Hurricanes Katrina and Rita Disaster Relief: Improper and	 
Potentially Fraudulent Individual Assistance Payments Estimated  
to Be Between $600 Million and $1.4 Billion (14-JUN-06, 	 
GAO-06-844T).							 
                                                                 
Hurricanes Katrina and Rita destroyed homes and displaced	 
millions of individuals. In the wake of these natural disasters, 
Federal Emergency Management Agency (FEMA) responded to the need 
to provide aid quickly through the Individuals and Households	 
Program (IHP) program, which provides housing assistance, real	 
and personal property assistance, and for other immediate,	 
emergency needs. As of February 2006, FEMA made 2.6 million	 
payments totaling over $6 billion. Our testimony today will (1)  
provide an estimate of improper and potentially fraudulent	 
payments through February 2006 related to certain aspects of the 
disaster registrations, (2) identify whether improper and	 
potentially fraudulent payments were made to registrants who were
incarcerated at the time of the disaster, (3) identify whether	 
FEMA improperly provided registrants with rental assistance	 
payments at the same time it was paying for their lodging at	 
hotels, and (4) review FEMA's accountability over debit cards and
controls over proper debit card usage. To estimate the magnitude 
of IHP payments made on the basis of invalid registrations, we	 
selected a random statistical sample of 250 payments made to	 
hurricanes Katrina and Rita registrants as of February 2006. We  
also conducted data mining and investigations to further	 
illustrate the effects of control breakdowns.			 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-06-844T					        
    ACCNO:   A55531						        
  TITLE:     Hurricanes Katrina and Rita Disaster Relief: Improper and
Potentially Fraudulent Individual Assistance Payments Estimated  
to Be Between $600 Million and $1.4 Billion			 
     DATE:   06/14/2006 
  SUBJECT:   Accountability					 
	     Check disbursement or control			 
	     Correctional facilities				 
	     Disaster relief aid				 
	     Erroneous payments 				 
	     Fraud						 
	     Housing allowances 				 
	     Hurricane Katrina					 
	     Hurricane Rita					 
	     Identity verification				 
	     Internal controls					 
	     Personal property					 
	     Prisoners						 
	     Program abuses					 
	     Real property					 
	     Individuals and Households Program 		 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-06-844T

     

     * Summary
     * FEMA Paid About $1 Billion to Individuals Who Provided Inval
          * Statistical Sample Results Indicate About $1 Billion in Pote
          * Sample Testing Understates Improper and Potentially Fraudule
          * Undercover Investigations and Case Study Examples of Fraudul
          * Data Mining Continued to Find Other Illustrative Examples of
     * Registrants Using Prisoner Identities Received Millions in D
     * Rental Assistance Payments Sent to Individuals Living in FEM
     * FEMA Lacked Controls over Accountability and Use of Debit Ca
          * Control Weaknesses over Accountability of FEMA Debit Cards
          * Lack of Guidance for Proper Use of Debit Cards
     * Concluding Comments
     * Contacts and Acknowledgement
     * Appendix I: Objectives, Scope and Methodology
          * Data Reliability
               * Order by Mail or Phone

Testimony

Before the Subcommittee on Investigations, Committee on Homeland Security,
House of Representatives

United States Government Accountability Office

GAO

For Release on Delivery Expected at 11:00 a.m. EST

Wednesday, June 14, 2006

HURRICANES KATRINAAND RITA DISASTER RELIEF

Improper and Potentially Fraudulent Individual Assistance Payments
Estimated to Be Between $600 Million and $1.4 Billion

Statement of Gregory D. Kutz, Managing Director

Forensic Audits and Special Investigations

John J. Ryan, Assistant Director

Forensic Audits and Special Investigations

GAO-06-844T

Mr. Chairman and Members of the Subcommittee,

Thank you for the opportunity to discuss our ongoing forensic audit and
related investigations of disaster relief assistance provided to
individuals and households for hurricanes Katrina and Rita. In a hearing
held in February 20061 before the Senate Committee on Homeland Security
and Governmental Affairs to discuss results of ongoing work, we testified
that significant flaws in the process for registering disaster victims
left the federal government vulnerable to substantial fraud and abuse
related to expedited assistance payments. Due to the magnitude of
potential fraud and abuse we observed in our February 2006 testimony, we
plan to issue a report containing recommendations to Department of
Homeland Security (DHS) and Federal Emergency Management Agency (FEMA) to
improve internal controls over the Individuals and Households Program
(IHP). This testimony reflects additional findings from the work we have
performed since February. We plan to continue reviewing other aspects of
IHP.

As we previously reported, expedited assistance-a component of the IHP
program for hurricanes Katrina and Rita-took the form of $2,000 payments
provided to disaster victims to help with the immediate, emergency needs
for food, shelter, clothing, and personal necessities. Individuals and/or
households who received expedited assistance may also be eligible to
receive other IHP payments for temporary housing assistance, real and
personal property repair and replacement, and other necessary expenses
related to a disaster-up to a cap of $26,200.2 As of mid-February 2006,
FEMA data showed that the agency had delivered about $6.3 billion in IHP
aid for hurricanes Katrina and Rita.3 Thirty seven percent (approximately
$2.3 billion) of this amount was delivered through expedited assistance
(EA) to hurricanes Katrina and Rita registrants. Of the remaining
payments, about $2 billion was delivered through temporary housing
assistance, and another approximately $2 billion was for repair and
replacement of real and personal property, and for other miscellaneous
categories.

1GAO, Expedited Assistance for Victims of Hurricanes Katrina and Rita:
FEMA's Control Weaknesses Exposed the Government to Significant Fraud and
Abuse, GAO-06-403T , (Washington, D.C.: Feb. 13, 2006).

2 Pursuant to 42 U.S.C. S: 5714, assistance for real property repair and
replacement is capped at $5,200 and $10,500, respectively. There are no
financial caps for housing assistance and other necessary expenses.

3As of mid-May 2006, FEMA reported that IHP payments for Katrina and Rita
totaled slightly over $6.7 billion. Data we analyzed as of February 2006
represented more than 90 percent of this amount.

As we previously testified, the need to provide assistance quickly led
FEMA to issue payments to hurricanes Katrina and Rita registrants without
first validating the identity and damaged property addresses of all
registrants and without first verifying that the registrants incurred
losses and had needs related to the hurricanes. However, with limited
exceptions,4 FEMA policy required that subsequent payments for temporary
housing assistance, real and personal property repair and replacement, and
other miscellaneous expenses be made only after FEMA had conducted an
inspection and determined that the extent of loss merited further
assistance. Addresses that were exempt from inspections had to go through
an electronic verification of ownership and occupancy with a third-party
contractor prior to FEMA providing registrants in those areas with rental
assistance and/or other nonexpedited assistance payments.

Today's testimony summarizes the results from our ongoing forensic audit
and investigative work reviewing the type and extent of fraud and abuse
for the IHP program. This testimony will (1) provide an estimate of
improper and potentially fraudulent payments related to certain aspects5
of the disaster registrations, (2) identify whether FEMA made improper or
potentially fraudulent IHP payments to registrants who were incarcerated
at the time of the disaster, (3) identify whether FEMA provided
registrants with rental assistance payments at the same time it was paying
for their lodging at hotelrooms, and (4) review FEMA's accountability over
debit cards and controls over proper debit card usage.

4 Exceptions were made for areas in Louisiana and Mississippi where
damages were widespread and extensive. For these areas, FEMA exempted
properties from an actual inspection prior to providing occupants in these
areas with rental assistance. FEMA also used geospatial imaging to
determine the level of real and personal property repair and replacement
on properties where FEMA could not conduct visual inspections.

5 For the purpose of this testimony, our estimate of improper and
potentially fraudulent payments is based on a statistical sample of
payments in which we examined whether the associated registrations
contained invalid Social Security Numbers (SSNs), bogus addresses, invalid
primary residence, and/or duplicate information. Invalid SSNs refer to
instances where the SSNs did not match with the name provided; the SSNs
belong to the deceased; or the SSNs had never been issued. Bogus addresses
refer to instances where the damaged address did not exist. Invalid
primary residences are related to registrations where the registrant had
never lived at the damaged address, or did not live at the damaged address
at the time of the hurricanes. Duplicate information refers to instances
where the registrations contained information that is duplicative of
another registration that received a payment and was earlier recorded in
FEMA's system.

To estimate the magnitude of IHP payments made on the basis of invalid
registrations, we selected a random sample of 250 payments of the 2.6
million IHP payments made to hurricanes Katrina and Rita registrants as of
February 2006. We excluded 3 of the 250 payments from our analysis because
these payments had been returned to the U.S. Government at the time of our
review, and the U.S. Government was therefore not susceptible to potential
fraud for them. We derived our estimate of improper and potentially
fraudulent payments by summing the dollars associated with improper and
potentially fraudulent payments in our sample and multiplying that sum by
a weighting factor to project the total from the sample to the population.
The weighting factor we used was the number of payments "represented" by
each of our randomly sampled payments, namely, the number of payments in
the population divided by the number of payments we sampled. To validate
sample registration data, we used a combination of site visits,
comparisons with publicly available data and Social Security
Administration (SSA) data, interviews with residents and their neighbors,
interviews with local postal officials, and duplicate registration
analysis. We also data mined IHP registration data to identify case
studies of registrants who provided invalid and potentially fraudulent
information.

To further illustrate the effects of control breakdowns, we continued our
undercover operations with bogus registrations to obtain additional IHP
payments beyond the original expedited assistance. To identify IHP
registrants who were prisoners, we obtained a database of federal inmates
as well as databases of inmates at state prisons in and around the areas
affected by hurricanes Katrina and Rita. We then compared prisoner data to
IHP registration data to identify registrations containing prisoner names
and SSNs. To identify case studies of individuals who received rental
assistance at the same time that they were housed in government-paid for
hotels, we compared the IHP registration data to information provided by
the hotels, e.g. driver's licenses. However, because data provided on
hotel residents did not contain FEMA registration numbers, we were unable
to determine the magnitude of duplicate payments.

To assess accountability over FEMA debit cards, we interviewed officials
from FEMA, Department of Treasury's Financial Management Service (FMS),
and JPMorgan Chase. To assess the usage patterns of FEMA debit cards, we
data mined debit card purchases and identified transactions that appeared
to be unrelated to emergency disaster needs. Further details on our scope
and methodology can be found in appendix I.

We conducted our audit and investigations from February 2006 through June
8, 2006. We conducted our audit work in accordance with generally accepted
government auditing standards and conducted investigative work in
accordance with the standards prescribed by the President's Council on
Integrity and Efficiency.

                                    Summary

We estimate that 16 percent of payments, totaling approximately $1
billion, were improper and potentially fraudulent because of invalid
registrations.6 This amount includes payments for expedited assistance,
rental assistance, housing and personal property repair and replacement,
and other necessary and emergency expenses. These payments were made to
(1) registrations containing Social Security Numbers (SSNs) that were
never issued or belonged to other individuals, (2) registrants who used
bogus damaged addresses, (3) registrants who had never lived at the
declared damaged addresses or did not live at the declared damaged address
at the time of disaster, and/or (4) registrations containing information
that was duplicative of other registrations already recorded in FEMA's
system. Our projection likely understates the total amount of improper and
potentially fraudulent payments because our work was limited to issues
related to misuse and abuse of identity, damaged property address
information, and duplicate payments. Our estimate does not account for
improper and potentially fraudulent payments related to issues such as
whether the applicants received rental assistance they were not entitled
to, received housing and other assistance while incurring no damage to
their property, and/or received FEMA assistance for the same damages
already settled through insurance claims.

Our forensic audit and investigative work showed that improper and
potentially fraudulent payments occurred mainly because FEMA did not
validate the identity of the registrant, the physical location of the
damaged address, and ownership and occupancy of all registrants at the
time of registration. For example, in one case a registrant received
$7,328 for expedited and rental assistance even though the registrant had
moved out of the rented house a month prior to hurricane Katrina. FEMA
also paid $2,000 to an individual who provided a damaged address that did
not exist, and paid $2,358 in rental assistance to another individual who
claimed his damaged property was inside a cemetery.

6 Because we followed a probability procedure based on random selections,
our sample is only one of a large number of samples that we might have
drawn. Since each sample could have provided different estimates, we
express our confidence in the precision of our particular sample's results
as a 95 percent confidence interval (e.g., plus or minus 5 percentage
points). This is the interval that would contain the actual population
value for 95 percent of the samples we could have drawn. The 95 percent
confidence interval surrounding the estimate of 16 percent ranges from 12
percent to 21 percent. The 95 percent confidence interval surrounding the
estimate of $1 billion ranges from $600 million to $1.4 billion.

Our work also confirmed that the processes that FEMA used to detect and
prevent duplicate registrations were not effective. Through sample testing
and data mining, we also found that FEMA made about $5.3 million in
payments to registrants who provided a post office box as their damaged
residence. For example, FEMA paid a registrant $2,748 who listed a post
office box in Alabama as the damaged property. Follow-up work with local
postal officials revealed that the post office box listed on the
registration had been used by individuals linked to other potential fraud
schemes. While not all payments made to post office boxes are improper or
potentially fraudulent, the number of potentially fraudulent payments
could be substantially reduced if FEMA put in place procedures to instruct
disaster recipients to provide actual street addresses of damaged property
when claiming disaster assistance. In addition, our undercover work
provided further evidence of the weaknesses in FEMA's management of the
disaster assistance process. For example, FEMA provided nearly $6,000 in
rental assistance to one of GAO's undercover registrations using a bogus
property as the damaged address. These payments came even though
verification with third-party records by FEMA indicated that the GAO
undercover registrant did not live at the damaged address, and after the
Small Business Administration reported that the damaged property could not
be found. GAO has not cashed these checks and plans to return the checks
to the Department of Treasury upon the conclusion of our work.

Without verifying the identity and primary residence of registrants prior
to IHP payments, it is not surprising that FEMA also made expedited and
rental assistance payments totaling millions of dollars to over 1,000
registrations made using information belonging to prison inmates. In other
words, payments were made to registrations using the names and SSNs of
individuals who were not displaced as a result of the storm but rather
were incarcerated at state prisons of the Gulf Coast area (that is,
Louisiana, Texas, Florida, Georgia, Mississippi, and Alabama), or federal
prisons across the United States at the time of the hurricanes. FEMA
criteria specified that expedited assistance be provided only to
individuals who were displaced due to the disaster and therefore were in
need of shelter, and further specified that FEMA may provide additional
assistance to individuals for the purpose of renting accommodations.7 For
example, FEMA paid over $20,000 to an inmate who used a post office box as
his damaged property.

We also found potentially wasteful and improper rental assistance payments
to individuals who were staying at hotels paid for by FEMA. In essence,
the government paid twice for these individuals' lodging-first by
providing a hotel at no cost and, second, by making payments to reimburse
these individuals for out-of-pocket rent. For example, FEMA paid an
individual $2,358 in rental assistance, while at the same time paying
about $8,000 for the same individual to stay 70 nights-at more than $100
per night-in a hotel in Hawaii. This registrant did not live at the
damaged property at the time of the hurricane. Another registrant stayed
more than 5 months-at a cost of $8,000-in hotels paid for by FEMA in
California, while also receiving three rental assistance payments for the
two separate disasters totaling more than $6,700. These instances occurred
because FEMA did not require hotels to collect FEMA registration numbers
and SSNs from residents staying in FEMA-paid for rooms. Without this
information, FEMA did not verify if the registrants were staying in
government provided hotels before sending them rental assistance. As a
result, FEMA made rental assistance payments which covered the same period
of time that the registrant was staying at a FEMA-paid hotel. Because the
hotels and FEMA did not collect registration identification numbers, we
were unable to quantify the magnitude of individuals who received these
duplicate benefits.

We found that FEMA did not institute adequate controls to ensure
accountability over the debit cards. Specifically, FEMA initially paid
$1.5 million for over 750 debit cards that the government could not
determine actually went to help disaster victims. Based on our numerous
inquiries, upon identification of several hundred undistributed cards
JPMorgan Chase refunded FEMA $770,000 attributable to the undistributed
cards. Further, we continued to find that debit cards were used for items
or services such as a Caribbean vacation, professional football tickets,
and adult entertainment, which do not appear to be necessary to satisfy
disaster-related needs as defined by FEMA regulations.8

7 44 CFR 206.117.

FEMA Paid About $1 Billion to Individuals Who Provided Invalid Registration Data

Because of FEMA's failure to establish basic upfront validation controls
over registrants' identity and address information, we estimate that FEMA
made approximately $1 billion of improper and potentially fraudulent
payments based on invalid registrations. 9 This represents 16 percent of
all individual assistance payments for hurricanes Katrina and Rita.10 The
improper and potentially fraudulent payments included cases where
individuals and households used invalid SSNs, used addresses that were
fictitious or not their primary residence, and for submitted earlier
registrations. These improper payments based on phony or duplicate
registration data were not only restricted to the initial expedited
assistance payments that we previously reported on, but also included
payments for rental assistance, housing repair, and housing replacement.
For example, rental assistance payments were made to registrants that used
a post office box and a cemetery as damaged properties. In fact, as part
of our ongoing forensic audit, FEMA continues to provide rental assistance
to GAO based on registrations that contained fictitious identities and
bogus damaged addresses. In one case, FEMA even sent GAO a check for
expedited assistance after an inspector could not confirm that the
property existed, and FEMA had decided not to provide housing assistance
to this registration. Our projection likely understates the total amount
of improper and potentially fraudulent payments since our examination of
sample payments focused only on invalid registrations and did not include
other criteria, such as insurance policies, which may make registrants
ineligible for IHP payments.

8 44 CFR 206.112.

9 All dollar estimates from this sample of FEMA disaster payments have 95
percent confidence intervals of within plus or minus $400 million of the
estimate itself, unless otherwise noted.

10 All percentage estimates from this sample of FEMA disaster payments
have 95 percent confidence intervals of within plus or minus 5 percentage
points of the estimate itself, unless otherwise noted.

Statistical Sample Results Indicate About $1 Billion in Potentially Fraudulent
and Improper IHP Payments

Based on our statistical sample we estimate that 16 percent of all
payments were based on invalid registrations. We considered a registration
invalid if it contained an invalid identity, invalid address information,
or was paid from duplicate registration information. Some registrations
failed more than one attribute. We drew our statistical sample from a
population of 2.6 million payments made in the wake of hurricanes Katrina
and Rita, totaling over $6 billion through mid-February 2006. Based on
these results, we project that FEMA made about $1 billion in assistance
payments based on improper or potentially fraudulent registrations. The 95
percent confidence interval associated with our estimate of improper and
potentially fraudulent registrations ranges from a low of $600 million to
a high of $1.4 billion in improper and potentially fraudulent payments.
Table 1 shows the attributes we tested, the estimated failure rate in each
attribute, and the overall projected failure amount.

Table 1: Results of Statistical Sampling and Estimate of Potentially
Improper and Fraudulent Payments

                                                            Percent Failure/ 
Reason Why Payment Was Not Valid      Number of Failures Estimated Amount 
Invalid primary residence                             26                  
(properties which could not be a                                          
primary residence and properties                                          
that the registrant did not live in                                       
at the time of the disaster)                                              
Payments based on duplicate                           12                  
registration data (registration                                           
containing same SSN, damaged                                              
property address, and/or current                                          
address as an earlier registration                                        
in FEMA's system)                                                         
Bogus properties useda (addresses                      3                  
did not exist)                                                            
Invalid SSN used (SSN never issued                     2                  
or belonging to other individuals)                                        
Total failures                                       39b       16 percent 
Estimate of Improper and Potentially                                      
Fraudulent Payments                                                       
Point estimate                                          $1.0 billionc     
95 percent confidence interval          $600 million to $1.4 billionc     

Source: GAO.

aRegistrations containing bogus damaged property addresses also fail the
invalid primary residence attribute. bSome registrations failed more than
one attribute; therefore, the total number of failures is less than the
sum of the attribute totals. cRounded to the nearest $10 million.

As shown in table 1, some registrations failed more than one attribute;
therefore the total number of registrations which failed our attribute
tests is less than the sum of the failures of each attribute. For example,
all payments made to registrations containing bogus damaged property
addresses also failed the primary residence test because the registrants
could not have lived there at the time of the disaster. Additional details
on the 39 registrants in our sample where we found a problem are as
follows:

Payments to Registrants Whose Damaged Property Address Was Not Their
Primary Residence - Twenty six payments failed the primary residence test.
These include individuals who had never lived at the damaged property, did
not live at the damaged property at the time of the disasters, or used
bogus property addresses on their registrations. We made these
determinations after reviewing publicly available records, conducting site
visits, and interviewing current residents and/or neighboring residents.
We provide additional details related to failures in this attribute in
table 2.

Table 2. Selected Payments in Statistical Sample That Failed the Primary
Residence Attribute

Case  Amount  Case Details                                                 
1    $19,636     o  Registrant received $2,000 in expedited assistance,    
                    $2,358 in rental assistance, and more than $15,000 in     
                    personal property replacement.                            
                    o  Registrant originally claimed damage at a street       
                    address several houses away from the damaged property     
                    address currently in FEMA's database. At some point in    
                    the disaster assistance process, the registrant made      
                    changes to the damaged property address.                  
                    o  No physical inspection occurred at the damaged         
                    property. Personal property payment was based on          
                    geospatial data due to the level of devastation in the    
                    area.                                                     
                    o  GAO reviews of publicly available information and      
                    credit report data showed that the registrant had never   
                    lived at the damaged property address for which she was   
                    paid.                                                     
2     14,750     o  Registrant used valid physical property as damaged     
                    address to receive three payments for expedited           
                    assistance, rental assistance, and personal property      
                    replacement.                                              
                    o  GAO audit and investigative work found no evidence     
                    that the individual ever lived at the property. After     
                    receiving the payments, the registrant withdrew the       
                    application without ever having a physical inspection     
                    performed or returning the disaster payments to FEMA.     
3      7,328     o  Registrant used damaged property in Kenner, Louisiana, 
                    as primary residence to qualify for one expedited         
                    assistance payment and two rental assistance payments.    
                    o  Registrant did not live at property at the time of     
                    disaster.                                                 
                    o  Owner of the property told us that the registrant had  
                    moved out of the damaged property a month prior to        
                    hurricane Katrina.                                        
4      6,161     o  Registrant used damaged property as primary residence  
                    to receive one expedited assistance and two rental        
                    assistance payments.                                      
                    o  Residents at the property had never heard of the       
                    registrant.                                               
5      2,784     o  Registrant used post office box in McIntosh, Alabama,  
                    as the damaged property address to receive expedited      
                    assistance and rental assistance.                         
                    o  The local postal inspector stated that the post office 
                    box was linked to other individuals associated with known 
                    fraudulent activity.                                      

Source: GAO analysis and investigation of FEMA data.

Payments to Duplicate Registrations-12 other payments in our sample failed
because they were made to registrants whose damaged property addresses and
current addresses had previously been submitted under other registrations
and had received payments on those previous registrations. For example,
one sample registrant submitted a registration containing the same damaged
and current property addresses as those used previously by another
registrant. Both registrations received payments for rental assistance for
$2,358 in September 2005.

Payments to Registrations with Bogus Property Addresses - Three payments
in our sample were made to registrations containing bogus property
addresses. For example, we found that one individual used several pieces
of bogus information to receive expedited assistance. Specifically, the
registrant used a SSN that was valid but the name did not match the name
in records maintained by the Social Security Administration. The
registrant also used a damaged property address in the 3000 block that was
determined to be invalid through our on-site inspection, as street numbers
on that street only went up to the 1000s. After the initial payment, the
registration was withdrawn voluntarily by the registrant. In effect, this
registrant was able to use completely bogus information to receive $2,000
from FEMA and then withdraw the registration to avoid further scrutiny.

Payments to Registrations Containing Invalid Social Security Numbers - Two
of the payments in the sample were made to individuals that used invalid
SSNs (e.g., SSNs that have never been issued or SSNs that did not match
the name provided on the registration). For example, one individual used a
SSN that had never been issued to receive FEMA payments for expedited and
rental assistance.

Overall, we observed that 17 of our sample failures (44 percent) were
related specifically to expedited assistance payments. The high level of
expedited assistance-related failure was expected because these payments
needed to be made quickly and, typically, prior to a physical inspection
of the damaged property. However, we found that the other 22 failures (56
percent) were related to rental assistance and personal and real property
repair and replacement payments. In its response to a draft GAO report,
FEMA represented to us that all nonexpedited assistance payments,
including the $2,358 in housing assistance payments, were subject to much
more stringent requirements. Specifically, FEMA represented that the
registrants had to demonstrate that they occupied the damaged property at
the time of the disaster. However, the 22 failures we found indicate that
these requirements were not effective in preventing improper and
potentially fraudulent registrations from receiving nonexpedited
assistance payments.

Sample Testing Understates Improper and Potentially Fraudulent Payments

Our estimate likely understates the total amount of improper and
potentially fraudulent payments because we did not test our samples for
all potential reasons why a disaster assistance payment could be
fraudulent or improper. For example, our testing criteria did not include
reviewing whether registrants had insurance policies that covered
hurricane damages, which may have made them ineligible for IHP payments.
We also did not test whether FEMA inspectors accurately assessed the
damage to each sampled damaged property, or whether the registrants were
displaced from their homes, an eligibility factor for rental assistance.

During the course of our work, we found that these problems affected some
of our sampled payments and, therefore, these payments may be improper or
potentially fraudulent. However, because the problems did not relate to
identity and address information, they passed our testing criteria. For
example, an individual in our statistical sample provided a valid SSN and
lived in a declared disaster area. However, the individual informed GAO
that he did not incur any hurricane-related damage. Despite this fact, the
individual received $2,000 in expedited assistance. We did not test
whether registrants received duplicate benefits from other FEMA programs,
such as free hotel lodging and trailers, which would have resulted in FEMA
paying duplicate housing benefits to the same registrant. Later in this
testimony, we provide examples where registrants received from FEMA free
hotel rooms in addition to rental assistance. Finally, our estimate would
include payments FEMA has identified for potential recoupment.

Undercover Investigations and Case Study Examples of Fraudulent and Improper IHP
Payments

Given the considerable amount of potentially fraudulent and improper
payments identified in our statistical sample, it is not surprising that
FEMA continued to provide rental assistance payments to GAO investigators
based on bogus registrations. In one instance, rental assistance was made
even after a FEMA inspector was unable to find the damaged property.
Similarly, our sample testing and data mining work also identified
additional examples of payments made on the basis of bogus information.

In our previous testimony,11 we reported that we were able to obtain
$2,000 expedited assistance checks from FEMA using falsified identities,
bogus property addresses, and fabricated disaster stories. FEMA has
continued to provide us with additional disaster-related assistance
payments even after FEMA received indications from various sources that
our registrations may be bogus. GAO has not cashed these checks and plans
to return the checks to the Department of Treasury upon the conclusion of
our work. The following provides details of two of our undercover
operations:

           o  Case #1 relates to a registration submitted by GAO for
           hurricane Rita that cited a bogus address in Louisiana as the
           damaged property. In October 2005, GAO received notice that the
           inspector assigned to inspect the property was not able to find
           the house despite numerous attempts to verify the address with the
           phone book, post office, and with a physical inspection. The
           registration was subsequently returned to FEMA by the inspector
           and coded as withdrawn because no contact was made with the
           registrant. Even though GAO never met with the inspector to prove
           that the damaged property existed, FEMA sent GAO a check for
           $2,000 in early 2006.
           o  Case # 2 relates to a GAO disaster registration for an empty
           lot in Louisiana for hurricane Katrina. Although the damaged
           property address was bogus, FEMA notified GAO that an inspection
           was performed and confirmed that the property was damaged.12
           However, FEMA stated that the registration could not be processed
           because FEMA was unable to corroborate that the GAO lived at the
           damaged property. GAO subsequently submitted a fictitious driver's
           license that included the bogus address, which FEMA readily
           accepted. Based on the fictitious driver's license, FEMA issued
           GAO a $2,358 rental assistance check, as shown in figure 1.
           Subsequent to FEMA issuing the $2,358 check, a Small Business
           Administration (SBA) inspector who was responsible for inspecting
           the damaged property in evaluation of a potential SBA loan13
           reported that the property did not exist. Although SBA discovered
           that the property was bogus, FEMA issued another rental assistance
           check to GAO, bringing the total rental assistance on this bogus
           registration to about $6,000. We found that the discrepancy
           between FEMA's result (which confirmed that the property existed),
           and SBA's result (which showed that the property did not exist)
           occurred because FEMA did not conduct a physical inspection on the
           property but instead used geospatial mapping to determine losses.

           Figure 1: Rental Assistance Check Issued to GAO

           We have previously testified regarding potentially fraudulent case
           studies we uncovered through data mining and investigative
           techniques. The potential fraud in those cases was hundreds of
           thousands of dollars. We have continued our data mining work find
           additional examples where FEMA made payments, sometimes totaling
           over $100,000, to improper or potentially fraudulent
           registrations, including payments made to registrants where
           cemeteries and post office boxes were claimed as damaged property
           addresses. Table 3 provides several additional examples of
           improper and potentially fraudulent payments.

11 GAO-06-403T .

12 Follow-up work indicates that because the address fell in an area with
tremendous devastation, FEMA used geospatial mapping in lieu of a physical
inspection to identify the level of damage and calculate the amount of
assistance.

13 Individuals and households who met a certain income threshold were
referred to SBA for a loan consideration.

Data Mining Continued to Find Other Illustrative Examples of Improper and
Potentially Fraudulent Payments

Table 3: Examples of Payments Made to Improper and Potentially Fraudulent
Registrations

Case   Amount  Case Details                                                
1    $109,708     o  8 individuals submitted 8 registrations using their   
                     own SSNs.                                                
                     o  All 24 payments were sent to a single apartment.      
                     o  4 individuals were members of the same household who  
                     were displaced to the same location. However, these      
                     individuals each received an expedited assistance and a  
                     rental assistance payment. According to public records,  
                     the other 4 individuals were not living at the damaged   
                     property at the time of the hurricane.                   
2     139,000     o  Individual received 26 payments using 13 different    
                     SSNs-only 1 of which belonged to the person.             
                     o  Public records indicate that the individual did not   
                     reside at any of the 13 addresses claimed as damaged     
                     property addresses.                                      
                     o  Public records also indicate that 8 of the 13         
                     addresses did not exist or have public ownership         
                     records.                                                 
3       4,358     o  Registrant claimed a UPS store address as damaged     
                     property address to qualify for 2 payments for expedited 
                     assistance and rental assistance.                        
4       2,358     o  Registrant used an address in Greenwood Cemetery, New 
                     Orleans, as the damaged property address to qualify for  
                     one rental assistance payment.                           
5       2,000     o  Registrant used a New Orleans cemetery as the damaged 
                     property address to obtain one expedited assistance      
                     payment.                                                 

Source: GAO analysis and investigation of FEMA data.

The following provides illustrative information for three of the cases.

           o  Case number 1 involves 8 individuals who claimed several
           different damaged property addresses, but the same current address
           which is a single apartment. Public record searches also
           determined that only 2 of the 8 individuals actually lived at the
           current address. Four individuals were members of the same
           household who shared the same damaged property address. However,
           the 4 individuals each received one expedited and one rental
           assistance payment. FEMA criteria specified that members from the
           same household who were displaced to the same location should be
           entitled to only one IHP payment. According to public records, the
           other 4 individuals were not living at the address claimed as
           damaged at the time of the hurricane.
           o  Case number 2 involves an individual who used 13 different
           SSNs-including one of the individual's own-to receive payments on
           13 registrations. The individual claimed 13 different damaged
           property addresses and used one single current address to receive
           FEMA payments. According to publicly available records, this
           individual had no established history at any of the 13 properties
           in Louisiana, Mississippi, and Alabama, which the individual
           claimed as damaged. The individual received approximately $139,000
           consisting of 8 expedited assistance payments, 4 rental assistance
           payments, and 14 other payments, including 3 payments of $10,500
           each, and 3 payments ranging from over $12,000 to over $17,000 for
           personal property replacement. Further audit and investigative
           work indicates that 8 of the 13 addresses did not exist or do not
           have public ownership records.
           o  Case number 4 involves a registrant who used the address of a
           cemetery to make an IHP claim. Specifically, the registrant used a
           damaged property address located within the grounds of Greenwood
           Cemetery, in New Orleans, Louisiana, to request disaster
           assistance from FEMA. Public records show no record of the
           registrant ever living in New Orleans. Instead, public records
           indicate that for the past five years, the registrant has resided
           in West Virginia at the address provided to FEMA as the
           registrant's current address.

           As discussed previously, one statistical sample item we tested
           related to an improper and potentially fraudulent payment FEMA
           made to an individual who received expedited and rental assistance
           as a result of using a post office box as a damaged property
           address. According to the Postal Inspector, this post office box
           was also linked to individuals that are associated with fraudulent
           activity. In total, we found that FEMA made over 2,000 payments
           totaling about $5.3 million to registrants who provided a post
           office box as their damaged residence. While not all payments made
           to post office boxes are improper or potentially fraudulent, the
           number of potentially fraudulent payments could be substantially
           reduced if FEMA put in place procedures to instruct disaster
           recipients to provide actual street addresses of damaged property
           when claiming disaster assistance.

           Registrants Using Prisoner Identities Received Millions in Disaster 
			  Assistance Payments
			  
			  FEMA paid millions of dollars to over 1,000 registrants who used
           names and SSNs belonging to state and federal prisoners for
           expedited and housing assistance.14 FEMA guidelines specify that
           eligibility for disaster assistance is predicated on the
           registrant being displaced from their primary residence due to the
           disaster, thus having need for shelter. These eligibility criteria
           should have generally excluded prisoners incarcerated throughout
           the disaster period. Given the weaknesses we identified earlier
           related to the number of individuals who claimed damages based on
           invalid property addresses, we can not ascertain whether FEMA
           properly verified that these registrations were valid, and
           therefore deserving of IHP payments. The following are three cases
           where prisoner identities were used to improperly receive IHP
           payments.

           o  Case 1 involves a convicted felon, housed in a Louisiana prison
           from April 2001 to the present, who registered for IHP assistance
           by telephone. The registrant made a FEMA claim using a post office
           box address in Louisiana as his damaged property address to
           qualify for IHP payments for expedited assistance, rental
           assistance, and personal property replacement. Two of these
           payments were made via checks sent to the address he falsely
           claimed as his current residence, and the final payment was sent
           via electronic funds transfer (EFT) to someone who also listed the
           same current address on the checking account. FEMA paid over
           $20,000 to the registrant even though the damaged property address
           on the registration was a post office box address and the
           registrant was incarcerated throughout the disaster period.
           o  Case 2 involves a registrant who has been incarcerated in a
           Louisiana state penitentiary since February 2005. Several weeks
           after the disaster, the registrant applied by telephone for
           individual disaster relief assistance claiming a Louisiana
           address. Based on his registration information, FEMA paid the
           inmate over $14,000 in checks mailed to an address in Texas that
           he listed as his current address, and an EFT was sent to his
           checking account. Payments included expedited assistance, rental
           assistance, and personal property replacement funds.

           o  Case 3 involves a registrant who has been incarcerated in a
           Mississippi correctional facility since 2004. The registrant used
           his name and SSN over the telephone to apply for and receive
           $2,000 in expedited assistance and $2,358 in rental assistance.
           The individual listed his correct current address, at the prison,
           to receive these payments.

           Rental Assistance Payments Sent to Individuals Living in FEMA-Paid-For Hotels
			  
			  Following hurricane Katrina, FEMA undertook massive efforts to
           house individuals and households who were displaced by the
           hurricane. Among other efforts, FEMA provided hotel accommodations
           to individuals who were at that time displaced across the United
           States.15 We found that although FEMA was responsible for paying
           hotel costs, FEMA did not require hotels to collect registration
           information (such as FEMA registration identification numbers or
           SSN) on individuals to whom it provided hotel accommodations.
           Without this information, FEMA was not able to identify
           individuals who were housed in hotels, and, thus, FEMA was unable
           to determine whether rental assistance should be provided to
           individuals to whom the federal government was providing free
           lodging. As a result, FEMA made rental assistance payments which
           covered the same period of time that the registrant was staying at
           a FEMA-paid hotels.16 Table 4 provides examples of some of these
           cases.

14 FEMA paid registrants who used names and SSNs belonging to inmates in
the Gulf Coast region (that is, Louisiana, Texas, Alabama, Mississippi,
Georgia, and Florida) or federal prison institutions and whose application
was made at the time of incarceration. Most of these prisoners are still
incarcerated. These numbers do not include prisoners who submitted false
identities or false addresses on their registrations, prisoners who were
free at the time of the hurricanes, received rental assistance, and were
later incarcerated (meaning they received rental assistance covering
periods of incarceration) or prisoners who used other schemes to collect
FEMA benefits, such as identity theft. The average amount FEMA paid to a
prisoner for expedited assistance and rental assistance was over $3,000.

15 Immediately after hurricane Katrina, the Red Cross moved to provide
hurricane victims with housing in hotels through its Special Transient
Accommodations Program. On October 25, 2005, FEMA took over the management
of this program. FEMA subsequently reimbursed Red Cross for expenditures
Red Cross incurred for its program.

16On November 23, 2005, FEMA issued a policy memo for Katrina stating that
rental assistance payments for the first 3 months ($2,358) are not
considered a duplication of benefits for individuals staying at FEMA paid
hotels. FEMA made the policy retroactive and applied it to all rental
assistance payments provided prior to the policy being issued. We do not
believe that this retroactive policy determination eliminates the fact
FEMA effectively provided some evacuees with two forms of lodging benefits
at the same time, resulting in a waste of government funds.

Table 4: FEMA Registrants Receiving Rental Assistance and FEMA Paid Hotels

                               Rental                                         
        Hotel Name         Assistance Total Hotel  
Case (Location)           Payments   Paymentsa  Details
1    Quality Inn            $6,734     $ 8,000     o  Registrant stayed at 
        (Carson, Calif.)                              two hotels from         
                                                      September 2005 to       
        Extended Stay                                 February 2006 at a cost 
        America                                       of $50 to $60 per       
        (Sacramento,                                  night.                  
        Calif.)                                       o  FEMA paid registrant 
                                                      rental assistance for   
                                                      both Katrina and Rita   
                                                      in October 2005 and     
                                                      again in December 2005  
                                                      for Katrina.            
2    Motel 6 (Port           5,602       7,000     o  Registrant stayed at 
        Allen, La.)                                   hotels from October     
                                                      2005 to February 2006   
                                                      at cost of $36 to $56   
                                                      per night.              
                                                      o  While at the hotel,  
                                                      registrant submitted    
                                                      self-certification      
                                                      forms stating he        
                                                      required housing        
                                                      assistance as a result  
                                                      of both disasters.      
                                                      o  FEMA paid registrant 
                                                      two rental assistance   
                                                      payments for Rita in    
                                                      November 2005 and two   
                                                      rental assistance       
                                                      payments for Katrina in 
                                                      December 2005 and       
                                                      January 2006.           
3    Marriott Courtyard      5,208      18,000     o  Registrant stayed at 
        (Lafayette, La.)                              hotel from September    
                                                      2005 to February 2006   
                                                      at a cost of $109 to    
                                                      $122 per night.         
                                                      o  FEMA paid registrant 
                                                      two rental assistance   
                                                      payments in September   
                                                      2005 and December 2005. 
4    Marriott Cypress        4,386      12,000     o  Registrant stayed at 
        Harbour (Orlando,                             the vacation resort     
        Fla.)                                         hotel from September to 
                                                      November 2005 at a cost 
                                                      of $154 to $249 per     
                                                      night.                  
                                                      o  In November 2005,    
                                                      the registrant moved to 
                                                      a FEMA-paid trailer.    
                                                      o  FEMA made two rental 
                                                      assistance payments to  
                                                      the registrant in       
                                                      October 2005.           
5    Days Inn (Monroe,       4,386       8,000     o  Registrant stayed at 
        La.)                                          hotel from October 2005 
                                                      to January 2006 at a    
                                                      cost of $69 to $79 per  
                                                      night.                  
                                                      o  FEMA paid registrant 
                                                      two rental assistance   
                                                      payments in September   
                                                      2005 and December 2005. 
                                                      o  FEMA inspector notes 
                                                      indicate registrant did 
                                                      not live at the damaged 
                                                      address at time of the  
                                                      hurricane.              
6    Intercontinental        4,056      14,000     o  Registrant stayed at 
        (New Orleans, La.)                            three hotels from       
                                                      November 2005 to        
        Days Inn                                      February 2006 at a cost 
        (Metairie, La.)                               of $119 to $260 per     
                                                      night.                  
        Best Western                                  o  FEMA paid registrant 
        French Quarter                                rental assistance       
        Landmark (New                                 payments in November    
        Orleans, La.)                                 2005 and January 2006.  
7    Ramada Plaza Hotel      2,358      31,000     o  Registrant stayed at 
        (Corona, N.Y.)                                hotel from September    
                                                      2005 to March 2006 at a 
                                                      cost of $149 per night. 
                                                      o  FEMA paid registrant 
                                                      rental assistance in    
                                                      September 2005.         
8    Pagoda Hotel            2,358       8,000     o  Registrant stayed at 
        (Honolulu, Hawaii)                            hotel from October to   
                                                      December 2005 at a cost 
                                                      of $110 to $115 per     
                                                      night.                  
                                                      o  FEMA paid the        
                                                      registrant rental       
                                                      assistance in November  
                                                      2005 and another rental 
                                                      assistance payment for  
                                                      $2,988 in January 2006. 
                                                      o  Our investigation    
                                                      and public records      
                                                      indicate that the       
                                                      registrant did not live 
                                                      at the damaged property 
                                                      address in New Orleans  
                                                      at the time of the      
                                                      hurricane but instead   
                                                      resided in North        
                                                      Carolina.               
9    French Quarter          2,358       8,000     o  Registrant stayed at 
        Suites (New                                   two hotels from         
        Orleans, La.)                                 November 2005 to        
                                                      January 2006 at a cost  
        Old Towne Inn (New                            of $100 to $136 per     
        Orleans, La.)                                 night.                  
                                                      o  FEMA paid registrant 
                                                      rental assistance in    
                                                      November 2005.          
                                                      o  Registrant was       
                                                      evicted from second     
                                                      hotel for violating     
                                                      hotel rules.            
10   Days Inn (Monroe,       2,028       8,000     o  Registrant stayed at 
        La.)                                          hotel from October 2005 
                                                      to January 2006 at a    
                                                      cost of $61 to $79 per  
                                                      night.                  
                                                      o  FEMA paid the        
                                                      registrant rental       
                                                      assistance in December  
                                                      2005.                   

Source: GAO analysis and investigation of FEMA and hotel data.

aRental assistance payments were made prior to February 13 while these
recipients were staying in the FEMA-paid hotels. Total hotel payments are
rounded to the nearest $1,000.

Because the hotels were not required to collect identification numbers, we
were unable to determine the magnitude of individuals who received these
duplicate benefits. However, as illustrated in table 4, our data mining
identified a number of individuals housed in FEMA-paid for hotels who have
received more than one rental assistance payment. Without an effective
means of reconciling individuals in FEMA hotels with those individuals
receiving rental assistance payments, FEMA may have wasted taxpayer
dollars by paying twice for housing assistance to hurricane victims.

        FEMA Lacked Controls over Accountability and Use of Debit Cards

FEMA did not establish proper accountability for debit cards. As a result,
FEMA disbursed about $1.5 million of taxpayer money for over 750 debit
cards that FEMA cannot establish went to disaster victims. In addition, as
reported previously, we continued to find cases where recipients purchased
goods and services that did not meet serious disaster related needs as
defined by federal regulations.17

17 44 CFR 206.110.

Control Weaknesses over Accountability of FEMA Debit Cards

FEMA lacked controls for accounting for debit cards issued, resulting in
the loss of accountability for over 750 debit cards valued at about $1.5
million. The lack of controls over debit cards is particularly troubling
given that debit cards are, in essence, cash that can be used to purchase
goods and services. In September 2005, JPMorgan Chase was initially paid
approximately $22.7 million for about 11,374 cards that the bank believed
were issued to FEMA registrants. However, prior to our inquiries beginning
in November 2005, we found that neither FEMA nor the bank had reconciled
the actual number of cards distributed with the number of cards for which
payment was made. From our numerous inquiries, both JPMorgan Chase and
FEMA began to reconcile their records to the debit cards issued. As a
result,

           o  JPMorgan Chase performed a physical count of cards remaining to
           identify the number of cards distributed. This resulted in
           JPMorgan Chase determining that it distributed 10,989 cards, not
           11,374 cards. Upon identification of the 385 undistributed debit
           cards, JPMorgan Chase refunded to FEMA $770,000 attributable to
           these undistributed debit cards.
           o  FEMA attempted to perform a reconciliation of the distributed
           cards to the cards recorded in its disaster recipient database. As
           of May 26, 2006, FEMA can only account for 10,608 cards of the
           10,989 cards JPMorgan Chase claimed that it has distributed.18 As
           a result, FEMA cannot properly account for 381 debit cards, worth
           about $760,000.

           Lack of Guidance for Proper Use of Debit Cards
			  
			  Since initially paying JPMorgan Chase $22.7 million, FEMA has
           expanded the use of debit cards as a payment mechanism for future
           IHP payment for some registrants. Through this process, FEMA made
           about $59 million in additional payments of rental assistance and
           other benefits. As of March 2006, over 90 percent of money funded
           to the debit cards has been used by recipients to obtain cash and
           purchase a variety of goods and services. Our analysis of data
           provided by JPMorgan Chase found that the debit cards were used
           predominantly to obtain cash19 which did not allow us to determine
           how the money was actually used. The majority of the remaining
           transactions was associated with purchases of food, clothing, and
           personal necessities.

           Similar to findings in our February 13, 2006, testimony, we
           continue to find some cases where cardholders purchased goods and
           services that did not appear to meet legitimate disaster needs. In
           this regard, FEMA regulations provide that IHP assistance be used
           for items or services that are essential to a registrant's ability
           to overcome disaster-related hardship. Table 5 details some of the
           debit cards activities we found that are not necessary to satisfy
           legitimate disaster needs.

18 Based on the electronic data provided to us, we were not able to
corroborate 400 of the 10,608 cards FEMA stated that they were able to
identify. According to a FEMA official, FEMA identified these recipients
utilizing data mining activities and a manual review process of the
recipient files. However, the FEMA official stated that no hard copies of
the recipient files were made and, thus, we are not able to conclude
whether these additional cards were, in fact, linked to a recipient who
received a debit card.

19 Over 70 percent of debit card dollars were cash withdrawals.

Table 5: Examples of Questionable Use of Debit Cards

Vendor             Location          Nature of Transaction          Amount 
Jewelz             Arlington, Tex.   Diamond jewelry including      $3,700 
                                        watches, earrings, and a ring  
Vacation Express   Atlanta, Ga.      All inclusive 1 week Caribbean  2,200 
                                        vacation resort in Punta Cana, 
                                        Dominican Republic             
Lesea Broadcasting South Bend, Ind.  Donations to a faith based      2,000 
                                        charity                        
New Orleans Saints New Orleans, La.  5 New Orleans Saints football   2,000 
                                        season tickets                 
Mark Lipkin        Houston, Tex.     Divorce lawyer services         1,000 
Legends            Houston, Tex.     Gentleman's club                  600 
The Pleasure Zone  Houston, Tex.     Adult erotica products            400 
Hooters            San Antonio, Tex. Alcoholic beverages including     300 
                                        $200 bottle of Dom Perignon    
                                        champagne                      
GGW Video          Santa Monica,     Girls Gone Wild videos            300 
                      Calif.                                           
Alamo Fireworks    San Antonio, Tex. Fireworks                         300 

Source: GAO analysis of debit card transactions and additional
investigations.

Note: Total transaction amounts are rounded to the nearest $100.

                              Concluding Comments

FEMA faces a significant challenge in ensuring that IHP relief payments
are only sent to valid registrants while also distributing those relief
payments as fast as possible. To ensure the success of the program, FEMA
must build the American taxpayers confidence that federal disaster
assistance only goes to those in need, and that adequate safeguards exist
to prevent assistance from going to those who submit improper and
potentially fraudulent registrations. To that effect, FEMA must develop
and strengthen controls to validate information provided at the
registration stage. As we have stated in prior audit work, and as FEMA had
learned from prior experience, pursuing collection activities after
disaster relief payments have been made is costly, time-consuming, and
ineffective. Upfront controls are all the more crucial given the estimated
$1 billion dollars that had gone to improper and potentially fraudulent
registrations related to hurricanes Katrina and Rita. It is key that FEMA
address weaknesses in its registration process so that it can
substantially reduce the risk for fraudulent and improper payments before
the next hurricane season arrives.

In addition, to help deter future fraudulent registrations, FEMA must
ensure there are consequences for those who commit fraud. We plan to refer
potentially improper payments to FEMA for further review, and hope that
FEMA will take the necessary recoupment actions. Further, we have
referred, and plan to refer additional cases of potential fraud to the
Katrina Fraud Task Force for further investigations and, if warranted,
indictments. Finally, we plan to issue a report in the future with
recommendations for addressing problems identified in this testimony.

Mr. Chairman and Members of the Committee, this concludes our statement.
We would be pleased to answer any questions that you or other members of
the committee may have at this time.

                          Contacts and Acknowledgement

For further information about this testimony, please contact Gregory Kutz
at (202) 512-7455 or [email protected] , John Kelly at (202) 512-6926 or
[email protected] .

Major contributors to this testimony include Kord Basnight, James Berry
Jr., Gary Bianchi, Valerie Blyther, Matthew Brown, Norman Burrell,
Jennifer Costello, Paul Desaulniers, Steve Donahue, Dennis Fauber,
Christopher Forys, Adam Hatton, Aaron Holling, Jason Kelly, Sun Kim,
Crystal Lazcano, Tram Le, John Ledford, Jennifer Leone, Barbara Lewis,
Jonathan Meyer, Gertrude Moreland, Richard Newbold, Kristen Plungas, John
Ryan, Sidney Schwartz, Robert Sharpe, Gail Spear, Tuyet-Quan Thai, Patrick
Tobo, Matthew Valenta, Tamika Weerasingha, and Scott Wrightson.

Appendix I: Objectives, Scope and Methodology

Our objectives were to (1) provide an estimate of improper and potentially
fraudulent payments related to certain aspects of the disaster
registrations, (2) identify whether FEMA made improper or potentially
fraudulent IHP payments to registrants who were incarcerated at the time
of the disaster, (3) identify whether FEMA provided registrants with
rental assistance payments at the same time it was paying for their hotel
rooms, and (4) review FEMA's accountability over debit cards and controls
over proper debit card usage.

To provide an estimate of improper and potentially fraudulent payments
related to certain aspects of the disaster registrations, we drew a
statistical sample of 250 payments from the Federal Emergency Management
Agency (FEMA)'s Individuals and Households Program (IHP) payments. Three
of the 250 were considered out of scope for our study because the payment
has been returned to the U.S. government by the time of our review.
Therefore, our review examined 247 payments for which the government was
subject to financial loss. Potentially fraudulent and invalid payments are
claims that contained (1) bogus identities, (2) addresses that did not
exist, (3) addresses where there was no evidence that the address was the
primary residence of the registrant at the time of the disaster, and (4)
addresses that had been previously registered using duplicate information
(such information would include same SSNs, same damaged address, and/or
same current address). We conducted searches of public records, available
FEMA data, and/or made physical inspections of addresses to determine if
registrations were improper and/or potentially fraudulent.

Because we followed a probability procedure based on random selections,
our sample is only one of a large number of samples that we might have
drawn. Since each sample could have provided different estimates, we
express our confidence in the precision of our particular sample's results
as a 95 percent confidence interval (e.g., plus or minus 5 percentage
points). This is the interval that would contain the actual population
value for 95 percent of the samples we could have drawn. As a result, we
are 95 percent confident that each of the confidence intervals in this
report will include the true values in the study population.

To identify whether FEMA made improper or potentially fraudulent IHP
payments to registrants who were incarcerated at the time of the disaster,
we obtained the FEMA IHP database as of February 2006. We obtained
databases containing state prisoner data since August 2005, including
releases and new incarcerations, from the states of Louisiana, Texas,
Mississippi, Alabama, Georgia, and Florida. We also obtained federal
prisoner data since August 2005, including releases and new
incarcerations, from the Department of Justice. We validated the databases
were complete by comparing totals against available public information on
prisoner populations. We compared these databases against the population
of IHP payments to identify prisoner SSN/name combinations that received
payments from FEMA. We restricted this comparison to prisoners who were in
state or federal prisons at the time of the disasters. We also interviewed
prisoners who registered for disaster relief and prison officials to
determine if prisoners were incarcerated at the time of the disaster.

To identify whether FEMA improperly provided registrants with rental
assistance payments at the same time it was paying for their hotel rooms,
we reviewed FEMA policies and procedures to determine how FEMA
administered its hotel program, and obtained FEMA data on its hotel
registrants. We also used data mining and forensic audit techniques to
identify registrants who stayed in hotels paid for by FEMA who also
received rental assistance payments through the IHP program. To determine
whether registrations from our data mining resulted in duplication of
housing benefits, we used a selection of 10 case studies for further
investigation. We obtained documentation from hotel officials to
substantiate that case study registrants stayed at hotels paid for by
FEMA. We also gathered available FEMA data on case study registrations
that received multiple rental assistance payments to determine what
information they had provided FEMA in order to receive additional rental
assistance.

To review FEMA's accountability over debit cards and controls over proper
debit card usage, we reviewed databases of transactions and accounts
provided by JPMorgan Chase, the administering bank for the debit cards, as
well as FEMA's database of debit card accounts. We interviewed bank, FEMA,
and Treasury officials regarding the reconciliation of debit card accounts
against IHP registrants and reviewed documentation related to the payment
flow of debit cards. We also performed data mining on debit card
transactions to identify purchases that did not appear to be indicative of
necessary expenses as defined by the Stafford Act's implementing
regulations.

During the course of our audit work, we identified multiple cases of
potential fraud. For cases that we investigated and found significant
evidence of fraudulent activity, we plan to refer our cases directly to
the Hurricane Katrina Fraud Task Force. We performed our work from
February 2006 through June 8, 2006 in accordance with generally accepted
government auditing standards and quality standards for investigations as
set forth by the President's Council on Integrity and Efficiency.

                                Data Reliability

To validate that the National Emergency Management Information System
database was complete and reliable, we compared the total disbursements
against reports FEMA provided to the Senate Appropriations Committee on
Katrina/Rita disbursements. We also interviewed FEMA officials and
performed electronic testing of the database on key data elements.

(192214)

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

GAO's Mission

The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting its
constitutional responsibilities and to help improve the performance and
accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost
is through GAO's Web site ( www.gao.gov ). Each weekday, GAO posts newly
released reports, testimony, and correspondence on its Web site. To have
GAO e-mail you a list of newly posted products every afternoon, go to
www.gao.gov and select "Subscribe to Updates."

Order by Mail or Phone

The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent of
Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more
copies mailed to a single address are discounted 25 percent. Orders should
be sent to:

U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
D.C. 20548

To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061

To Report Fraud, Waste, and Abuse in Federal Programs

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: [email protected]
Automated answering system: (800) 424-5454 or (202) 512-7470

Congressional Relations

Gloria Jarmon, Managing Director, [email protected] (202) 512-4400 U.S.
Government Accountability Office, 441 G Street NW, Room 7125 Washington,
D.C. 20548

Public Affairs

Paul Anderson, Managing Director, [email protected] (202) 512-4800 U.S.
Government Accountability Office, 441 G Street NW, Room 7149 Washington,
D.C. 20548

www.gao.gov/cgi-bin/getrpt? GAO-06-844T.

To view the full product, including the scope

and methodology, click on the link above.

For more information, contact Gregory Kutz at (202) 512-7455 or
[email protected].

Highlights of GAO-06-844T , a testimony before the Subcommittee on
Investigations, Committee on Homeland Security, House of Representatives

June 14, 2006

HURRICANES KATRINA AND RITA DISASTER RELIEF

Improper and Potentially Fraudulent Individual Assistance Payments
Estimated to Be Between $600 Million and $1.4 Billion

Hurricanes Katrina and Rita destroyed homes and displaced millions of
individuals. In the wake of these natural disasters, Federal Emergency
Management Agency (FEMA) responded to the need to provide aid quickly
through the Individuals and Households Program (IHP) program, which
provides housing assistance, real and personal property assistance, and
for other immediate, emergency needs. As of February 2006, FEMA made 2.6
million payments totaling over $6 billion.

Our testimony today will (1) provide an estimate of improper and
potentially fraudulent payments through February 2006 related to certain
aspects of the disaster registrations, (2) identify whether improper and
potentially fraudulent payments were made to registrants who were
incarcerated at the time of the disaster, (3) identify whether FEMA
improperly provided registrants with rental assistance payments at the
same time it was paying for their lodging at hotels, and (4) review FEMA's
accountability over debit cards and controls over proper debit card usage.

To estimate the magnitude of IHP payments made on the basis of invalid
registrations, we selected a random statistical sample of 250 payments
made to hurricanes Katrina and Rita registrants as of February 2006. We
also conducted data mining and investigations to further illustrate the
effects of control breakdowns.

We estimate that through February 2006, FEMA made about 16 percent or $1
billion in improper and potentially fraudulent payments to registrants who
used invalid information to apply for disaster assistance. Based on our
statistical sample, we are 95 percent confident that the range of improper
and potentially fraudulent payments is from $600 million to $1.4 billion.
In our assessment of whether a payment was improper and potentially
fraudulent, we did not test for other evidence of impropriety or potential
fraud, such as insurance fraud and bogus damage claims. This means our
review potentially understates the magnitude of improper payments made.
Examples of fraud and abuse include payments to registrants who used post
office boxes, United Parcel Service stores, and cemeteries as their
damaged property addresses.

Absent proper verification, it is not surprising that FEMA continued to
pay fictitious disaster registrations set up by GAO as part of our ongoing
forensic audit. In one case, FEMA paid nearly $6,000 to our registrant who
submitted a vacant lot as a damaged address. Below is a copy of a rental
assistance check sent to GAO after FEMA received feedback from its
inspector that the GAO undercover registrant did not live at the damaged
address, and after a Small Business Administration inspector reported that
the damaged property could not be found.

We also found that FEMA provided expedited and housing assistance to
individuals who were not displaced. For example, millions of dollars in
expedited and housing assistance payments went to registrations containing
the names and social security numbers of individuals incarcerated in
federal and state prisons during the hurricanes. In addition, FEMA
improperly paid individuals twice for their lodging-paying their hotels
and rental assistance at the same time. For example, at the same time that
FEMA paid $8,000 for an individual to stay in California hotels, this
individual also received three rental assistance payments for both
hurricane disasters. Finally, we found that FEMA could not establish that
750 debit cards worth $1.5 million went to hurricane Katrina victims. We
also found debit cards that were used for a Caribbean vacation,
professional football tickets, and adult entertainment.
*** End of document. ***