit program.¹⁷

The Computer Matching and Privacy Protection Act of 1988 (CMPPA; P.L. 100-503) has enabled some of this matching by establishing administrative requirements for agencies that conduct matching programs.¹⁸ While the CMPPA is sometimes cited as a hinderance to using data to ensure payment integrity,¹⁹ Congress has permitted some modifications to the CMPPA's requirements to explicitly enable the prevention and detection of improper payments.²⁰

Access to some data in DNP requires compliance with the CMPPA's provisions related to "matching agreements."²¹ However, Treasury, in consultation with the Office of Management and Budget (OMB), can waive the requirement for matching agreements.²²

Data Analytics and Automation

Beyond matching data, there are other approaches to how data can be used in the prevention of improper payments. OMB's Circular No. A-123, "Requirements for Payment Integrity Improvement," advises agencies to use data analytics to identify trends, patterns, anomalies, and exceptions within data to identify indicators of improper payments.²³ These analytic methods include rule-based analytics, anomaly detection, predictive analytics, network/link analytics, and text analytics.²⁴ Please see the Appendix for more detail on these methods.

In addition to the methods outlined in Circular No. A-123, some agencies use intelligent automation and robotic process automation (also called robotic processing automation) in payment processes.²⁵ In general, this method is designed to automate usually rule-based processes that may have been performed manually across multiple information systems, such as performing calculations, validating information, and matching data that corresponds to eligibility criteria. The joint alert points to some roles within an agency that may implement automation and analytic methods, including the chief information officer, the chief data officer, and program managers, as well as staff with analytics and data science skills.²⁶

Recovery Operations Center

The American Recovery and Reinvestment Act of 2009 (ARRA; P.L. 111-5) led to the establishment of one of the first multi-agency data analytics platforms. ARRA provided $862 billion to stimulate the job economy during the recession that followed the 2008 financial crisis. A central body comprised of more than a dozen agency inspectors general was created to coordinate oversight of ARRA funding, called the Recovery and Accountability Transparency Board.²⁷ A component of the board was the Recovery Operations Center (ROC), which used data analytics to monitor ARRA spending. ROC staff shared their data and tools with the inspector general (IG) community and applied data matching, text mining, and other techniques to review 1.7 million entities that received federal funds and successfully identify a range of fraudulent activities.²⁸ While some members of the oversight community argued that the ROC could serve as the basis for a centralized data analytics agency that could support IGs' anti-fraud efforts beyond the ARRA, the ROC was shuttered when the board sunset in 2015.²⁹

Widespread Weaknesses Identified in Pre-Pandemic Audits

In the years leading up to the pandemic, auditors reported widespread, persistent non-compliance with improper payments requirements at the 24 agencies subject to the Chief Financial Officers Act (P.L. 101-576), which have historically accounted for 99% of annual improper payments.³⁰ Every year between FY2011 and FY2018, except for one, at least-half of these agencies were non-compliant with improper payments requirements.³¹ Among the weaknesses that auditors identified were that some agencies

• Lacked internal controls to address known risks. The Unemployment Insurance (UI) program was repeatedly deemed vulnerable to fraud from identity thieves and organized criminal groups that apply for benefits using stolen personally identifiable information.³²
• Did not publish improper payments estimates for all programs and activities deemed at risk. Some multi-billion-dollar federal programs, such as Temporary Assistance to Needy Families and the Premium Tax Credit, did not consistently report improper payments estimates.³³
• Published invalid improper payments estimates. The Department of Defense has published unreliable improper payments estimates for all of its programs for 12 consecutive years, starting in FY2010.³⁴ The Department of Labor (DOL) underestimated the amount of improper payments in the UI program for four consecutive years, starting in FY2017.³⁵
• Had not performed required fraud risk assessments. The Department of Health and Human Services had not conducted a comprehensive fraud risk assessment of the Head Start program by 2019, heightening the risk of fraud and improper payments.³⁶

As a consequence of these and other weaknesses, government-wide improper payments increased 45% during the 2010s, peaking at $175 billion in FY2019.³⁷

Control Weaknesses in Emergency Spending Programs

For decades, auditors have reported that weak internal controls over emergency funding have left the government vulnerable to improper payments, especially fraud.³⁸ Disaster situations are unique in that there may be a perceived conflict between expediting the disbursal of funds and implementing safeguards to ensure that funds are used as intended by Congress.³⁹ In 2018, the Small Business Administration (SBA) IG described the challenges SBA faced in implementing disaster relief programs:

Unfortunately, the need to disburse such loans quickly poses many complications and may create opportunities for dishonest applicants to commit fraud. OIG and GAO audits have identified that SBA's disaster loans have been vulnerable to fraud and losses in the past because loan transactions are often expedited in order to provide quick relief to disaster survivors, and disaster lending personnel, who are brought into the workforce quickly, lack sufficient training or experience. Additionally, the volume of loan applications may overwhelm SBA's resources and its ability to exercise careful oversight of lending transactions.⁴⁰

In this environment, agencies may not accurately identify all of the risks to program funding, and therefore their internal controls may not adequately protect against fraud and improper payments.⁴¹ For example, in the 2000s and 2010s, some agencies that administered disaster funding

• Did not establish internal control plans that fully identify and mitigate programmatic risks. The Additional Supplemental Appropriations for Disaster Relief Requirements Act of 2017 (P.L. 115-72) required each agency that received funds to submit an internal control plan specific to disaster spending. One agency did not submit a plan, one agency's plan did not address the risk of fraud, and another agency's plan was one paragraph—too incomplete to ensure that effective policies were outlined.⁴²
• Lacked effective pre-payment verification processes. SBA failed to implement adequate preventive controls to ensure that only eligible borrowers obtained certain emergency loans—the eligibility of nearly 85% of borrowers could not be confirmed in post-payment reviews.⁴³
• Did not ensure state and local entities that administer federal emergency programs met federal standards. Some state education agencies that received disaster recovery funding from the Department of Education lacked proper processes to detect fraud.⁴⁴

Throughout the 2010s, GAO issued a series of "priority" recommendations to OMB that would mitigate the risks associated with fraud, improper payments, and internal control weaknesses in emergency programs.⁴⁵ Seven of those priority recommendations remained open in April 2019, just months before the onset of COVID-19.

Improper Payments in Pandemic Programs

The scale of funding provided in response to the pandemic significantly exceeded that of previous federal emergency relief initiatives. Agencies received more than five times as much funding for pandemic relief—$4.6 trillion—than they did under ARRA. Overall, 66 programs received at least $1 billion in pandemic funding, and 173 programs received at least $100 million.⁴⁶ Funding was provided both to new programs that were established as part of the federal response to COVID-19 and to programs that existed prior to the pandemic. The funding for several programs, such as UI, is jointly administered by federal and state agencies. Table 1 shows the largest pandemic spending areas, the federal agency that administers each program, and the amount of funding each program received.

Federal and state agencies were tasked with getting pandemic funds out quickly while also ensuring that proper safeguards were in place.⁴⁷ Agencies generally disbursed funds rapidly for most pandemic programs.⁴⁸ SBA issued the equivalent of 14 years' worth of lending in 14 days,⁴⁹ for example, and the Internal Revenue Service (IRS) issued 157 million economic impact payments (EIPs) less than two months after the EIP program was established under the Coronavirus Aid, Relief, and Economic Security Act (CARES Act).⁵⁰

In addition to providing funding for relief programs, the CARES Act established the Pandemic Response Accountability Committee (PRAC), a body of 21 IGs that was to play an oversight role similar to that of the Recovery and Accountability Transparency Board. PRAC and the Office of Federal Financial Management within OMB jointly issued an "alert" on using automation and data analytics to reduce payment integrity risks, noting that the pandemic highlighted preexisting issues.⁵¹ The alert also encouraged IGs to make use of a data analytics center established within PRAC a little more than a year after agencies began distributing relief funds, the Pandemic Analytics Center of Excellence (PACE).⁵²

At the outset of the pandemic, many pandemic programs lacked fundamental pre-payment, post-payment, and fraud management controls, and some agencies responded slowly to the need to rectify these weaknesses.⁵³ As a consequence, hundreds of billions of dollars may have been lost to fraud and other improper payments,⁵⁴ including billions to transnational criminal organizations and violent street gangs within the United States.⁵⁵

Lack of Effective Pre-Payment Controls

PIIA requires agencies to establish effective pre-payment controls, including the use of DNP. Several agencies, in order to expedite the disbursal of funds, allowed applicants to self-certify their eligibility for pandemic assistance. For example, under the Emergency Rental Assistance program, Treasury awarded grants to state and local governments, which in turn awarded the funds for rent, utilities, and home energy costs to renters under financial stress. Treasury did not require any documentation from applicants that would verify either that they had rental agreements in place or that they met the financial need criteria for the program. The eligibility information was self-certified.⁵⁶ While allowing self-certification reduced the administrative burden on applicants, it also exposed the program to significant risks of fraud and improper payments.

Similarly, SBA did not verify the information that applicants provided when they sought loans from two of the largest pandemic programs: Economic Injury Disaster Loans (EIDL) and the Paycheck Protection Program (PPP). EIDL offered low-interest loans to small businesses (including nonprofits) to help cover their operating expenses. To qualify for EIDL assistance, a business had to have been operating on or before January 31, 2020—information that the applicant was allowed to self-certify on the application. Similarly, applicants for SBA's PPP loans, which were intended to incentivize businesses to retain their workers, could self-attest that their organizations qualified for assistance. Michael Horowitz, the IG for the Department of Justice and the chair of PRAC, said the lack of verification directly contributed to the $200 billion of estimated fraud in the EIDL and PPP programs:⁵⁷

If you open up the bank window and say, give me your application and just promise me you are who you say you are, you attract a lot of fraudsters, and that's what happened here.⁵⁸

In one example, a fraud ring of 14 individuals submitted 75 applications for PPP loans in 2020.⁵⁹ By providing falsified data, bank records, and tax forms—none of which SBA verified—the ring obtained more than $20 million in assistance.⁶⁰

Many of the state agencies that determine UI eligibility—often called state workforce agencies—allowed UI applicants to self-certify their information for pandemic funds. The CARES Act provided first-time UI benefits to an expanded pool of eligible workers, supplemented the UI benefits of all unemployed workers, and extended the time workers were eligible for unemployment compensation. State agencies were quickly overwhelmed with applications. Initial claims jumped from 282,000 on March 20, 2020, to 57.4 million five months later.⁶¹ According to the DOL IG, state agencies were unprepared to process so many claims and did not initially apply standard internal controls, such as verifying eligibility and identity information before issuing payments.⁶² As a consequence of allowing applicants to self-certify their information, fraudsters stole between $100 billion and $135 billion in UI pandemic funds.⁶³

Pre-payment controls also failed due to inadequate services provided by federal contractors. The Health Resources and Services Administration (HRSA), a component of the Department of Health and Human Services, managed the Uninsured Program, which reimbursed health care providers for provision of COVID-19-related services to uninsured individuals. A contractor was responsible for confirming that a patient did not have insurance prior to reimbursing a provider. The contractor, however, tried to verify a patient's insurance status only when the provider submitted a Social Security Number. If no such number was provided, the contractor automatically issued a payment.⁶⁴ Moreover, the contractor misidentified some patients who did have insurance as being uninsured and paid providers for services that private insurance should have covered.⁶⁵ Due in large part to weaknesses in data quality and pre-payment eligibility assessments, the Uninsured Program issued an estimated $784 million in improper payments, the equivalent of a 19% error rate.⁶⁶

In one instance, an agency issued millions of payments to individuals whom it had identified as deceased.⁶⁷ The CARES Act established a refundable tax credit, the 2020 Recovery Rebates for Individuals program, which provided a refundable tax credit of up to $1,200 for eligible individuals and an additional $500 for each dependent minor in an eligible individual's household. The IRS was authorized to issue advance payments for the tax credit, referred to as EIPs. Four months after the program was established, the IRS had issued 2.2 million EIP payments worth $3.5 billion to individuals whom the IRS knew were deceased.⁶⁸ The IRS initially argued that the payments were proper because the CARES Act did not specify that dead people were ineligible, although it later issued guidance clarifying that deceased individuals did not qualify for EIPs.⁶⁹ In this instance, the agency performed a pre-payment review but interpreted the statute in such a way as to allow millions of improper payments to be issued.

Lack of Effective Post-Payment Controls

Post-payment controls, such as reviewing supporting documentation and payment data, are important tools for detecting and recovering improper payments. They are particularly important for detecting fraud and improper payments in programs that permitted applicants to self-certify identity or eligibility. However, some agencies did not establish and implement effective post-payment controls in a timely manner. For example, the CARES Act, enacted in March 2020, established both the ERA program and the Provider Relief Fund, a HRSA-managed program that reimbursed health care providers for costs associated with diagnosing, testing, or treating COVID-19. Twenty months after the CARES Act was passed, Treasury had issued more than $28 billion under ERA but had not established post-payment procedures to verify the eligibility and accuracy of payments to renters and identify and recover overpayments.⁷⁰ Similarly, by September 2021, HRSA had issued over $132 billion from the Provider Relief Fund but had not developed plans to identify or recover overpayments.⁷¹

State agencies that implemented federal pandemic programs also did not implement effective post-payment controls in some cases. DOL's Employment and Training Administration, which oversees federal funds for UI, issued guidance in May 2020 that specified the post-payment controls states must implement to verify that payments were being made to eligible individuals and to recover overpayments.⁷² Under this guidance, states must (1) verify eligibility information provided by beneficiaries by cross-matching it with employment and income data sources, and (2) recover overpayments through various offset programs.⁷³ The DOL IG determined that non-compliance with this guidance was widespread—40% of state agencies did not perform the required cross-matches and 38% did not attempt to recover overpayments through offset programs.⁷⁴

Related to the recovery of overpayments is the collection of delinquent loans. Agencies commonly attempt to collect loan debts by repossessing the collateral (if any) used for the loan, litigation, or offset programs managed by Treasury.⁷⁵ The Debt Collection Improvement Act of 1996 (P.L. 104-134) requires credit granting agencies to refer delinquent debt to Treasury for collection, unless it would cost more to recover the funds than the amount that would be charged off. SBA managed two of the largest pandemic loan programs, EIDL and PPP, and chose not to pursue collection on delinquent loans under $100,000. SBA justified this decision, in large part, by arguing that it would not be cost effective to attempt to collect on the loans, which the SBA IG estimates to total $1.1 billion for PPP⁷⁶ and as much as $62 billion for EIDL.⁷⁷ The SBA IG argued that the agency's decision was not justified because it did not perform an adequate cost-benefit analysis on collecting debt for either program.⁷⁸

Lack of Fraud Risk Management Controls

Agencies were required to begin implementing the standards and leading practices of the GAO framework in 2016. The lack of progress in subsequent years meant some agencies "were not adequately prepared to prevent fraud when the pandemic began."⁷⁹ This is particularly true for the two agencies with the largest fraud losses: SBA (PPP and EIDL) and DOL (UI). According to auditors, SBA and DOL shared three significant weaknesses in their fraud controls.

Each agency is required to identify or create an office to lead its fraud risk management activities. This entity is meant to oversee and coordinate the agency's fraud risk prevention, detection, and response activities. SBA did not establish its Fraud Risk Management Board until April 2022,⁸⁰ and DOL had not designated an anti-fraud entity by January 2023.⁸¹ It is not clear if DOL has done so since.

Agencies must also perform fraud risk assessments as soon possible to identify vulnerabilities in program operations. These assessments are the basis for developing effective internal controls that mitigate the risk of fraud and improper payments. SBA completed its fraud risk assessments for PPP and EIDL in October 2021, when PPP had already stopped accepting applications and two months before EIDL would follow suit.⁸² As of January 2023, DOL had not performed a fraud risk assessment of the UI program, and it is not clear if it has done so since.⁸³ One important duty of a DOL anti-fraud entity might be to collaborate with state workforce agencies to ensure that states have effective fraud controls in place. The California Employment Development Department was required by state law to review its anti-fraud policies annually, but it had not done so between January 2016 and January 2021.⁸⁴ As a consequence, the agency relied on "uninformed and disjointed techniques" to detect fraud and paid an estimated $10.4 billion to potential fraudsters between March and December of 2020.⁸⁵

The GAO framework requires agencies to outline the specific actions they will take to monitor and manage fraud risks. The most effective strategies emphasize pre-payment controls, but information gained by monitoring all fraud controls can help agencies determine whether those controls are effective and how they may be adjusted to achieve better results. By January 2023, SBA and DOL had both partially completed their anti-fraud strategies.⁸⁶

Non-Compliance with Improper Payments Requirements

PIIA requires agencies to assess all of the programs that they administer to determine if they are susceptible to significant amounts of improper payments. OMB Circular A-123,⁸⁷ which provides guidance to agencies on how to implement PIIA requirements, specifies that for newly established programs an assessment should be performed after the first 12 months of the program. Risk assessments must consider a number of factors, including whether the program is new to an agency or has experienced significant funding changes and the volume of payments the agency must review. Once a program is determined to be at risk, the agency must report a valid improper payment estimate for it, among other requirements.

Because PIIA requirements are not mandatory until 12 months after a program has been established, most agencies did not report on improper payments in new pandemic programs in FY2021.⁸⁸ In FY2022, several agencies performed inadequate risk assessments or reported unreliable improper payments estimates.

At least two agencies were determined to be non-compliant with PIIA in FY2022 because they performed inadequate risk assessments on pandemic assistance programs. SBA, for example, used flawed methodologies to conclude that there was no significant risk of improper payments for the $28.5 billion Restaurant Revitalization Fund (RRF) and the $14.6 billion Shuttered Venues Operator Grant (SVOG) program.⁸⁹ Similarly, the Federal Emergency Management Agency determined that the Funeral Assistance program, which provided billions of dollars to cover burial costs for people who died of COVID-19, was not at risk for significant improper payments, but it did not account for the program's weak internal controls or the volume of claims the agency would need to review.⁹⁰

Several agencies were non-compliant with PIIA requirements in FY2022 for reporting unreliable improper payments estimates for pandemic programs. The improper payments estimate for the Education Stabilization Fund at the Department of Education was inaccurate because the department lacked sufficient documentation to support its classification of sampled payments as improper, unknown, or proper.⁹¹ The Department of Housing and Urban Development reported an unreliable improper payment estimate for the Tenant Based Housing Assistance program because it did not test a wide enough range of payments.⁹² SBA did not use reliable samples for developing improper payment estimates for PPP and EIDL, and so neither program had valid estimates for FY2022.⁹³ Similarly, DOL did not provide a full estimate of improper payments for UI in FY2022, as it did not incorporate samples from all pandemic funding streams.⁹⁴

Additional Consequences of Fraud and Other Improper Payments

As noted, effective internal controls facilitate the objectives of a program by ensuring, among other things, that funds are spent in the manner intended. During the pandemic, federal and state agencies often disbursed funds without appropriate controls in place in order to get assistance out as quickly as possible. Some stakeholders argue that the idea that there is a tradeoff between speed and security "is a false premise."⁹⁵ PRAC Chairman and Justice Department IG David Horowitz argued that agencies should have run verified payments through DNP, as required, and that doing so would not have caused significant delays in issuing funds:

It's a false narrative that has been set out, that there are only two choices. One choice is get the money out right away, and that the only other choice is to spend weeks and months trying to figure out who was entitled to it. [Screening payments would have taken] 24 hours? 48 hours? Would that really have upended the program? I don't think it would have. And it was data sitting there. It didn't get checked.⁹⁶

The lack of effective internal controls not only undermined the effectiveness of pandemic programs but led to outcomes that were contrary to broader federal objectives. Notably, funds that were lost to fraud were not available to support the individuals and businesses that Congress intended. Had the billions in loans intended for businesses not been lost to fraud, for example, fewer stores may have closed and laid off workers. In addition, internal control weaknesses over pandemic programs compromised some agencies' financial statements. SBA received a disclaimer⁹⁷ on its FY2022 financial statements because it could not provide documentation to support transactions and balances for four pandemic programs: PPP, EIDL, RRF, and SVOG.⁹⁸ DOL received a qualified opinion⁹⁹ on its FY2022 financial statements due to concerns with UI pandemic funding accounts.¹⁰⁰

Some pandemic assistance was stolen by domestic street gangs and transnational criminal organizations that used those funds for criminal activity. Members of the Milwaukee street gang called the "Wild 100s" or "Shark Gang" were indicted for fraudulently obtaining pandemic unemployment assistance funds and using the money to purchase firearms, narcotics, jewelry, and vacations and to solicit murder for hire.¹⁰¹ In Shreveport, LA, members of the Step or Die gang were indicted for fraudulently obtaining PPP and EIDL loans,¹⁰² and in Brooklyn, NY, members of the Woo Gang were charged with stealing millions in UI funds.¹⁰³ In 2021, after the fraud scheme had been launched, Woo Gang members posted a music video on YouTube entitled "Trappin" that included the lyrics, "Unemployment got us workin' a lot."¹⁰⁴ By some estimates, foreign crime syndicates—such as those in Russia, China, and Nigeria—stole tens of billions of dollars from pandemic programs.¹⁰⁵ Criminal groups used stolen pandemic funds to further their activities, according to Jeremy Sheridan, former assistant director of the Office of Investigations at the U.S. Secret Service:

These groups are profiting so greatly from these types of schemes, they engage in a host of other crimes. Drug trade, crimes against children, more sophisticated cyber-related fraud. And this money is basically an investment to them to conduct more extensive criminal operations…some of which include crimes that will compromise national security.¹⁰⁶

There may be a cyclical effect to high levels of fraud and criminality: As public awareness of fraud spreads, it may create the perception that relief funds can be easily stolen and therefore make emergency programs a target for further exploitation.¹⁰⁷ Moreover, as the public becomes aware of high levels of fraud, it may lose trust in government in general, and specifically in the government's ability to safeguard taxpayer funds.¹⁰⁸

Considerations for Congress

There are policy options that Congress might wish to consider that may mitigate the risk of fraud and improper payments in federal programs, including emergency spending programs.

Establishing a Central Anti-Fraud Entity

Some agencies have been slow to implement comprehensive, effective anti-fraud controls. Audits of pandemic programs found that, despite the mandate of the FRDAA, "federal agencies did not strategically manage fraud risks in alignment with the GAO framework and were not adequately prepared to prevent fraud when the pandemic began."¹⁰⁹ Some agencies remain vulnerable to fraud: As of August 2023, agencies had 95 open GAO recommendations for better aligning their fraud practices with the leading practices and standards in the Framework, including 25 recommendations for enhancing the use of data analytics to manage fraud risks.¹¹⁰

H.R. 8322, the Strengthening Tools to Obstruct and Prevent Fraud Act of 2022, would have established, among other things, a dedicated anti-fraud office within OMB.¹¹¹ This proposed office, the Federal Real Anti-fraud Unified Directorate (FRAUD), was to coordinate activities related to reducing and preventing fraud and improper payments, including

• sharing leading practices and tools with agencies;
• providing technical assistance to agencies in implementing the fraud risk management activities of the GAO framework; and
• assisting agencies with the collection and use of data, including working to reduce barriers to data sharing.

A central anti-fraud entity might facilitate the implementation of effective fraud controls at federal agencies. By disseminating leading practices and sharing lessons learned across the government, the entity might help agencies be aware of, and prepare for, emerging fraud threats and possibly provide solutions to agencies facing challenges in selecting and implementing appropriate data analysis tools. In addition, GAO has suggested that such an entity might serve as a successor to PACE, assisting IGs with their efforts to assess and identify fraud on a permanent basis.¹¹² If Congress chooses to create a central anti-fraud entity, it may wish to consider where it should be located. H.R. 8322 proposed placing FRAUD within OMB, which issues government-wide guidance on fraud and improper payments. There might also be benefits to placing it within the Council of the Inspectors General on Integrity and Efficiency (CIGIE), an independent entity within the executive branch that is composed of more than two dozen agency IGs and has, as its mission, to "continually identify, review, and discuss areas of weakness and vulnerability in Federal programs with respect to waste, fraud, and abuse."¹¹³ Placing an anti-fraud entity within the CIGIE might ensure that the investigative work of federal IGs is readily incorporated into the entity's guidance and that the entity's data analytics capabilities are supporting IGs' fraud detection efforts.

Require Emergency Spending Internal Control Plans

Congress has, at times, included in disaster funding legislation a requirement for OMB to establish criteria for agencies to follow when developing disaster relief internal control plans. The Disaster Relief Act of 2013 (P.L. 113-2), passed in response to Hurricane Sandy, included such a provision, as did the Additional Supplemental Appropriations for Disaster Relief Requirements Act of 2017 (P.L. 115-72), which provided funding to address the damage caused by a series of hurricanes and wildfires. The objective of having OMB establish criteria for disaster programs is to ensure that agencies establish effective controls for the payment integrity risks of emergency relief programs, some of which are unique, such as the emphasis on expedited disbursal.¹¹⁴ GAO has recommended that Congress require OMB to issue guidance to agencies to develop internal control plans for emergency programs that could be quickly implemented or adapted in response to a future disaster.¹¹⁵ Such a requirement might enable agencies to put into place effective pre-payment and post-payment controls in a more timely manner, thereby potentially reducing fraud and improper payments. The value of OMB's guidance might be limited by how carefully the guidance is drafted. For example, GAO criticized OMB's guidance for implementing internal controls over disaster funding as required by P.L. 115-72, noting that the guidance did not include sufficient direction to ensure that agencies would develop adequate control plans in a timely manner.¹¹⁶

Lowering the PIIA Threshold

H.R. 877, the Preventing Improper Payments Act of 2023, would require any program making more than $100 million in payments in a fiscal year to be deemed susceptible to significant improper payments.¹¹⁷ One issue Congress may wish to consider is whether to lower the threshold for programs subject to PIIA. As noted, 173 programs received at least $100 million in pandemic funding. Not all of these programs, however, were subject to all PIIA requirements. Currently, PIIA reporting and corrective action requirements apply only to programs with estimated improper payments of (1) $10 million when that represents at least 1.5% of program outlays or (2) $100 million. GAO has recommended that all new federal programs making more than $100 million in payments in any one fiscal year be deemed susceptible to significant levels of improper payments.¹¹⁸ New programs may be at an elevated risk level because staff are unfamiliar with program requirements. In addition, agencies have historically not developed and implemented internal controls for new relief programs in a timely manner.¹¹⁹ Such a mandate would potentially identify fraud and improper payments that might otherwise not be discovered under current guidance, thereby expanding the government's understanding of the scope of the problem and potentially reducing financial loss from fraud and overpayments. On the other hand, lowering the threshold might create diminishing returns, as the costs associated with fully implementing PIIA requirements on some new programs might exceed the amount of overpayments prevented and recovered.

Appendix.