This is the accessible text file for GAO report number GAO-15-15 
entitled 'Hurricane Sandy: FEMA Has Improved Disaster Aid Verification 
but Could Act to Further Limit Improper Assistance' which was released 
on December 12, 2014. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as 
part of a longer term project to improve GAO products' accessibility. 
Every attempt has been made to maintain the structural and data 
integrity of the original printed product. Accessibility features, 
such as text descriptions of tables, consecutively numbered footnotes 
placed at the end of the file, and the text of agency comment letters, 
are provided but may not exactly duplicate the presentation or format 
of the printed version. The portable document format (PDF) file is an 
exact electronic replica of the printed version. We welcome your 
feedback. Please E-mail your comments regarding the contents or 
accessibility features of this document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

United States Government Accountability Office: 
GAO: 

Report to Congressional Requesters: 

December 2014: 

Hurricane Sandy: 

FEMA Has Improved Disaster Aid Verification but Could Act to Further 
Limit Improper Assistance: 

GAO-15-15: 

GAO Highlights: 

Highlights of GAO-15-15, a report to congressional requesters. 

Why GAO Did This Study: 

Hurricane Sandy struck the United States in October 2012, causing an
estimated $65 billion in damages. FEMA provides assistance to survivors
through IHP and other programs. Part of its mission is to provide 
assistance quickly, but GAO previously identified weaknesses in FEMA's 
ability to do so while protecting government resources. Moreover, GAO'
s 2006 reports on Hurricane Katrina and Rita showed that FEMA did not 
consistently validate the identity of applicants or inspect damaged 
properties. 

GAO was asked to review the internal controls FEMA's IHP used in 
response to the storm. This report discusses (1) the extent to which 
FEMA implemented controls to help prevent IHP payments that are at 
risk of being improper or potentially fraudulent and (2) challenges 
FEMA and states faced obtaining information to help prevent IHP 
payments from duplicating or overlapping with other sources in its
response to Hurricane Sandy. 

GAO reviewed FEMA's records for assistance provided to the five states
that received IHP following the storm, assessed FEMA's controls to 
prevent individuals from fraudulently receiving disaster assistance, 
and interviewed FEMA officials and selected officials from states 
impacted by the storm. 

What GAO Found: 

By implementing new controls since the mid-2000s, the Federal Emergency
Management Agency (FEMA) improved its ability to detect improper and
potentially fraudulent payments, but GAO identified continued 
weaknesses in the agency's validation of Social Security numbers, 
among other things. As of August 2014, FEMA stated that it had 
provided over $1.4 billion in Hurricane Sandy assistance through its 
Individuals and Households Program (IHP)-—which provides financial 
awards for home repairs, rental assistance, and other needs—-to almost 
183,000 survivors. GAO identified $39 million, or 2.7 percent, that was
at risk of being improper or fraudulent, compared to 10–22 percent of 
similar assistance provided for Hurricanes Katrina and Rita. GAO 
identified payments as at-risk if they had characteristics indicating, 
for example, that ineligible recipients or duplication of assistance 
could be involved. However, it is not possible to determine whether 
these payments were definitively improper or fraudulent without 
inspecting each payment. FEMA officials reviewed GAO's findings and
stated that at least $6.1 million of the $39 million were not improper 
or fraudulent, but GAO could not independently confirm their 
conclusions for each payment. 

In February 2006, FEMA began using a tool to validate the identity of 
applicants during registration. FEMA also hired contractors to inspect 
damaged homes to verify the identity and residency of applicants and 
that reported damage was a result of Hurricane Sandy. However, in this 
review, GAO found 2,610 recipients with potentially invalid 
identifying information who received $21 million of the $39 million 
GAO calculated as potentially improper or fraudulent. GAO's analysis
included data from the Social Security Administration (SSA) that FEMA 
does not use, such as SSA's most-complete death records. Collaborating 
with SSA prior to providing assistance could give FEMA additional 
information to further reduce its risk of assisting ineligible 
applicants. 

FEMA and state governments faced challenges in obtaining the data 
necessary to help prevent duplicative payments from overlapping 
sources. For example, FEMA was unable to identify potentially 
duplicative rental-assistance payments to recipients of its Sheltering 
and Temporary Essential Power pilot program, in part because it did 
not request the necessary data from states at the program's outset. 
FEMA recently took steps to make data sharing among programs easier,
including initiating a committee to explore ways to maintain and share 
relevant data needed to evaluate and help prevent potentially 
duplicative assistance in the future. In addition, FEMA relies on self-
reported data from applicants regarding private home insurance—-a 
factor the agency uses in determining benefits, as federal law 
prohibits FEMA from providing assistance for damage covered by
private insurance. By examining data from entities that provide 
federally backed mortgages, GAO identified 534 individuals receiving 
over $2.3 million in home repair and personal property assistance who 
said they did not have private insurance but had mortgages that 
require such insurance. FEMA reviewed 55 cases and stated that 32 were 
likely appropriate because the assistance was for damage not covered 
by private insurance. However, the risk remains that some individuals 
may have received assistance from FEMA for ineligible expenses.
Assessing a variety of methods to verify self-reported data would 
provide FEMA greater assurance that it has a cost-effective means of 
obtaining sufficiently accurate and reliable information. 

What GAO Recommends: 

GAO recommends, among other things, that FEMA collaborate with
SSA to obtain additional data, collect data to detect duplicative 
assistance, and implement an approach to verify whether recipients 
have private insurance. FEMA concurred with the recommendations. 

View [hyperlink, http://www.gao.gov/products/GAO-15-15]. For more 
information, contact Seto J. Bagdoyan at 202-512-6722 or 
bagdoyans@gao.gov. 

[End of section] 

Contents: 

Letter: 

Background: 

FEMA Implemented Controls to Prevent Assistance to Ineligible 
Recipients, but Opportunities Exist to Further Enhance Oversight: 

FEMA and the States Faced Challenges in Obtaining and Sharing 
Information Needed to Prevent Payments from Potentially Overlapping 
Sources: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments and Our Evaluation: 

Appendix I: Objectives, Scope, and Methodology: 

Appendix II: Recipients and Dollars to Counties: 

Appendix III: Individual and Households Program (IHP) Registrations 
Reviewed by the Federal Emergency Management Agency (FEMA): 

Appendix IV: Comment from the Department of Homeland Security: 

Appendix V: GAO Contacts and Staff Acknowledgments: 

Tables: 

Table 1: Individuals and Households Program (IHP) Expenditures as of 
November 2013: 

Table 2: Federal Emergency Management Agency (FEMA) Disaster-Recovery 
Programs and Status of Hurricane Sandy Expenditures as of November 
2013: 

Table 3: Summary of IHP Assistance Identified as At-Risk for Potential 
Fraud or Improper Payments: 

Table 4: Definitions of Flood-Insurance Compliance Flag in Federal 
Emergency Management Agency (FEMA) Database: 

Table 5: Individuals and Households Program (IHP) Home-Repair and 
Personal-Property Assistance for Recipients That Reported No Private 
Insurance but Held Federally Backed Mortgages That Require Insurance 
Coverage. 

Table 6: Summary of the Federal Emergency Management Agency's (FEMA) 
Review of the Individuals and Households Program (IHP) Assistance 
Identified as Being at Risk for Potential Fraud or Improper Payments: 

Figures: 

Figure 1: Federal Emergency Management Agency (FEMA) Programs 
Providing Assistance after Hurricane Sandy: 

Figure 2: Hurricane Sandy Individuals and Households Program (IHP) 
Recipients by County: 

Figure 3: Individuals and Households Program (IHP) Recipients Using 
Duplicate Bank Accounts: 

Figure 4: Individuals and Households Program (IHP) Addresses at Which 
Multiple Recipients Received More than a Combined $31,900: 

Abbreviations: 

DHS: Department of Homeland Security: 

DHS OIG: Department of Homeland Security Office of the Inspector 
General: 

EVS: Enumeration Verification System: 

Fannie Mae: Federal National Mortgage Association: 

FEMA: Federal Emergency Management Agency: 

FHA: Federal Housing Administration: 

Freddie Mac: Federal Home Loan Mortgage Corporation: 

IHP: Individuals and Households Program: 

NEMIS: National Emergency Management Information System: 

NFIP: National Flood Insurance Program: 

ONA: Other Needs Assistance: 

PKEMRA: Post-Katrina Emergency Management Reform Act of 2006: 

SSA: Social Security Administration: 

SSN: Social Security number: 

Stafford Act: Robert T Stafford Disaster Relief and Emergency 
Assistance Act: 

STEP: Sheltering and Temporary Essential Power: 

TSA: Transitional Shelter Assistance: 

[End of section] 

United States Government Accountability Office: 
GAO:
441 G St. N.W. 
Washington, DC 20548: 

December 12, 2014: 

Congressional Requesters: 

In its mission to reduce the loss of life and property after 
disasters, the Federal Emergency Management Agency (FEMA) must quickly 
assist those in need while also protecting government resources from 
fraud, waste, and abuse. Both objectives are critical to the agency's 
success and strong governance, but achieving them simultaneously can 
be challenging. If FEMA provides assistance too quickly, abuse may go 
undetected; conversely, if FEMA spends too much time assessing 
applicants' eligibility, the applicants may be deprived of needed 
assistance and services. Our work has consistently shown that reliable 
and effective controls are vital in helping achieve an appropriate 
balance.[Footnote 1] 

In 2005, FEMA provided $7 billion in financial assistance to survivors 
of Hurricanes Katrina and Rita, which caused an estimated $159.4 
billion in damages. The response to these disasters exposed several 
vulnerabilities in FEMA's internal controls. In a series of reports 
issued from June through December 2006, we identified significant 
control weaknesses that resulted in an estimated $600 million to $1.4 
billion in potentially fraudulent or improper payments.[Footnote 2] 
FEMA reported that approximately $60 million of those payments had 
been recovered as of September 2014.[Footnote 3] Our 2006 work 
examining FEMA's response to Hurricanes Katrina and Rita showed that 
FEMA did not consistently validate the identity of applicants, inspect 
or confirm the physical existence of damaged residences, or confirm 
whether potential aid recipients actually owned or occupied a damaged 
property at the time of the disaster. In June and September 2006, we 
recommended that FEMA develop processes for validating applicants' 
identities and primary residences during the application process. 
[Footnote 4] In response, FEMA took several steps to strengthen its 
controls, including establishing identity verification for all 
applications as of June 2006 and inspections for all residences as of 
2008. In a June 2009 report, we reexamined these controls in FEMA's 
2008 response to Hurricanes Gustav and Ike and found that they had 
improved.[Footnote 5] However, we recommended additional actions in 
that report, including a recommendation that FEMA conduct random 
checks to assess the validity of applicants' supporting documentation. 
Beginning in December 2009, the agency took further steps to improve 
controls by randomly reviewing and verifying the legitimacy of the 
supporting documentation that caseworkers accept from applicants under 
the Individuals and Households Program (IHP), which provides financial 
awards for home repairs, rental assistance, and other needs. 

As in the 2005 response to Hurricanes Katrina and Rita and the 2008 
response to Hurricanes Gustav and Ike, FEMA provided large-scale 
posthurricane assistance to survivors after Hurricane Sandy struck the 
Northeast United States in October 2012 and caused an estimated $65 
billion worth of damage. The Disaster Relief Appropriations Act of 
2013 included approximately $50 billion in supplemental appropriations 
for fiscal year 2013 for expenses related to the consequences of 
Hurricane Sandy.[Footnote 6] The funds were allocated to a number of 
agencies, including almost $11.8 billion to FEMA, which used a portion 
of the funds to provide housing and other assistance to those affected 
by Hurricane Sandy through a number of programs, including to IHP. 
According to the data FEMA provided in November 2013, the most current 
and complete records at the time of our request, 182,782 individuals 
in five disaster-affected states received assistance through the 
agency's IHP program.[Footnote 7] 

You asked us to review the internal controls FEMA used in providing 
assistance through IHP as a part of the agency's response to Hurricane 
Sandy. This report assesses (1) the extent to which FEMA implemented 
controls to help prevent IHP payments that are at risk of being 
improper or potentially fraudulent and (2) what challenges, if any, 
FEMA and states faced in obtaining and sharing information to help 
prevent IHP payments from duplicating or overlapping with other 
sources of assistance in FEMA's response to Hurricane Sandy.[Footnote 
8] 

To assess the extent to which FEMA had implemented controls to help 
prevent payments that are at risk of being improper or potentially 
fraudulent, we reviewed FEMA's IHP records for applications and 
assistance provided in response to Hurricane Sandy as of November 
2013, as well as FEMA's controls designed to prevent individuals from 
fraudulently receiving disaster assistance.[Footnote 9] We submitted 
IHP applicants' Social Security numbers (SSN) to the Social Security 
Administration's (SSA) Enumeration Verification System (EVS). The EVS 
provides information on invalid (never issued) SSNs and instances 
where there are mismatches between SSN, name, and birth date. In 
addition, we searched the IHP applicant database for records with 
duplicative SSNs, addresses, bank account numbers, and phone numbers 
as well as evidence that personal information of likely deceased 
individuals on SSA's full death file was used to obtain IHP benefits. 
[Footnote 10] We also compared IHP records with prison records of 
individuals incarcerated in state prisons in Connecticut, New Jersey, 
and New York to determine whether rental assistance payments were made 
to prisoners.[Footnote 11] Finally, we interviewed FEMA officials and 
reviewed policies related to eligibility for assistance for flood-
related damage through IHP and reviewed IHP assistance records to 
assess the extent to which that guidance was consistently followed. 

To examine the challenges, if any, FEMA and states faced in obtaining 
and sharing information to help prevent duplicative IHP payments from 
overlapping sources, we reviewed application data of IHP recipients 
who reported that they did not have private homeowners insurance to 
determine whether their damaged properties had a federally backed 
mortgage, which housing and mortgage officials told us require 
mortgage holders to maintain private insurance. We compared these 
applications with data from the Federal Housing Administration (FHA), 
the Federal National Mortgage Association (Fannie Mae), and the 
Federal Home Loan Mortgage Corporation (Freddie Mac) to determine 
whether any IHP recipients may have received assistance for damage 
from Hurricane Sandy that could be covered by private homeowners 
insurance. We also interviewed state and federal officials and 
reviewed guidance about FEMA's Sheltering and Temporary Essential 
Power (STEP) pilot program to assess FEMA's ability to determine 
whether an applicant's home had been repaired through the STEP program 
prior to providing sheltering assistance through the IHP.[Footnote 12] 

We assessed the accuracy and reliability of FEMA's IHP data and data 
provided by state departments of correction by interviewing agency 
officials knowledgeable about the data system and by obtaining written 
responses regarding (1) methods of data collection and quality control 
reviews, (2) practices and controls over data-entry accuracy, and (3) 
any limitations of the data. To assess the reliability of data from 
FHA, Fannie Mae, and Freddie Mac, we interviewed agency officials 
knowledgeable about the data system and mortgage loans. In addition, 
we conducted electronic testing of the data, including checks for 
missing, out of range, or logically inaccurate data. We determined 
that the data were sufficiently reliable for the purposes of this 
report. 

We assessed FEMA's controls and the challenges FEMA and states faced 
in obtaining data to prevent overlapping payments by using criteria 
from FEMA guidance, a review of laws pertaining to disaster relief, 
including the Post-Katrina Emergency Management Reform Act of 2006 
(PKEMRA),[Footnote 13] and the Robert T. Stafford Disaster Relief and 
Emergency Assistance Act (Stafford Act), as amended.[Footnote 14] We 
also reviewed best practices from auditing and antifraud 
organizations, internal control criteria from Standards for Internal 
Control in the Federal Government, and previous GAO work on fraud 
prevention and information systems controls.[Footnote 15] 

We conducted this performance audit from July 2013 to December 2014 in 
accordance with generally accepted government auditing standards. 
Those standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objectives. We believe 
that the evidence obtained provides a reasonable basis for our 
findings and conclusions based on our audit objectives. A more 
detailed explanation of our objectives, scope, and methodology can be 
found in appendix I. 

Background: 

In late October 2012, Hurricane Sandy made landfall in southern New 
Jersey, with effects felt across 11 states and the District of 
Columbia, particularly the densely populated New York and New Jersey 
coasts. The storm caused an estimated $65 billion worth of damage, as 
more than 23,000 people sought refuge in temporary shelters and more 
than 8.5 million utility customers lost power. In response, the 
Disaster Relief Appropriations Act of 2013 was signed into law in 
January 2013, which included approximately $50 billion in supplemental 
appropriations for expenses related to the consequences of Hurricane 
Sandy. The funds were allocated to a number of agencies, including 
almost $11.8 billion to FEMA, which used a portion of the funds to 
provide housing and other assistance to those affected by Hurricane 
Sandy through a number of programs. As of September 30, 2014, the 
agency had obligated nearly $10.6 billion to Hurricane Sandy recovery, 
of which over $1.6 billion was expended through IHP assistance. 

FEMA Disaster Assistance Programs: 

FEMA disaster assistance is provided through its IHP, which is part of 
its Individual Assistance program, as well as through its Public 
Assistance grant programs. These federal assistance programs were 
established under the Stafford Act. In addition, the National Flood 
Insurance Program (NFIP) provides insurance coverage for flood damage 
to individuals who live in designated flood zones. (See figure 1 for a 
summary of the various types of assistance.) 

Figure 1: Federal Emergency Management Agency (FEMA) Programs 
Providing Assistance after Hurricane Sandy: 

[Refer to PDF for image: illustration] 

Individual Assistance, Public Assistance, and insurance through the 
National Flood Insurance Program (NFIP) provided lodging, home repair, 
other needs assistance, and claims payments to individuals affected by 
Hurricane Sandy. The programs were not mutually exclusive, so an 
individual could receive assistance or claims payments from more than 
one of them. 

FEMA programs active after Hurricane Sandy: 

Insurance: 
Claim payments from the National Flood Insurance Program (NFIP) go to 
policyholders to cover flood damage to buildings and property. 

Public Assistance: 
* Funds go to tribal and local governments for the Sheltering and 
Temporary Essential Power (STEP) program to repair houses to be 
inhabitable; 
* Funds go to state, tribal, and local governments and nonprofit 
organizations for recovery efforts; 
Transitional Sheltering Assistance (TSA): 
* Funds go to hotels for lodging. 

Individual Assistance: 
Administered by: Individuals and Households Program (IHP): 
* Funds go to individuals for home repair; 
* Funds go to individuals for rental of alternative housing; 
* Funds go to individuals for personal property damage; 
* Funds go to individuals for other needs such as medical, dental, 
funeral, transportation, moving and storage, and other expenses. 

Source: GAO analysis of FEMA data. GAO-15-15. 

[End of figure] 

FEMA's IHP program provides financial assistance and direct assistance 
to eligible individuals and households who, as a direct result of a 
major disaster or emergency, have uninsured or underinsured necessary 
expenses and serious needs that cannot be addressed by other means, 
such as other assistance programs or insurance. For example, IHP 
provides financial assistance in the form of money to individuals and 
households for home repairs, rental assistance, personal property, 
transportation, and funeral and burial costs. FEMA determines whether 
individuals or households meet eligibility requirements for IHP 
assistance after they register either online, in person, or over the 
telephone.[Footnote 16] Individuals and households may be eligible for 
assistance if, due to the disaster, they have been displaced from 
their primary residence or their primary residence has been rendered 
uninhabitable. Additionally, the primary residence must be located in 
a presidentially declared disaster area and the applicant must have 
insufficient or no insurance coverage. Applicants must submit 
identification information, including name, SSN, and date of birth. 
Applicants must also provide a physical property address affected by 
the disaster. 

After Hurricane Sandy, individuals or households could receive a 
maximum of $31,900 in financial assistance through IHP.[Footnote 17] 
As of November 2013, FEMA had provided more than $1.4 billion in IHP 
cash assistance to survivors of Hurricane Sandy.[Footnote 18] Figure 2 
shows the number of recipients and total dollar amounts of assistance 
provided through IHP after Hurricane Sandy, by county. 

Figure 2: Hurricane Sandy Individuals and Households Program (IHP) 
Recipients by County: 

[Refer to PDF for image: interactive graphic] 

Instructions: Roll over the shaded U.S. counties for more information. 

Print version: See Appendix II. 

[End of figure] 

Table 1 describes the total payments made through the IHP in response 
to Hurricane Sandy, by state, according to data provided to us by FEMA 
in November 2013. 

Table 1: Individuals and Households Program (IHP) Expenditures as of 
November 2013: 

State (disaster number): New York (4085); 
Number of households receiving assistance: 117,578; 
Housing assistance (dollars): $859,928,592; 
Other needs assistance (dollars): $145,584,045; 
Total assistance (dollars): $1,005,512,637. 

State (disaster number): New Jersey (4086); 
Number of households receiving assistance: 61,398; 
Housing assistance (dollars): 359,074,194; 
Other needs assistance (dollars): 56,748,678; 
Total assistance (dollars): $415,822,872. 

State (disaster number): Connecticut (4087); 
Number of households receiving assistance: 2,969; 
Housing assistance (dollars): 13,976,857; 
Other needs assistance (dollars): 1,107,837; 
Total assistance (dollars): $15,084,694. 

State (disaster number): Maryland (4091)[A]; 
Number of households receiving assistance: 732; 
Housing assistance (dollars): 2,147,394; 
Other needs assistance (dollars): 424,167; 
Total assistance (dollars): $2,571,561. 

State (disaster number): Rhode Island (4089); 
Number of households receiving assistance: 105; 
Housing assistance (dollars): 378,749; 
Other needs assistance (dollars): 42,592; 
Total assistance (dollars): $421,341. 

State (disaster number): Total; 
Number of households receiving assistance: 182,782; 
Housing assistance (dollars): $1,235,505,786; 
Other needs assistance (dollars): $203,907,319; 
Total assistance (dollars): $1,439,413,105. 

Source: Federal Emergency Management Agency (FEMA). GAO-15-15. 

[A] States may choose to participate in the administration of the 
Other Needs Assistance (ONA) provision of IHP. FEMA administered ONA 
on behalf of all affected states except for Maryland, which opted to 
participate in the administration of this benefit. 

[End of table] 

FEMA's Public Assistance grant program provides funding to state, 
tribal, and local governments and nonprofit organizations for recovery 
efforts after a disaster, including removing debris, implementing 
emergency protective measures, and repairing or replacing damaged 
public equipment or facilities. FEMA also uses Public Assistance 
grants to provide short-term sheltering for disaster survivors who are 
unable to return to their homes. For instance, Transitional Shelter 
Assistance (TSA) provides short-term sheltering assistance to disaster 
survivors who have a continuing need for shelter after congregate 
shelters, such as those in schools, have closed.[Footnote 19] Under 
TSA, disaster survivors may be eligible to stay in hotel or motel 
lodging for a limited period and have the cost of the room and taxes 
covered by FEMA. Payments for TSA lodging are made through a 
contracted vendor directly to participating hotels on behalf of FEMA; 
disaster survivors are not provided with any cash assistance under 
this program. While the TSA program is funded under Section 403 of the 
Stafford Act through Public Assistance, it is administered through 
FEMA's Individual Assistance program, which is more prepared to 
collect information on individuals than Public Assistance. FEMA 
considers applicants' eligibility for TSA as part of the IHP 
application process. 

In addition to IHP and TSA, which were administered by FEMA's 
Individual Assistance program, FEMA implemented the STEP initiative in 
the weeks after Hurricane Sandy and reimbursed local governments the 
cost for providing this assistance to disaster survivors through the 
Public Assistance program. STEP was a pilot program intended to reduce 
the demand for other FEMA-provided shelter, such as congregate 
shelters or TSA, and allow individuals to return to or remain in their 
homes.[Footnote 20] Limiting the need for sheltering assistance 
outside of residents' homes was particularly important because 
Hurricane Sandy affected an area with high population density, limited 
space, and high demand for hotel rooms and other potential sheltering 
facilities. The STEP program shares some commonality with IHP, as it 
provides basic repairs to disaster-affected residences such as for 
electricity, heat, hot water, securing broken windows, and covering 
exterior walls and roofs. However, STEP is intended only to make the 
homes habitable for the short term and does not provide any assistance 
beyond basic repairs to homes, whereas IHP provides financial 
assistance for home repair or replacement, rental expenses, damaged 
personal property, and other needs. In New York City, the New York 
City Rapid Repair Program augmented STEP to allow for repairs to 
multifamily dwellings and more permanent repairs needed to meet 
building codes. FEMA reported that STEP had provided repairs to 
approximately 12,500 separate households in New Jersey and New York. 
FEMA also reported that, as of June 2014, nearly $418 million had been 
expended through the STEP program to states and localities, which were 
responsible for establishing contracts with service providers to 
assist residents in need of repairs. These states and localities later 
provided FEMA with the records of service, which were maintained at 
the state or local level, for reimbursement. 

Finally, homeowners with mortgages held by federally regulated private 
lenders on property in participating communities identified by FEMA to 
be in special flood hazard areas are required to purchase flood 
insurance under the National Flood Insurance Program (NFIP). Under 
NFIP, the federal government assumes the liability for the insurance 
coverage and sets rates and coverage limitations, among other 
responsibilities, while private insurers sell the policies and 
administer the claims for a fee determined by FEMA. While certain 
homeowners are required to purchase flood insurance, any property 
owner regardless of flood risk may purchase NFIP flood insurance if 
their community participates in the program. NFIP is administered by 
FEMA's Federal Insurance and Mitigation Administration on behalf of 
the federal government, which is responsible for administering 
programs that provide assistance for mitigating future damage from 
natural hazards.[Footnote 21] Homeowners who fail to maintain flood 
insurance despite being required to do so are usually not eligible for 
repair, replacement, or restoration assistance from FEMA or other 
federal agencies for insurable damage related to flooding. 

Table 2 summarizes the disaster-recovery programs discussed in this 
report. 

Table 2: Federal Emergency Management Agency (FEMA) Disaster-Recovery 
Programs and Status of Hurricane Sandy Expenditures as of November 
2013: 

Disaster-recovery program: Individuals and Households Program (IHP); 
Type of program: Individual Assistance; 
Payment or assistance provided: Up to $31,900 for home repair, rent, 
and other disaster-related expenses; 
Number of households receiving assistance or claims payments following 
Hurricane Sandy: 182,782[A]; 
Funds expended or claims paid following Hurricane Sandy (millions of 
dollars): $1,439. 

Disaster-recovery program: Transitional Shelter Assistance (TSA); 
Type of program: Public Assistance; 
Payment or assistance provided: FEMA-paid lodging in local hotels; 
Number of households receiving assistance or claims payments following 
Hurricane Sandy: 11,505; 
Funds expended or claims paid following Hurricane Sandy (millions of 
dollars): $106. 

Disaster-recovery program: Sheltering and Temporary Essential Power 
(STEP); 
Type of program: Public Assistance; 
Payment or assistance provided: Basic home repairs to allow survivors 
to return quickly; 
Number of households receiving assistance or claims payments following 
Hurricane Sandy: Approximately 12,500; 
Funds expended or claims paid following Hurricane Sandy (millions of 
dollars): $418[B]. 

Disaster-recovery program: National Flood Insurance Program (NFIP); 
Type of program: Insurance; 
Payment or assistance provided: Insurance claims to policyholders for 
flood damage; 
Number of households receiving assistance or claims payments following 
Hurricane Sandy: 144,293; 
Funds expended or claims paid following Hurricane Sandy (millions of 
dollars): $8,202[C]. 

Source: FEMA and GAO analysis of FEMA data. GAO-15-15. 

[A] Since FEMA provided the data in November 2013, IHP assistance had 
increased to $1,454 million for 182,911 recipients as of August 2014. 

[B] Data for STEP were provided in September 2014. 

[C] Data for NFIP data are current as of June 2014. 

[End of table] 

New Controls Introduced after Hurricanes Katrina and Rita: 

In responding to disasters and federal legislation since Hurricanes 
Katrina and Rita, FEMA implemented new controls designed to improve 
its capacity to verify applicants' eligibility for assistance. We 
reported in June 2006 that in response to Hurricane Katrina, FEMA made 
between $600 million to $1.4 billion in improper and potentially 
fraudulent payments, in part due to insufficient steps by FEMA to 
verify applicants' identities and residences.[Footnote 22] Verifying 
identities is an essential step in preventing fraud, waste, and abuse. 
[Footnote 23] After Hurricanes Katrina and Rita, we also identified 
potential fraud and abuse related to the temporary housing assistance 
FEMA provided to individuals displaced by the disasters. For example, 
in the wake of these hurricanes, we reported that some survivors were 
simultaneously staying in hotels under TSA and receiving cash rental 
assistance payments.[Footnote 24] In addition, in March 2007 we 
reported that FEMA made nearly $20 million in duplicate payments to 
over 7,000 applicants who improperly claimed the same damaged property 
for both Hurricanes Katrina and Rita.[Footnote 25] We made a number of 
recommendations in our March 2007 report to help minimize duplicate 
payments, which FEMA has implemented as discussed below. 

FEMA instituted a number of changes following Hurricanes Katrina and 
Rita and implemented new fraud-prevention controls in response to 
Hurricanes Gustav and Ike in 2008. As we reported in June 2009, FEMA 
established identity and address verification on all applications, 
identified duplicate registrations, and increased requirements for 
home inspections. In addition, FEMA began requiring individuals in 
need of housing assistance to provide valid registration numbers 
before checking into FEMA-paid-for hotels.[Footnote 26] 

In addition, FEMA took steps to respond to requirements included in 
the Post-Katrina Emergency Management Reform Act of 2006 (PKEMRA). For 
example, PKEMRA required FEMA to develop and implement a training 
program to prevent waste, fraud, and abuse. In response, FEMA now 
requires all employees to take a fraud-prevention course each calendar 
year and contractors for FEMA Disaster Housing Inspections provide 
fraud and abuse avoidance training to the inspectors.[Footnote 27] 

PKEMRA also required that FEMA submit any database or processing 
system to the Department of Homeland Security Office of the Inspector 
General (DHS OIG) for a review of internal controls. In response, the 
DHS OIG has issued a series of reports on FEMA's internal controls. 
For example, in 2009, a DHS OIG analysis of disaster registration and 
payment data concluded that FEMA made virtually no payments to 
applicants with invalid or duplicate SSNs and made far fewer payments 
to applicants who had provided other duplicate information for the 
2008 disasters.[Footnote 28] In the same report, the DHS OIG reported 
that IHP payments to duplicate, improper, and potentially fraudulent 
registrations decreased substantially since Hurricane Katrina, 
primarily because FEMA required inspection of every applicant's home 
before it would process an assistance payment. 

FEMA Implemented Controls to Prevent Assistance to Ineligible 
Recipients, but Opportunities Exist to Further Enhance Oversight: 

The controls that FEMA implemented have improved the agency's ability 
to prevent improper or potentially fraudulent payments, and the amount 
of such payments for Hurricane Sandy decreased compared to Hurricanes 
Katrina and Rita. However, we identified some limitations in the 
agency's validation of Social Security numbers (SSN), identification 
of duplicate applications, and oversight of flood damage assistance. 

FEMA Improved Controls for Preventing Potentially Improper or 
Fraudulent IHP Payments prior to Hurricane Sandy: 

While safeguards were generally not effective after Hurricanes Katrina 
and Rita, the controls FEMA implemented since then have improved the 
agency's ability to prevent improper or potentially fraudulent IHP 
payments. After ensuring that payments in multiple at-risk categories 
were not counted more than once (as discussed below), we identified 
about $39 million, or 2.7 percent of the more than $1.4 billion in IHP 
assistance, that was at risk of being improper or potentially 
fraudulent after Hurricane Sandy.[Footnote 29] By comparison, the 
estimated proportion of improper and potentially fraudulent IHP 
payments made in response to Hurricanes Katrina and Rita was between 
$600 million to $1.4 billion, or 10 to 22 percent, of the $6.3 billion 
of assistance provided. FEMA reports that it is in the process of 
trying to recover some of the improper payments from Hurricane Sandy 
and reported that it has requested repayment of over $8.5 million and 
had recouped about 8 percent of that amount as of October 2014. 

As described in more detail through the rest of the report, we defined 
improper and potentially fraudulent payments as including assistance 
that was provided to (1) state prisoners, (2) individuals using SSNs 
that did not match SSA's records or belonged to likely deceased 
individuals, (3) applicants using the same identifying information as 
other applicants, and (4) applicants receiving payments for damage 
that were at risk of being duplicative with damage covered by a 
private homeowners insurance policy. It also includes payments for 
flood-related damage for which documentation was not sufficiently 
transparent to provide assurance that the payments were for eligible 
damage. In our calculation, however, the $39 million in at-risk 
dollars is the maximum amount at risk that we identified, and we 
referred each of these cases to FEMA for further investigation. Based 
on several examples provided by FEMA in response to our analysis, we 
would expect case-by-case investigations of these payments to show 
that some of the payments were proper. Thus, the actual percentage of 
fraudulent or improper payments could ultimately amount to less than 
the Office of Management and Budget's benchmark for identifying 
programs with significant improper payments.[Footnote 30] Table 3 
lists the categories of at-risk payments we identified, along with the 
frequency and dollar amount of the payments. Because some of the 
payments we identified as being at risk appear in more than one 
category, the sum of the dollar amounts for each category in the table 
is greater than our total at-risk calculation of $39 million, which 
counts the payments included in multiple categories only once. 
Additionally, and as discussed below, FEMA officials stated that at 
least $6.1 million of the payments we identified as being at risk were 
deemed appropriate upon the agency's subsequent review of our matching 
results and related applicant files (see appendix III). However, we 
were not able to independently verify what FEMA officials told us 
without additional investigation into each payment. Accordingly, while 
we present what FEMA officials told us about the outcome of their 
review as context from the agency's perspective, we continue to 
include these cases in our at-risk calculation. 

Table 3: Summary of IHP Assistance Identified as At-Risk for Potential 
Fraud or Improper Payments: 

Type of risk for payments made: Receipt of rental assistance while 
incarcerated; 
Number of IHP registrations: 2; 
At-risk assistance (dollars): $7,328.00. 

Type of risk for payments made: Social Security number (SSN) was 
invalid, did not match Social Security Administration's (SSA) records 
for other identifying information, or SSN belonged to likely deceased 
individual; 
Number of IHP registrations: 2,610; 
At-risk assistance (dollars): $21,892,332.43. 

Type of risk for payments made: Duplicates not flagged by the Federal 
Emergency Management Agency (FEMA); 
Number of IHP registrations: 203; 
At-risk assistance (dollars): $1,679,836.63. 

Type of risk for payments made: SSNs used by multiple recipients; 
Number of IHP registrations: 20; 
At-risk assistance (dollars): $180,725.43. 

Type of risk for payments made: Bank accounts used by multiple 
recipients; 
Number of IHP registrations: 147; 
At-risk assistance (dollars): $1,247,660.29. 

Type of risk for payments made: Addresses where more than 1 applicant 
received home-repair assistance; 
Number of IHP registrations: 128; 
At-risk assistance (dollars): $1,324,189.94. 

Type of risk for payments made: Address and last name used by multiple 
recipients and cumulatively receiving more than $31,900; 
Number of IHP registrations: 418; 
At-risk assistance (dollars): $1,153,336.95. 

Type of risk for payments made: Receipt of funeral assistance through 
a second registration in the same household; 
Number of IHP registrations: 18; 
At-risk assistance (dollars): $71,716.16. 

Type of risk for payments made: Receipt of home-repair assistance and 
claiming to lack private homeowner's insurance while maintaining 
federally backed mortgage; 
Number of IHP registrations: 534; 
At-risk assistance (dollars): $2,324,748.49. 

Type of risk for payments made: Inaccurate flags for National Flood 
Insurance Program (NFIP) compliance; 
Number of IHP registrations: 1,322; 
At-risk assistance (dollars): $10,542,717.72. 

Source: GAO analysis of FEMA data. GAO-15-15. 

Note: Because some of the payments we identified as being at risk 
appear in more than one category, the sum of the dollar amounts for 
each category in the table is greater than our total at-risk 
calculation of $39 million, which counts the payments included in 
multiple categories only once. 

[End of table] 

Two Applicants Incarcerated in State Prisons Obtained Rental 
Assistance through IHP but May Have Been Eligible for Assistance: 

The Stafford Act specifies that eligibility for temporary housing 
assistance is predicated on individuals or households being displaced 
from their predisaster primary residence or their predisaster primary 
residence being rendered uninhabitable or inaccessible due to the 
disaster. FEMA may provide temporary housing assistance in the form of 
financial assistance to individuals or households to rent alternate 
housing accommodations. Generally, the eligibility criteria will 
exclude incarcerated individuals from receiving financial assistance 
for the time they are in prison, as they do not have a disaster-
related need for housing.[Footnote 31] In a 2006 testimony, however, 
we described how FEMA paid over $3 million to over 1,000 applicants 
who used names and SSNs belonging to state and federal prisoners for 
expedited and housing assistance following Hurricane Katrina.[Footnote 
32] In July 2012, we followed up on our recommendation that FEMA 
develop a means for preventing prisoners from receiving disaster 
assistance to which they were ineligible. In response, FEMA reported 
that it had implemented a control to flag applications using high-risk 
addresses, including prisons, for further review prior to providing 
assistance. 

To test these controls, we compared data from IHP with data from state 
prisons in the three most-affected states.[Footnote 33] Our analysis 
of FEMA data showed that out of 182,782 recipients, FEMA provided IHP 
assistance to 2 individuals who were incarcerated for the entire 6 
months following Hurricane Sandy. FEMA officials stated that both of 
the individuals, or adult members of their households, met their 
procedural requirements for assistance, which includes the owner of a 
damaged home or another individual over the age of 18 who lived in the 
home prior to the disaster to be present for the home inspection of 
the damaged addresses. However, as noted above, while FEMA was able to 
tell us about the outcome of its review, additional investigation 
would be required to validate FEMA's conclusions. Thus, we did not 
independently verify documentation that these individuals were 
eligible or were present for the inspection. 

FEMA's Internal Controls for Identifying Invalid SSNs Did Not Prevent 
Payments to Some Potentially Ineligible Recipients: 

In February 2006, FEMA began using a tool created by a contractor to 
help validate the identity of applicants during the initial review of 
an application, eliminating any wait otherwise necessary for another 
agency to validate the applicant's personal information. The validity 
check cross-references information provided by applicants against 
multiple databases, including public records, credit reports, and 
other sources. According to FEMA officials, the validity check uses 
SSA's Death Master File, which is a publicly available subset of the 
death records that SSA maintains on deceased SSN-holders.[Footnote 34] 
Officials further stated that the validity check compares the 
applicant's SSN and other identifying information with these various 
public sources of information to verify that the SSN matches the name 
of the applicant, does not belong to a deceased individual, and is not 
associated with more than one person (e.g., the SSN has been used in 
an instance of identity theft). Officials said that in addition to 
verifying applicants' SSNs, the validity check provides other checks. 
For example, it compares damaged property addresses with public 
records to verify that the applicant lived at the damaged property. It 
also flags "high-risk" addresses, such as addresses of businesses and 
prisons. 

While FEMA's SSN validity check is designed to identify and flag 
ineligible applicants, we found that 2,610 of the 182,782 IHP 
recipients had SSNs that could either not be validated by SSA or 
appeared on the full death file. These individuals received over $21 
million in assistance through the IHP. We identified these 2,610 
recipients for potential ineligibility by using multiple sources of 
SSA data. Specifically, we compared IHP applicants' names, dates of 
birth, and SSNs to SSA's records using SSA's Enumeration Verification 
System (EVS). EVS flags SSNs in which the name or date of birth (or 
both) do not match its records for the SSN, as well as SSNs that have 
never been issued. We also compared IHP applicants to SSA's full death 
file to identify individuals who may have used a likely deceased 
person's identity to receive assistance. As discussed earlier, the 
full death file lists all SSNs of people for whom SSA has received a 
record of death, and FEMA uses a subset of the full death file as part 
of its validity checks. 

Of the 2,610 recipients, our analysis showed that 10 recipients used 
SSNs that had never been issued. These 10 recipients received 14 
assistance payments totaling less than $43,000, about 0.004 percent of 
the payments made to the 182,782 recipients in our review. While this 
may indicate a limitation in FEMA's validity check, FEMA nevertheless 
processed fewer payments to applicants using SSNs that had never been 
issued, suggesting that on the whole FEMA's ability to screen 
applicants based on invalid SSNs improved. For instance, in our 
previous work on Hurricanes Katrina and Rita, we estimated that 0.8 
percent (or 20,800 payments) of the 2.6 million payments made through 
the IHP were to applicants who used SSNs that had never been issued. 
[Footnote 35] 

FEMA reviewed a nongeneralizable sample of 41 of the 2,610 recipients 
we identified with names or dates of birth that did not match SSA's 
records and found that all 41 passed its validity check for SSNs. 
During its review of our analysis, FEMA officials indicated that they 
used a different third-party vendor's software from the one FEMA uses 
when it initially receives an application for assistance to verify 
that the payments were proper. Based on its results, FEMA suggested 
that a majority of recipients in the sample could have been flagged by 
EVS because they had changed their last names due to marriage or 
divorce but had not reported the change to SSA. While this may be 
case, individuals who legally change their name are to report the 
change to SSA. Hence, applicants with names that do not match SSA's 
records are to provide evidence of their legal name prior to receiving 
assistance from federal programs like IHP. These 41 recipients were 
not selected randomly; therefore, conclusions regarding the 
appropriateness of the payments for the 2,610 recipients we identified 
cannot be made from the sample FEMA reviewed. 

We also found that 45 of the 2,610 recipients appeared on the full 
death file and had an IHP application dated after the reported date of 
death.[Footnote 36] These 45 recipients received over $465,000 in 
assistance. In response to our request for additional information 
about these cases, FEMA selectively reviewed 36 of the cases and 
determined that in 26 of these cases either a coapplicant was eligible 
for assistance because he or she was both an occupant of the damaged 
property and an heir to the property due to the death of the owner; or 
there was no indication in the file supporting the situation that the 
applicant was deceased at the time of the disaster, at inspection, or 
during calls made by the joint field office.[Footnote 37] FEMA 
officials stated that in the remaining 10 cases, 7 were submitted for 
recoupment review, 2 had payments returned voluntarily, and the last 
was likely under investigation for fraud. 

While some of the information FEMA provided for 26 of the cases may 
explain why a coapplicant is eligible for an assistance payment made 
to a deceased applicant, other instances related to the other 
recipients will require additional follow up by FEMA to determine 
whether the payments were potentially improper or fraudulent. For 
instance, when there is no indication in a file that an applicant is 
deceased, it could be that FEMA's identity check did not detect the 
use of a deceased person's identity. Furthermore, FEMA allows 
individuals other than the applicant to meet with an inspector and 
handle other aspects of the application--a measure often important for 
applicants who are physically unable to meet with an inspector 
because, for example, they took shelter with family out of town or are 
too ill or infirm to travel to the damaged home. However, if FEMA's 
verification check did not identify a deceased individual, this 
flexibility in who meets with the inspector can increase the risk of 
fraud. 

As demonstrated by our analysis, FEMA's control to ensure the validity 
of applicants' SSNs--that the SSN belongs to the applicant and does 
not belong to a likely deceased individual--could be enhanced if it 
obtained more-comprehensive sources of information, such as SSA's full 
death file--the tool we used to identify likely deceased individuals. 
In addition, FEMA officials stated that the agency's validity check 
does not confirm that the date of birth is consistent with the name 
and SSN on the application, which we were able to do by using SSA's 
EVS. Such differences could explain why we were able to identify more 
potentially fraudulent transactions, such as recipients being 
potentially deceased or as having SSNs that did not match the 
associated name and date of birth as registered with SSA. As an 
assistance-providing federal agency, FEMA may have the authority to 
access SSA's more-comprehensive death file data.[Footnote 38] FEMA may 
also be able to establish an information-sharing agreement with SSA to 
access EVS in order to verify the SSNs provided by IHP applicants. 
[Footnote 39] However, in providing technical comments on a draft of 
this report in November 2014, FEMA stated that as of October 2014 it 
had determined that the agency may be able to cross-check applicant 
data with SSA's full death file. FEMA further stated that it had not 
contacted SSA to explore the cost and feasibility of accessing the 
full death file or EVS, although officials are open to considering 
this option if it is found to be the best approach. Under IHP, FEMA is 
to ensure that recipients are eligible for assistance. Supplementing 
the verification check that the contractor uses with SSA data could 
enable FEMA to further identify potentially ineligible applicants and 
reduce the risk of improper or fraudulent payments. 

FEMA's Internal Controls Helped Prevent Improper Payments to Most but 
Not All Applicants Using Duplicate Applicant Information: 

FEMA's National Emergency Management Information System (NEMIS) uses 
an automatic control to identify IHP applications containing the same 
identifying information as other applicants to preclude payment of 
duplicate benefits. FEMA officials explained that this control is 
designed to identify applicants who have submitted duplicative 
information in one or more of four fields on the application: SSN, 
address, phone number, and bank account number. For example, the 
control is designed to hold payments to an applicant using the same 
SSN as another applicant who received assistance until a FEMA official 
can manually review the application and determine whether payment is 
appropriate. FEMA officials document in NEMIS their rationale for 
approving payments in these cases. 

Duplicative information in one or more of those four fields can 
suggest potential fraud. Specifically, it can indicate that an 
applicant is applying multiple times or that more than one member of a 
household is applying for IHP assistance, which is generally not 
allowed in the program.[Footnote 40] For example, SSNs are assigned to 
individuals, so applicants using the same SSN are likely to be either 
one person with multiple applications or an instance of possible 
identity fraud. Duplicate bank accounts also indicate a higher risk 
that multiple applicants from one household are requesting assistance. 
For example, two individuals sharing a bank account are likely to 
share living expenses and income, as one might expect to see in a 
household. Applicants with duplicate identifying information in the 
address and phone number fields may pose a risk, for example, of more 
than one person applying for benefits for the same damage, such as to 
a vehicle or other personal property, for which only one person, alone 
or as head of household, is eligible. 

We tested whether FEMA's control to identify applications containing 
the same identifying information as other applications functioned 
consistently and found that it identified most such applications. 
Specifically, we found that, of the 182,782 IHP recipients, 36,021 
records shared duplicate SSNs, addresses, phone numbers, or bank 
accounts with one or more other applicants. FEMA's control flagged 
35,818 (99 percent) of these 36,021 recipients as having duplicate 
information when the applications were first processed. According to 
FEMA, these payments were to be halted until FEMA staff manually 
reviewed the applications. FEMA provided several examples from NEMIS 
documenting FEMA staff evaluation of the duplicate information and 
their eligibility determination. 

However, the control did not identify the remaining 203 duplicate 
applicants, who received financial assistance totaling about $1.7 
million. We provided information on these missed duplicates to FEMA 
for review. FEMA officials provided the following explanations: 

* Officials stated that the control should have identified 30 of these 
applicants. As a consequence, a FEMA official should have manually 
reviewed these applications before a payment was processed. FEMA 
officials are investigating these 30 cases and said that they will 
analyze why NEMIS did not flag the applications. 

* In 125 cases, officials explained that the duplicate applications 
were filed in different states and thus assigned a different disaster 
number. FEMA assigns separate disaster numbers for each state affected 
by a single disaster as each state receives its own presidential 
declaration of disaster. Because FEMA's duplicate control does not 
compare applications across different disaster numbers in different 
states, FEMA's control did not identify these applications as having 
duplicate information. As a consequence, it faced increased risk of 
providing improper assistance.[Footnote 41] 

As of August 2014, FEMA had not provided explanations for the 48 
remaining instances in which we identified applications with duplicate 
information that were not flagged by FEMA's system. FEMA officials 
were unable to explain why the control did not function properly for 
all of the cases we identified but said that they will examine the 
control further to determine why it functioned inconsistently. 
According to standards for federal information-system controls, 
evaluating controls can help reduce risk in government programs. 
[Footnote 42] Identifying the cause for the control's inconsistent 
performance to the extent that the benefits exceed the costs could 
better position FEMA to determine whether modifications to the control 
are appropriate to reduce the chance of it missing duplicates in 
future applications. Additionally, Standards for Internal Controls in 
the Federal Government states that risks should be analyzed for their 
possible effect in order to determine how to manage the 
risks.[Footnote 43] As such, an analysis of the assistance provided to 
recipients using duplicate identifying information who were not 
flagged by FEMA's internal controls, including the costs of options 
available to address the issue, may provide insight as to how to 
effectively manage this risk in the future. 

In addition to testing whether FEMA's control consistently identified 
applications with duplicative identifying information, we 
independently analyzed the 36,021 recipients to identify what we 
considered "high-risk" recipients: These were recipients who FEMA's 
control flagged as a duplicate but for which FEMA subsequently 
provided assistance payments and that met our criteria for high risk. 
These criteria, as discussed in greater detail below, included any 
instance in which assistance was provided to (1) recipients using the 
same SSN, (2) recipients using the same bank account, and (3) 
recipients using the same address or phone number as well as other 
identifying information such as the same last name, which are 
indications that two individuals are of the same household. 

Recipients with Duplicate SSNs: 

Because SSNs are assigned to individuals, applications with the same 
SSN are likely to be either one person with multiple applications or 
an instance of possible identity fraud. Our analysis found that 10 
recipients received assistance through two registration accounts each, 
both of which used the same SSN and other identifying information. 
Collectively, the 10 recipients were recorded as 20 different 
individuals in NEMIS and obtained $180,725 in assistance. We provided 
information about these cases to FEMA for explanation. In 5 cases, 
FEMA officials stated that the manual review had improperly allowed 
payment, and FEMA initiated efforts to further review and, as 
appropriate, recoup the assistance. FEMA officials stated that a 
caseworker had not followed proper procedures in completing manual 
reviews for these 5 individuals. In four cases, FEMA officials 
permitted an individual to use a second registration account to obtain 
additional assistance for funeral expenses for relatives who passed 
away as a result of the storm. We discuss these cases in greater 
detail below. In the last case, FEMA officials stated that the 
applicant withdrew the second application upon being informed of the 
duplication, and that, while a rental assistance check had been issued 
through the second registration, the individual would have been 
eligible for the additional payment had the individual continued to 
use the first registration, so recovery of payments was unnecessary. 

Recipients with Duplicate Bank Accounts: 

Individuals sharing a bank account are likely to share living expenses 
and income, as one might expect in a household with cohabitants. 
However, only one member of a household is generally eligible to 
receive IHP assistance. We found 147 recipients out of the 36,021 
duplicates who shared a bank account with at least one other 
recipient, receiving a total of about $1.2 million. Furthermore, of 
these 147 recipients, 81 had matching last names in addition to bank 
account numbers. In 22 of those cases, the address and phone number 
also matched, increasing the risk of an improper or potentially 
fraudulent payment (see figure 3). FEMA officials stated that 133 of 
the 147 recipients did not receive duplicative benefits. Payments to 4 
recipients had already been identified as improper and recouped by 
FEMA, and an additional 10 were identified and submitted for 
recoupment review. 

Figure 3: Individuals and Households Program (IHP) Recipients Using 
Duplicate Bank Accounts: 

[Refer to PDF for image: illustration of concentric circles] 

Duplicate bank account: 
We found 147 recipients who shared a bank account with at least one 
other recipient, receiving a total of about $1.2 million. 

Duplicate bank account and last name: 
Of these 147 recipients, 81 had matching last names in addition to 
bank account numbers. 

Duplicate bank account, last name, address, and phone number: 
In 22 of the 81 cases, the address and phone number also matched, 
suggesting that these were members of the same household and that 
therefore at least one payment was likely to be improper. 

Source: GAO analysis of FEMA data. GAO-15-15. 

Note: As of October 2014, the Federal Emergency Management Agency 
(FEMA) reviewed payments to these 147 recipients, stating that 133 did 
not receive a duplication of assistance and that the remaining 14 
recipients were either being reviewed for recoupment of payments or 
had already repaid the duplicative assistance. We could not 
independently confirm FEMA's conclusions without additional 
investigation for each payment. 

[End of figure] 

In addition, we identified nine bank accounts among these 147 
recipients that received payments totaling more than $31,900, the 
maximum amount allowable per household. FEMA officials stated that 
payments were allowable for eight of these nine bank accounts. They 
further explained that they began seeking recoupment of payments to 
the other bank account in January 2013 when they discovered that the 
manual review had incorrectly determined to pay this applicant. 

Recipients with Duplicate Addresses or Phone Numbers and Other Risk 
Factors: 

In cases where we found recipients with duplicate addresses or phone 
numbers, we looked for additional risk factors that could indicate the 
applicants were part of the same household.[Footnote 44] Specifically, 
we found 128 recipients using 66 addresses at which more than one 
person received home-repair assistance--a type of assistance that FEMA 
officials said should be provided to only one person per home 
regardless of how many people lived in a damaged home. This assistance 
totaled $1.3 million. FEMA reviewed the records of these 128 
recipients and stated that 99 recipients did not receive duplications 
of assistance, while payments to 3 recipients had already been 
identified as improper and recouped by FEMA and an additional 26 were 
identified and submitted for recoupment review. 

Additionally, we found 1,007 addresses at which multiple recipients 
cumulatively received more than the $31,900 maximum allowed per 
household. In 202 of those instances, totaling $7.6 million and 
including 418 recipients, applicants shared a last name with another 
recipient at that address, suggesting that the recipients may have 
composed a household (see figure 4). FEMA's review of 200 of the 418 
recipients concluded that 46 of these 200 recipients did not receive 
duplications of assistance and an additional 100 maintained renter and 
landlord relationships, so all parties were eligible for the 
assistance received. According to FEMA officials, the remaining 54 
recipients were in recoupment review or had repaid the duplicative 
payments. 

Figure 4: Individuals and Households Program (IHP) Addresses at Which 
Multiple Recipients Received More than a Combined $31,900: 

[Refer to PDF for image: illustration of concentric circles] 

Duplicate addresses receiving more than $31,900: 
We found 1,007 addresses at which multiple recipients received more 
than $31,900 maximum allowed per household. 

Applicants shared a last name with another recipient at that address: 
In 202 of those instances, totaling $7.6 million, applicants shared a 
last name with another recipient at that address, suggesting that the 
recipients may have composed a household. 

Source: GAO analysis of FEMA data. GAO-15-15. 

Note: $31,900 is the maximum allowable amount of assistance to an 
individual or household. 

[End of figure] 

As of October 2014, FEMA reviewed 200 of the 418 recipients residing 
at the 202 addresses where recipients shared a last name and address, 
stating that 145 did not receive a duplication of assistance and that 
the remaining 55 recipients were either being reviewed for recoupment 
of payments or had already repaid the duplicative assistance. We could 
not independently confirm FEMA's conclusions without additional 
investigation for each payment. 

Receipts of Funeral Assistance through a Second Registration in the 
Same Household: 

As mentioned above, FEMA officials stated that there were 4 instances 
in which an individual applicant was allowed to use a second 
registration number to apply for and receive funeral expenses. 
However, we found 5 additional instances in which members of a single 
household were allowed to create a second registration account to 
receive additional assistance for funeral expenses.[Footnote 45] The 9 
cases involved 18 recipients who received a total of nearly $72,000 
for funeral expenses. In these cases, individuals received as much as 
an additional $10,000 for funeral expenses, and in 3 cases the total 
amount of assistance exceeded the $31,900 limit per household. While 
this approach was not consistent with federal law, the decision to 
provide additional aid was made for humanitarian reasons. In April 
2014, FEMA clarified its guidance to explicitly state that a second 
registration could not be used for funeral expenses, as that could 
allow a household to exceed the $31,900 assistance cap. 

FEMA Could Enhance Oversight of Assistance for Flood-Related Damage: 

Individuals that receive IHP assistance for flood-related damage in a 
disaster and live in certain flood zones are generally required to 
purchase and maintain flood insurance as a condition of receiving 
assistance from the IHP for flood-related damage.[Footnote 46] An 
individual was generally not eligible to receive IHP assistance for 
flood-insurable items that incurred flood-related damage from 
Hurricane Sandy if the damaged property had a flood-insurance 
requirement from a prior disaster but the owner did not comply with 
this requirement and did not maintain a policy.[Footnote 47] 

FEMA uses information from two NFIP-related databases to populate 
fields in its IHP database to flag IHP applicants who are potentially 
ineligible for assistance for flood-related damage.[Footnote 48] Table 
4 shows the definitions of the flag FEMA uses to document flood-
insurance requirement compliance and, by extension, applicant 
eligibility to receive flood-related assistance. 

Table 4: Definitions of Flood-Insurance Compliance Flag in Federal 
Emergency Management Agency (FEMA) Database: 

Flagged as "Yes": (compliant): Damaged property has a flood-insurance 
requirement and the policy is maintained;[A] or; Damaged property has 
no flood-insurance requirement; 
Flagged as "No": (noncompliant): Damaged property has a flood-
insurance requirement that is not maintained. 

Source: FEMA. GAO-15-15. 

[A] An applicant is considered compliant if there is an active flood-
insurance policy at the time the damage occurs for at least the amount 
of assistance received during a previous disaster. 

[End of table] 

According to our analysis of the 182,782 IHP recipients, we found that 
39,766 received about $385 million in assistance for flood-related 
damage.[Footnote 49] However, FEMA flagged 1,322 of these 39,766 
individuals as being noncompliant with an existing flood-insurance 
requirement and provided these individuals with about $10.5 million in 
assistance for flood-related damage. 

FEMA reviewed a nongeneralizable sample of 63 of these noncompliant 
cases to explain why these applicants received assistance for flood-
related damage. FEMA officials determined that in 26 of the cases, the 
recipient was compliant at the time of the assistance payment. In 
another 31 cases, the recipient was noncompliant at the time of 
Hurricane Sandy, but received assistance for items not covered by 
flood-insurance, which constitute eligible payments. In the remaining 
6 cases, the assistance for flood-related damage was paid in error and 
is eligible for recoupment. The officials further explained that many 
of those flagged as noncompliant were individuals whose property did 
not have a flood-insurance requirement prior to Hurricane Sandy, and 
the noncompliant flag appeared after receiving IHP assistance for 
flood-related damage. According to the officials, the fields that are 
populated from the NFIP-related databases are updated on a continuous 
basis. FEMA officials explained that what likely happened with most of 
the 1,322 applicants was that their damaged property was flagged as 
compliant at the time the assistance payment for flood-related damage 
was made, but subsequent to the payment, a data change to the 
applicant's file may have prompted the system to recheck the NFIP-
related databases--and because there was no indication of the purchase 
of their newly required flood-insurance--the applicant information was 
updated and appeared in the IHP database as noncompliant. We could not 
independently corroborate the officials' explanations because the 
design of the compliance flag in the IHP database did not allow us to 
verify the applicant's flood-insurance status at the time the payment 
was made. 

Internal control standards require controls and transactions to be 
clearly documented and documentation to be readily available for 
examination.[Footnote 50] The design of the compliance flag prevents 
FEMA or other reviewers from determining, after the fact, whether a 
noncompliance flag meant that an applicant was ineligible for 
assistance for flood-related damage after Hurricane Sandy. FEMA 
officials told us that currently there is not a way to tell through 
review of an applicant's file alone what an applicant's compliance 
status was at the time of the IHP assistance payment. As a result, 
when we presented FEMA officials with the 1,322 records that indicated 
a noncompliant applicant received IHP assistance for flood-related 
damage, FEMA officials could only determine whether a particular 
applicant was in fact eligible for the assistance payment for flood-
related damage by reviewing an external NFIP-related database. The 
need for this extra step to review these transactions makes it more 
difficult to determine how much IHP assistance might have been 
improperly paid. FEMA officials also stated that the interaction 
between the IHP and NFIP databases was based on legacy systems that 
are in need of updating, which they are exploring. Specifically, FEMA 
officials told us that they are currently developing a budget for 
acquiring new information-technology capabilities and, in the agency's 
November 2014 written response to this report (see appendix IV), 
produced a set of development milestones to improve this compliance 
flag by May 31, 2016. FEMA officials stated that they were supportive 
of an enhancement to improve the current system's ability to track 
flood-insurance compliance and provide additional assurances that 
recipients were, in fact, eligible for IHP assistance for flood-
related damage. Updating the legacy systems could be a good 
opportunity to redesign the compliance flag in the IHP system so that 
it will preserve the applicant's compliance status at the time of the 
IHP assistance payment. 

FEMA and the States Faced Challenges in Obtaining and Sharing 
Information Needed to Prevent Payments from Potentially Overlapping 
Sources: 

We found that FEMA and state governments did not have the information 
necessary to determine whether FEMA was successful in preventing IHP 
recipients from receiving overlapping payments from FEMA's Sheltering 
and Temporary Essential Power (STEP) program. FEMA implemented a new 
intra-agency data-sharing agreement in April 2014 to help make future 
information sharing between these programs easier. In addition, FEMA 
does not have a mechanism to verify whether individuals have 
homeowners insurance, which would limit IHP payments for damages also 
covered by private insurance. 

Limited STEP Data Posed a Challenge in FEMA's Efforts to Design 
Controls and Determine Whether STEP Recipients Also Received IHP 
Assistance: 

FEMA's guidance states that individuals who participate in the STEP 
pilot program are generally ineligible for IHP rental assistance once 
STEP-related work is completed, but FEMA did not have controls in 
place to limit IHP assistance from being offered to STEP recipients. 
FEMA's evaluation of the STEP program could help develop these 
controls by first collecting data from states and localities that 
implemented STEP. Specifically, FEMA asked that localities provide 
data on STEP participants by September 30, 2014, and FEMA plans to use 
the data to evaluate the pilot program, including lessons learned. 
However, according to the agency's analysis plan, this information 
will not permit FEMA to determine how many STEP recipients were living 
in TSA housing or receiving IHP rental assistance after STEP work was 
completed on their residence, and several challenges may hinder its 
efforts.[Footnote 51] 

When it initiated STEP in the weeks following Hurricane Sandy, FEMA 
did not provide guidance to states and localities that would help it 
obtain complete information about the participants in the STEP 
program. Specifically, FEMA's guidance for data collection directed 
the localities that implemented STEP to provide FEMA and the 
appropriate state with a list of residences that received STEP 
assistance, including the owner's/occupant's name, residential 
address, and IHP registration ID, if applicable.[Footnote 52] However, 
FEMA did not direct the localities to collect additional data elements 
on residents served, such as dates of service, which would have 
allowed FEMA to determine whether individuals were receiving rental 
assistance or remained in TSA lodging after repairs on their home were 
complete.[Footnote 53] As a result, localities defined the required 
information differently and collected different types of data outside 
of the required fields. For instance, FEMA officials told us that some 
localities collected names and addresses of participants but not the 
dates on which repairs were begun and finished. In addition, 
localities defined service dates differently. For example, some 
localities defined the start date as the date on which the repair work 
was initiated, while other localities defined it as the date of the 
initial assessment. FEMA has identified the absence of consistent data 
as a challenge for its analysis and its ability to understand whether 
STEP recipients continued to receive rental or other potentially 
duplicative assistance after repairs were complete. 

FEMA officials also told us that one obstacle to collecting STEP data 
for comparison to TSA and IHP data is that, prior to Hurricane Sandy, 
they did not take the steps under the Privacy Act of 1974 to allow 
them to collect more personally identifiable information, such as SSNs 
or dates of birth, on individuals who received assistance through 
Public Assistance programs like STEP. As a consequence, FEMA could not 
identify and compare individuals who received STEP assistance with 
those who received TSA and IHP. FEMA officials also stated that their 
ability to request recipient addresses from local jurisdictions and 
compare them against data on individuals receiving other types of 
assistance in real time was inhibited because they did not have this 
authority immediately after Hurricane Sandy. 

In response to these issues, in March 2014, FEMA published a new 
System of Records Notice, as required by the Privacy Act, on data 
sharing to make information sharing between programs easier.[Footnote 
54] Specifically, under the new rule, which took effect in April 2014, 
in future disasters FEMA will be able to instruct localities to 
collect and share relevant information on properties and individuals 
receiving assistance through Public Assistance efforts such as STEP, 
and FEMA will be able to compare this to assistance provided through 
Individual Assistance. FEMA officials expect the new data rule will 
help them to more accurately identify and monitor private properties 
that have been damaged by a disaster and are in need of Public 
Assistance for purposes of preventing duplication of benefits. 
According to the officials, FEMA has set up a committee to explore 
ways to maintain and share this data by developing a comprehensive 
information-technology system to house relevant disaster data, 
including information gathered by IHP and Public Assistance so that 
different entities within FEMA can access it. This committee should 
provide FEMA an opportunity to identify the specific fields it will 
need to both evaluate and prevent potentially duplicative sources of 
assistance from pilot programs, like STEP, when it implements such 
programs in the future. 

FEMA Made Payments at Risk of Being Improper Because It Did Not Have a 
Mechanism to Verify Whether IHP Recipients Had Homeowners Insurance: 

IHP provides disaster survivors with home-repair funds for damages not 
covered by private homeowners insurance, as federal law prohibits FEMA 
from providing assistance for damage covered by private insurance. To 
determine whether applicants carry private insurance, FEMA relies on 
self-reported data from each applicant. Specifically, applicants must 
identify any insurance policies they have during the registration 
process. 

In order to identify properties likely to have been covered by a 
homeowners insurance policy at the time of the storm, we examined IHP 
home-repair assistance provided to addresses that held mortgages 
backed by Fannie Mae, Freddie Mac, or FHA. The federally related 
mortgages of these three entities require the homeowner to maintain 
private homeowners insurance on the property, according to officials 
at those agencies. Our analysis of the 182,782 IHP recipients found 
that 40,770 were homeowners who received assistance for home repair or 
personal property damage (excluding certain flood-related damage) and 
of these, 3,718 reported that they did not have any private 
insurance.[Footnote 55] Of the 3,718 recipients, we found that 534 
(14.4 percent) received assistance for damage to a property that had a 
federally backed mortgage that required private homeowners insurance 
as of October 2012. FEMA provided over $2.3 million in assistance for 
home repair or personal property damage to these individuals (see 
table 5 below). 

Table 5: Individuals and Households Program (IHP) Home-Repair and 
Personal-Property Assistance for Recipients That Reported No Private 
Insurance but Held Federally Backed Mortgages That Require Insurance 
Coverage. 

Mortgage holder: Federal National Mortgage Association (Fannie Mae); 
Number of recipients that reported not having private insurance and 
received IHP assistance: 81; 
Assistance received[A] (dollars): $635,746. 

Mortgage holder: Federal Home Loan Mortgage Corporation (Freddie Mac); 
Number of recipients that reported not having private insurance and 
received IHP assistance: 43; 
Assistance received[A] (dollars): $166,205. 

Mortgage holder: Federal Housing Administration (FHA); 
Number of recipients that reported not having private insurance and 
received IHP assistance: 410; 
Assistance received[A] (dollars): $1,522,798. 

Mortgage holder: Total; 
Number of recipients that reported not having private insurance and 
received IHP assistance: 534; 
Assistance received[A] (dollars): $2,324,749. 

Source: GAO analysis of Federal Emergency Management Agency (FEMA), 
Fannie Mae, Freddie Mac, and FHA data. GAO-15-15. 

Note: As of October 2014, FEMA reviewed 55 of the 534 recipients, 
stating that 32 did not receive a duplication of assistance. We could 
not independently confirm FEMA's conclusions without additional 
investigation for each payment. 

[A] Excludes assistance to homeowners for flood damage to properties 
located in a special flood hazard area because such flood damage is 
typically not covered by private homeowners insurance. 

[End of table] 

We consider these payments to be at risk because these homeowners were 
likely to have insurance that typically covers this type of damage, 
although they reported that they did not. However, it is not possible 
to determine whether these matches definitively identify improper 
payments without reviewing the facts and circumstances of each case. 
Under certain circumstances, FEMA can appropriately provide assistance 
for home repair or personal property to individuals with private home 
insurance policies. For example, FEMA may provide IHP assistance for 
damage that is not covered by a particular private insurance policy or 
for damage that exceeds the limit on a private insurance policy. 
[Footnote 56] In addition, if an insurance payment is delayed by more 
than 30 days, FEMA may provide applicants with home-repair payments, 
which are considered an advance and must be repaid to FEMA once an 
insurance settlement is received. FEMA reviewed 55 of these cases and 
stated that 32 were likely appropriate because the assistance was for 
damage that likely would not have been covered by private insurance. 
Nevertheless, these payments are at higher risk of being improper if 
the recipient has an unreported homeowners insurance policy. 

GAO's fraud control framework states that information provided by 
applicants for government programs should be validated against 
government or other third-party sources.[Footnote 57] There are a 
number of options that may help FEMA better evaluate whether IHP 
applicants have homeowners insurance policies. Implementation costs 
and the extent to which self-reported data could be validated vary 
among these options. For instance, to mitigate instances in which an 
applicant was not aware that he or she had homeowners insurance or did 
not understand the question, FEMA could ask whether applicants have a 
mortgage, since most mortgages require the mortgagee to maintain 
homeowners insurance. Although FEMA officials noted that having a 
mortgage did not automatically mean that individuals have homeowners 
insurance, it would allow the agency to flag applicants who said that 
they had a mortgage but no homeowners insurance for further 
verification of lack of insurance. Alternatively, FEMA has the legal 
authority to solicit this information from housing agencies, which 
means it may be able to periodically check applicant addresses against 
Fannie Mae's, Freddie Mac's, and FHA's federally related mortgages, as 
we did. This control would not prevent all potentially improper 
payments, as not all mortgages are federally related, but could 
provide an alternative to contacting individual insurance companies 
while allowing FEMA to recoup some funds that were provided for home 
repairs already covered by homeowners insurance. FEMA has not explored 
collaborating with federal entities that guarantee mortgages, such as 
FHA, Fannie Mae, or Freddie Mac. Lastly, public-private models for 
data sharing have proved successful for other agencies. For instance, 
MITRE, a nonprofit corporation that operates federally funded research 
and development centers chartered by Congress, recently assisted a 
federal agency in exchanging sensitive information with several 
private companies from a competitive industry. MITRE collected, held, 
and conducted analysis that all participants agreed to. It then 
provided the results to the parties while protecting both sensitive 
federal data and business competitive data that the parties would not 
want to share with one another.[Footnote 58] A similar approach could 
help FEMA more systematically obtain data from private insurance 
companies. FEMA officials told us that they have the legal authority 
to solicit information from private insurance companies and have 
assessed possible mechanisms to check IHP and Public Assistance 
applicant information with data of third parties such as insurance 
companies in order to prevent a duplication of benefits. However, the 
agency did not implement this solution because the proposed mechanism 
raised privacy concerns and may have used incomplete information. 
Evaluating options, including the costs and feasibility, for verifying 
the accuracy of self-reported information FEMA received on whether 
applicants have private homeowners insurance could better position 
FEMA in making decisions about future assistance payments to help 
prevent duplication of payments to those applicants with homeowner 
insurance benefits. 

Conclusions: 

In the 7 years between Hurricane Katrina and Hurricane Sandy, FEMA 
took steps to improve its ability to prevent ineligible applicants 
from receiving assistance following a disaster. For example, FEMA's 
controls for verifying identity, residence, and other key identifying 
information have helped identify high-risk applications and reduced 
the number of ineligible individuals from receiving payments, compared 
with previous disasters. However, additional opportunities exist to 
further enhance FEMA's oversight of its assistance. Given the limited 
amounts FEMA has been able to recover from improper payments for 
Hurricane Katrina (approximately 10 percent of the original amount has 
been recovered), strengthening its preventative, up-front controls is 
a better way to protect taxpayer resources than attempting to recover 
improper payments after they are made. For example, without 
collaborating with and obtaining additional data from SSA, 
particularly data from EVS and the full death file that SSA maintains, 
FEMA risks paying ineligible applicants because its automated identity-
verification control would remain incomplete. Additionally, assessing 
the feasibility of options to enhance FEMA's automated control that 
flags applications with duplicate identifying information may help 
management select cost-effective ways to further reduce the risk of 
improper payments. With regard to flood assistance, modifying data 
fields in its IHP database would allow FEMA's management to better 
assess the extent to which only eligible applicants received 
assistance for flood-related damage. Unless FEMA leverages these 
opportunities to make changes, the potential for improper assistance 
payments like those we identified in this report will likely persist. 

FEMA continues to pilot new ways of providing assistance to disaster 
survivors, such as the STEP program. FEMA encountered challenges 
obtaining data from states on the delivery of STEP assistance after 
Hurricane Sandy in part because it did not request necessary data 
fields and, at the time, it did not have the authority to compare 
certain types of data on individuals receiving support from its 
Individual Assistance and Public Assistance programs. By determining 
data requirements and developing a process for comparing these data 
across programs before future disasters, FEMA would be better 
positioned to both evaluate STEP and ensure in future disasters that 
individuals whose homes are made habitable do not continue to receive 
duplicative types of assistance, such as rental assistance. 

Finally, FEMA provided home-repair assistance to some applicants who 
may have inaccurately indicated that they did not have homeowners 
insurance, meaning that FEMA would have paid for damage already 
covered by a private source. This risk stems from FEMA's reliance on 
self-reported data for a single question--whether the applicant has 
private insurance--that is part of the application process. FEMA has 
begun exploring a mechanism for validating these data. Other 
approaches--each with varying levels of cost-effectiveness--could 
provide greater assurance that FEMA has accurate and reliable 
information on whether homeowners truly need its assistance or could 
turn instead to their private insurance to recover damages. 

Recommendations for Executive Action: 

To help FEMA prevent improper payments, we recommend that the 
Administrator of FEMA take the following three actions: 

* Collaborate with SSA to assess the cost and feasibility of checking 
recipient SSNs against EVS and the full death file to more accurately 
identify recipients who used SSNs that were ineligible or belonged to 
likely deceased individuals, document the results of this assessment, 
and if determined to be cost-beneficial take steps to implement a 
partnership to use SSA data. 

* Assess the cost and feasibility of addressing limitations in FEMA's 
control for identifying duplicate information in applications in high-
risk data fields--such as SSN, bank-account information, address, and 
phone number--that may currently allow individuals or households to 
improperly receive multiple payments, and if determined to be cost-
beneficial take steps to address the system design limitation. 

* As part of updates to legacy systems, redesign the compliance flag 
in the IHP system to clearly identify and document applicants' 
compliance with NFIP requirements at the time when assistance for 
flood-related damage was provided through IHP. 

To facilitate more-effective data sharing with state-level partners 
and enhance FEMA's ability to prevent duplicative benefits, we 
recommend that the Administrator of FEMA take the following action: 

* As part of its committee that is implementing enhanced data-sharing 
between Public Assistance and Individual Assistance programs, 
establish data-reporting requirements for states, including specific 
fields needed and a standard process for comparing information across 
programs, including IHP and STEP, to better position FEMA to evaluate 
such pilot programs and to help prevent potential duplicative payments. 

Finally, to prevent assistance that duplicates homeowner insurance 
benefits, we recommend the Administrator of FEMA take the following 
action: 

* Evaluate options, including costs and feasibility, to identify an 
approach for verifying the accuracy of self-reported information FEMA 
receives on whether applicants have private homeowners insurance. Such 
options could include posing additional questions to applicants, 
sharing data with federal agencies to identify federally backed 
mortgages, or developing a data-sharing approach with private 
insurance companies. 

Agency Comments and Our Evaluation: 

We provided a draft of this report to the Secretary of Homeland 
Security for comment. In its written comments, reproduced in appendix 
IV and summarized below, the Department of Homeland Security (DHS) 
concurred with all five recommendations. DHS also described ongoing or 
planned actions, and provided a timeline for addressing the 
recommendations. DHS further stated that FEMA had already implemented 
the fifth recommendation; however, we continue to believe that 
additional action is needed to fully address that recommendation. 

In response to our first recommendation, to collaborate with SSA to 
assess the cost and feasibility of checking recipient SSNs against EVS 
and the full death file, DHS said that FEMA would engage with SSA to 
assess the cost and feasibility of using EVS and the full death file, 
as well as work with its third-party vendor to assess the feasibility 
of improving SSN validation results. The agency expects to complete 
this work by December 31, 2015. 

In response to our second recommendation, to assess the cost and 
feasibility of addressing limitations in FEMA's control for 
identifying duplicate information in applications in high-risk data 
fields that may currently allow individuals or households to 
improperly receive multiple payments and take steps to address the 
system design limitation if cost-beneficial, DHS said that FEMA would 
work with developers to ascertain why certain duplicate applications 
were not flagged, anticipating a completion date by January 2015. DHS 
also stated that FEMA would consider appropriate system improvements 
based on the review and that a schedule of system changes would be 
developed according to the availability of funds. 

In response to our third recommendation, to redesign the compliance 
flag in the IHP system to clearly identify and document applicants' 
compliance with NFIP requirements at the time when assistance for 
flood-related damage was provided through IHP, DHS said that FEMA's 
Recovery Directorate would identify a means for recording changes to 
applicants' compliance with NFIP requirements. According to DHS, the 
changes are to be easily viewed and queried to show applicants' status 
throughout the phases of the application process. FEMA estimated that 
work would be completed by May 31, 2016. 

These actions, if implemented effectively, would address the intent of 
our recommendations. 

In response to our fourth recommendation, to establish data-reporting 
requirements for states, DHS stated that FEMA would enhance its 
information-technology infrastructure to better facilitate 
bidirectional data sharing with states. FEMA started this effort in 
2013 and plans to continue this work through September 30, 2016, in 
developing a datacenter to process this data exchange. While this 
action may help facilitate the sharing of data between FEMA and 
states, additional steps will be required to clarify at the outset of 
the response to a given disaster what data states are to collect and 
when the data will be shared with FEMA. 

In response to our fifth recommendation to evaluate options to 
identify an approach for verifying the accuracy of self-reported 
information FEMA receives on whether applicants have private 
homeowners insurance, DHS stated that FEMA recognized the value in 
obtaining insurance data for IHP applicants and described the efforts 
FEMA has taken to-date to obtain this information. According to DHS, 
efforts to obtain the data from private-sector companies were not 
successful because FEMA is precluded from complying with the private-
sector companies' expectations of receiving personally identifiable 
information about applicants in return from FEMA. Additionally, DHS 
stated that FEMA determined that access to insurance information from 
individual private insurance companies was not cost-effective, 
although DHS did not provide evidence to demonstrate that an analysis 
of the costs was completed. DHS stated that FEMA had considered 
acquiring data from other federal agencies to determine whether IHP 
recipients had federally backed mortgages, as we did in our analysis. 
According to DHS, FEMA contends that such analysis would only cover a 
small percentage of the insured population, yet we determined that 
nearly one-third of recipients of home repair or personal property 
assistance through the IHP after Hurricane Sandy had a federally 
backed mortgage. We believe that, given the inherent unreliability of 
self-reported data, adopting a mechanism to identify risk in a 
meaningful portion of applications warrants serious consideration. 
Further, though DHS states that an applicant's mortgage status does 
not influence eligibility for IHP assistance, we contend that mortgage 
status could serve as an appropriate flag for additional follow-up 
from a manual review of applications in which applicants claim not to 
have private home insurance. DHS also states that including one 
additional self-reported question on the IHP application regarding 
whether applicants have a mortgage would increase registration time 
and require approval from the Office of Management and Budget. One 
additional question should not significantly increase respondent 
burden. In addition, a question about mortgage status could provide an 
additional data point to assess the validity of responses to the 
current question. As a consequence, we reiterate our recommendation 
that FEMA evaluate these costs and potential benefits of adding a 
second question regarding whether an applicant has a mortgage as a 
flag for potentially inaccurate statements about insurance coverage. 
We appreciate the administrative burden associated with changes to the 
applicant form and suggest that FEMA could incorporate this change 
along with one of its future updates. While the percentage of 
applications in which this issue is a concern ultimately may not be 
large, the cumulative dollar amount of such potentially improper or 
potentially fraudulent payments from this disaster and future 
disasters could be significant. We consider this recommendation open 
until FEMA conducts additional analysis of the costs and benefits of 
these methods in screening applicants for misstatements about their 
private home insurance status. 

FEMA also provided technical comments, which we incorporated as 
appropriate. In its technical comments, FEMA clarified several terms 
and provided additional details related to its policies and programs. 
FEMA also requested that the report reflect the agency's ability to 
provide supporting evidence pertaining to the at-risk payments we 
identified, which is reflected in the report. Additionally, FEMA 
suggested that some of the figures we report related to FEMA's 
supporting evidence did not match its calculations. We reviewed these 
comments but determined that the report correctly summarizes the 
results of our analysis and the evidence that FEMA provided. 

We are sending copies of this report to interested congressional 
committees, the Secretary of Homeland Security, the Administrator of 
FEMA, the Administrator of SSA, and other interested parties. In 
addition, the report is available at no charge on the GAO website at 
[hyperlink, http://www.gao.gov]. 

If you or your staff have any questions about this report, please 
contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for 
our Offices of Congressional Relations and Public Affairs may be found 
on the last page of this report. GAO staff who made key contributions 
to this report are listed in appendix V. 

Signed by: 

Seto J. Bagdoyan: 
Director, Forensic Audits and Investigative Service: 

List of Requesters: 

The Honorable Thomas R. Carper: 
Chairman: 
The Honorable Tom Coburn, M.D.
Ranking Member: 
Committee on Homeland Security and Governmental Affairs: 
United States Senate: 

The Honorable Michael T. McCaul: 
Chairman: 
Committee on Homeland Security: 
House of Representatives: 

The Honorable Susan W. Brooks: 
Chairman: 
Subcommittee on Emergency Preparedness, Response, and Communication: 
Committee on Homeland Security: 
House of Representatives: 

[End of section] 

Appendix I: Objectives, Scope, and Methodology: 

This report examines (1) the extent to which the Federal Emergency 
Management Agency (FEMA) implemented controls to help prevent 
Individuals and Households Program (IHP) payments that are at risk of 
being improper or potentially fraudulent and (2) what challenges, if 
any, FEMA and states faced in obtaining and sharing information to 
help prevent IHP payments from duplicating or overlapping with other 
sources of assistance in its response to Hurricane Sandy. 

To assess the extent to which FEMA implemented controls to help 
prevent payments that are at risk of being improper or potentially 
fraudulent, we reviewed FEMA's controls designed to prevent 
individuals from fraudulently receiving disaster assistance, reviewed 
IHP data of applications and assistance provided in response to 
Hurricane Sandy, and interviewed FEMA officials. FEMA provided its IHP 
records as of November 2013, the most current and complete data 
available at the time of our request. The data contained records for 
all applicants requesting assistance for damages related to Hurricane 
Sandy, as well as the type and amount of IHP assistance payment 
received. To identify indications of payments to potentially 
ineligible recipients, we performed extensive testing of these data to 
determine whether there were (1) records with duplicate Social 
Security numbers (SSN), addresses, bank account numbers, and phone 
numbers and (2) payments to potentially ineligible recipients, such as 
those that were identified in other data systems as having invalid 
SSNs or as likely deceased or incarcerated at the time an assistance 
payment was received. 

To identify whether any of the award recipients had potentially 
inaccurate or invalid personal identification information (SSN, name, 
birth date), we submitted this information for verification to the 
Social Security Administration's (SSA) Enumeration Verification System 
(EVS). The EVS system provides information on invalid (never issued) 
SSNs and instances where there are mismatches between SSN, name, and 
birth date. Where there are mismatches between SSN and name or SSN and 
birth date, EVS may provide one or more suggested SSNs based on the 
applicants' name and birth date. Where EVS provided these 
alternatives, we compared the suggested SSN to the SSN in the IHP data 
to determine the likelihood that a mistake had been made in 
transcribing them. In some cases, we found an EVS suggested SSN to be 
very similar to the SSN on the corresponding application, such as a 
match on 8 of 9 digits, leading us to conclude that the SSN was a 
match. However, if the mismatch was greater than 2 digits, we 
considered the SSN unverifiable with SSA's records. We defined invalid 
SSNs as those that EVS determined had never been issued. 

To identify IHP recipients who may have used the identity of a likely 
deceased individual to receive IHP assistance, we matched FEMA IHP 
recipient data to the SSA's full death file by SSN to identify cases 
where the IHP application date was after the reported date of death. 
The full death file contains all of SSA's death records, including 
state-reported death information. We used a copy of SSA's full death 
file that was current as of May 2014, the most recent version 
available at the time we performed the analysis. We identified matches 
in two ways. In the first, we compared the SSNs that IHP recipients 
used in their application with the SSNs of those listed on the full 
death file. In the second, we examined the results of our analysis 
using the EVS system, which verified that IHP applicant information 
matched SSA's records. EVS identified some IHP recipients whose SSNs 
did not correspond to their name or date of birth. For some of these 
IHP recipients with mismatched identifying information, EVS provided a 
valid SSN for the name and date of birth of the applicant. For some of 
the flagged SSNs, EVS provided one or more valid SSNs that matched on 
the name and date of birth (or just on the name). We checked these EVS-
recommended SSNs against the full death file. We used the EVS-
recommended valid SSN to compare these IHP recipients with the SSNs of 
those listed on the full death file. For cases where EVS recommended 
more than one SSN for an IHP recipient, we only counted it as a full 
death file "match" if all the EVS-recommended SSNs matched with an 
individual on the death file. 

To identify award recipients with SSN's associated with incarcerated 
individuals at the time of FEMA assistance, we matched FEMA IHP data 
to state department of corrections prisoner databases from New York, 
New Jersey, and Connecticut.[Footnote 59] Prisoner data included 
individuals incarcerated on the day that Hurricane Sandy made 
landfall, October 29, 2012, and at any time in the following 6 months 
(through April 29, 2013). We identified records for which the FEMA 
assistance recipients' SSN, name, and birth date, or name and address 
matched that of a person who was incarcerated from October 29, 2012 
through April 29, 2013. We conducted an analysis of the matches to 
eliminate those individuals who could have qualified for rental 
assistance prior to or following their incarceration. We also 
eliminated cases that appeared to be a result of two individuals 
sharing a name or address but having different dates of birth and SSNs. 

It is not possible to determine from data matching alone whether these 
matches definitively identify recipients who were deceased or 
incarcerated without reviewing the facts and circumstances of each 
case. For example, it is possible that individuals can be erroneously 
listed in the full death file. Similarly, a recipient may have an SSN, 
name, and date of birth similar to an individual in state prison 
records. Alternatively, our matches may also understate the number of 
deceased or incarcerated individuals receiving assistance because 
matching would not detect applicants whose identifying information in 
the FEMA data differed slightly from their identifying information in 
other databases. 

To assess FEMA's oversight of IHP assistance for flood-related damage, 
we analyzed FEMA's IHP data to determine the number of recipients and 
amount of assistance received for flood-related damage from Hurricane 
Sandy whose property carried a requirement to purchase and maintain 
flood-insurance on that damaged property for future disasters. We 
examined how FEMA determined and tracked the eligibility of IHP 
recipients to receive assistance for flood-related damage based on 
their compliance with an existing flood-insurance requirement from a 
previous disaster. We analyzed the IHP data to identify how much flood-
related assistance, if any, FEMA provided to IHP recipients it had 
flagged as noncompliant with an existing flood-insurance requirement. 
An applicant who was noncompliant with a flood-insurance requirement 
could still be eligible for IHP flood-related assistance to repair 
items that are not covered by flood insurance, such as wells, sewers, 
or septic systems, as well as for types of assistance that are not 
dependent on whether an applicant has flood insurance, such as rental 
assistance or assistance with medical, dental, childcare, or disaster-
related funeral costs. 

We assessed the accuracy and reliability of FEMA's IHP data by 
interviewing agency officials knowledgeable about the data system and 
by obtaining from the agency written responses regarding (1) the 
agency's methods of data collection and quality-control reviews, (2) 
practices and controls over data-entry accuracy, and (3) any 
limitations of the data. In addition, we conducted electronic testing 
of the data, including checks for missing, out of range, or logically 
inaccurate data. We determined that the data were sufficiently 
reliable for the purposes of our report. 

We also assessed the reliability of SSA's full death file and prisoner 
databases provided by departments of corrections in Connecticut, New 
Jersey, and New York by reviewing relevant documentation, interviewing 
knowledgeable agency officials, and examining the data for obvious 
errors and inconsistencies. We concluded that each database was 
sufficiently reliable for the purposes of this report. 

In addition to data analysis, we identified criteria for FEMA's 
actions by examining policies, laws, and guidance, including the 
policy memos and applicant guidance published by FEMA for the National 
Flood Insurance Program (NFIP) and IHP. We reviewed changes to FEMA's 
controls since Hurricane Katrina and interviewed officials from FEMA, 
state governments of New York and New Jersey, and the city of New York 
involved in the recovery effort about the effectiveness of the 
controls and any likely opportunities for fraud. We also reviewed 
relevant legal materials, including the Post-Katrina Emergency 
Management Reform Act of 2006 (PKEMRA).[Footnote 60] In addition, we 
referred to best practices cited by auditing and antifraud 
organizations, GAO's fraud control framework, and previous GAO work on 
information-systems controls.[Footnote 61] 

To examine the challenges, if any, FEMA and the states faced in 
obtaining and sharing information necessary to prevent duplicative 
payments from overlapping sources, we reviewed guidance about FEMA's 
Sheltering and Temporary Essential Power (STEP) pilot program to 
assess FEMA's ability to determine whether an applicant's home had 
been repaired through the STEP program prior to the cessation of 
sheltering assistance through the IHP. Finally, we interviewed 
federal, state, and local officials involved in the response to 
Hurricane Sandy about challenges faced in data-sharing efforts. 

To identify individuals who may have received IHP assistance for 
damage from Hurricane Sandy that could be covered by private insurance 
companies, we requested that the Federal National Mortgage Association 
(Fannie Mae), and the Federal Home Loan Mortgage Corporation (Freddie 
Mac) compare the addresses of individuals listed who received home-
repair or personal property assistance from IHP with their loan 
records for October 2012, the month that Hurricane Sandy made 
landfall, to identify addresses that had a mortgage backed by one of 
these two entities. We also obtained data on mortgages backed by the 
Federal Housing Administration (FHA) as of September 30, 2012 and 
compared these data with IHP data on individuals who received home-
repair or personal-property assistance to identify addresses that had 
an FHA-backed mortgage. According to officials from these housing and 
mortgage organizations, mortgages backed by Fannie Mae, Freddie Mac, 
and FHA require that loan servicers (banks) ensure that mortgage 
holders maintain hazard insurance on the mortgaged property, so it is 
more likely that individuals who had a mortgage would also carry a 
hazard insurance policy. We determined whether any of the IHP 
recipients listed as homeowners who reported not having any private 
insurance received assistance for a damaged address that had a 
federally backed loan, and we analyzed the types and amounts of 
assistance received. We assessed the reliability of data from FHA, 
Fannie Mae, and Freddie Mac by interviewing agency officials 
knowledgeable about the data system and mortgage loans. In addition, 
we conducted electronic testing of the data, including checks for 
missing, out of range, or logically inaccurate data. We determined 
that the data were sufficiently reliable for the purposes of our 
engagement. However, it is not possible to determine whether these 
matches definitively identify improper payments without reviewing the 
facts and circumstances of each case. 

We identified criteria for data sharing within FEMA and with external 
organizations by examining policies, laws, and guidance, including the 
policy memos and applicant guidance published by FEMA for the STEP 
program and IHP. We interviewed officials from FEMA, state governments 
of New York and New Jersey, and the city of New York involved in the 
recovery effort about the effectiveness of data-sharing efforts and 
controls to prevent duplication of benefits. We also reviewed relevant 
legal materials, including the Robert T. Stafford Disaster Relief and 
Emergency Assistance Act, as amended.[Footnote 62] In addition, we 
referred to best practices cited by auditing and antifraud 
organizations and previous GAO work on program evaluation and GAO's 
fraud-control framework.[Footnote 63] Finally, we assessed the 
reliability of data from Fannie Mae and Freddie Mac by interviewing 
agency officials knowledgeable about the data system and mortgage 
loans. In addition, we conducted electronic testing of the data, 
including checks for missing, out of range, or logically inaccurate 
data. We determined that the data were sufficiently reliable for the 
purposes of our engagement. 

We performed this audit from July 2013 through December 2014 in 
accordance with generally accepted government auditing standards. 
Those standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objectives. We believe 
that the evidence obtained provides a reasonable basis for our 
findings and conclusions based on our audit objectives. 

[End of section] 

Appendix II: Recipients and Dollars to Counties: 

The following maps represent a static version of the interactive 
graphic in figure 2, detailing Individuals and Households Program 
(IHP) assistance received by each county that was declared by the 
President to be a disaster area eligible for Individual Assistance 
programs. The President declares disaster areas at the request of the 
governor of each state. Although the Federal Emergency Management 
Agency submits a recommendation to the President, disaster 
declarations are ultimately at the President's discretion. Amounts may 
not total due to rounding. 

Distribution of Individuals and Households Program Funds in Response 
to Hurricane Sandy for New Jersey: 

[Figure: illustrated map of New Jersey] 

County: Atlantic; 
Number of recipients: 8,712;
Dollars to county: $44,657,370. 

County: Bergen;
Number of recipients: 2,779;
Dollars to county: $19,850,637. 

County: Burlington; 
Number of recipients: 245; 
Dollars to county: $1,110,082. 

County: Camden; 
Number of recipients: 421; 
Dollars to county: $1,193,538. 

County: Cape May; 
Number of recipients: 1,907; 
Dollars to county: $8,718,039. 

County: Cumberland; 
Number of recipients: 223; 
Dollars to county: $1,430,995. 

County: Essex; 
Number of recipients: 1,651; 
Dollars to county: $4,935,141. 

County: Gloucester; 
Number of recipients: 100; 
Dollars to county: $588,206. 

County: Hudson; 
Number of recipients: 5,172; 
Dollars to county: $27,667,126. 

County: Hunterdon; 
Number of recipients: 78; 
Dollars to county: $231,011. 

County: Mercer; 
Number of recipients: 198; 
Dollars to county: $499,172. 

County: Middlesex; 
Number of recipients: 2,980; 
Dollars to county: $19,422,435. 

County: Monmouth; 
Number of recipients: 11,537; 
Dollars to county: $85,579,069. 

County: Morris; 
Number of recipients: 264; 
Dollars to county: $594,614. 

County: Ocean; 
Number of recipients: 22,444; 
Dollars to county: $189,528,659. 

County: Passaic; 
Number of recipients: 270; 
Dollars to county: $688,018. 

County: Salem; 
Number of recipients: 207; 
Dollars to county: $1,218,273. 

County: Somerset; 
Number of recipients: 327; 
Dollars to county: $780,201. 

County: Sussex; 
Number of recipients: 151; 
Dollars to county: $374,941. 

County: Union; 
Number of recipients: 1,655; 
Dollars to county: $6,484,914. 

County: Warren; 
Number of recipients: 77; 
Dollars to county: $270,431. 

County: Total; 
Number of recipients: 61,398; 
Dollars to county: $415,822,873. 

Source: GAO analysis of Federal Emergency Management Agency data 
(data); Map Resources (map). GAO-15-15. 

[End of figure] 

Distribution of Individuals and Households Program Funds in Response 
to Hurricane Sandy for Connecticut: 

[Figure: illustrated map of Connecticut] 

County: Fairfield; 
Number of recipients: 1,856; 
Dollars to county: $9,726,137. 

County: Mashantucket Pequot Indian Reservation; 
Number of recipients: 1; 
Dollars to county: $248. 

County: Middlesex; 
Number of recipients: 124; 
Dollars to county: $553,567. 

County: New Haven; 
Number of recipients: 828; 
Dollars to county: $4,191,425. 

County: New London; 
Number of recipients: 160; 
Dollars to county: $613,317. 

County: Total; 
Number of recipients: 2,969; 
Dollars to county: $15,084,694. 

Source: GAO analysis of Federal Emergency Management Agency data 
(data); Map Resources (map). GAO-15-15. 

[End of figure] 

Distribution of Individuals and Households Program Funds in Response 
to Hurricane Sandy for Maryland: 

[Figure: illustrated map of Maryland] 

County: Somerset; 
Number of recipients: 732; 
Dollars to county: $2,571,561 

County: Total; 
Number of recipients: 732; 
Dollars to county: $2,571,561 

Source: GAO analysis of Federal Emergency Management Agency data 
(data); Map Resources (map). GAO-15-15. 

Note: Somerset County in Maryland was approved for Individual 
Assistance after an appeal, as it was the area with the greatest unmet 
need. The City of Chrisfield in Somerset County sustained the heaviest 
concentration of damage to its residences. 

[End of figure] 

Distribution of Individuals and Households Program Funds in Response 
to Hurricane Sandy for New York: 

[Figure: illustrated map of New York] 

County: Bronx; 
Number of recipients: 653; 
Dollars to county: $3,094,134. 

County: Kings; 
Number of recipients: 24,790; 
Dollars to county: $220,154,772. 

County: Nassau; 
Number of recipients: 39,696; 
Dollars to county: $325,512,835. 

County: New York; 
Number of recipients: 3,964; 
Dollars to county: $15,371,605. 

County: Orange; 
Number of recipients: 142; 
Dollars to county: $469,633. 

County: Putnam; 
Number of recipients: 48; 
Dollars to county: $183,337. 

County: Queens; 
Number of recipients: 27,086; 
Dollars to county: $250,781,103. 

County: Richmond; 
Number of recipients: 10,065; 
Dollars to county: $104,174,988. 

County: Rockland; 
Number of recipients: 473; 
Dollars to county: $3,242,520. 

County: Suffolk; 
Number of recipients: 10,066; 
Dollars to county: $80,031,647. 

County: Sullivan; 
Number of recipients: 76; 
Dollars to county: $283,604. 

County: Ulster; 
Number of recipients: 86; 
Dollars to county: $516,608. 

County: Westchester; 
Number of recipients: 433; 
Dollars to county: $1,695,853. 

County: Total; 
Number of recipients: 117,578; 
Dollars to county: $1,005,512,637. 

Source: GAO analysis of Federal Emergency Management Agency data 
(data); Map Resources (map). GAO-15-15. 

[End of figure] 

Distribution of Individuals and Households Program Funds in Response 
to Hurricane Sandy for Rhode Island: 

[Figure: illustrated map of Rhode Island] 

County: Newport; 
Number of recipients: 12; 
Dollars to county: $69,650. 

County: Washington; 
Number of recipients: 93; 
Dollars to county: $351,691. 

County: Total; 
Number of recipients: 105; 
Dollars to county: $421,341. 

Source: GAO analysis of Federal Emergency Management Agency data 
(data); Map Resources (map). GAO-15-15. 

[End of figure] 

[End of section] 

Appendix III: Individual and Households Program (IHP) Registrations 
Reviewed by the Federal Emergency Management Agency (FEMA): 

FEMA officials stated that at least $6.1 million of the payments we 
identified as being at-risk were deemed appropriate upon the agency's 
review of our matching results and related applicant files. Table 6 
describes the results of FEMA's review for each type of risk for which 
payments were made, including the number of payments and dollar 
amounts of payments deemed appropriate as well as those recouped or 
under review. 

Table 6: Summary of the Federal Emergency Management Agency's (FEMA) 
Review of the Individuals and Households Program (IHP) Assistance 
Identified as Being at Risk for Potential Fraud or Improper Payments: 

Type of risk for payments made: Receipt of rental assistance while 
incarcerated; 
Number of IHP registrations identified as being at risk: 2; 
Number of at-risk IHP registrations reviewed by FEMA: 2; 
Number of IHP registrations FEMA deemed proper: 2; 
Amount of at-risk payments FEMA deemed proper (dollars): $7,328; 
Number of at-risk IHP registrations with payments recouped or in 
review: 0; 
Amount of at-risk payments recouped or in review (dollars): $0. 

Type of risk for payments made: Social Security number (SSN) was 
invalid, did not match Social Security Administration's (SSA) records 
for other identifying information, or SSN belonged to likely deceased 
individual; 
Number of IHP registrations identified as being at risk: 2,610; 
Number of at-risk IHP registrations reviewed by FEMA: 77; 
Number of IHP registrations FEMA deemed proper: 67; 
Amount of at-risk payments FEMA deemed proper (dollars): $781,028; 
Number of at-risk IHP registrations with payments recouped or in 
review: 10; 
Amount of at-risk payments recouped or in review (dollars): $120,472. 

Type of risk for payments made: Duplicates not flagged by FEMA; 
Number of IHP registrations identified as being at risk: 203; 
Number of at-risk IHP registrations reviewed by FEMA: 203; 
Number of IHP registrations FEMA deemed proper: n/a; 
Amount of at-risk payments FEMA deemed proper (dollars): n/a; 
Number of at-risk IHP registrations with payments recouped or in 
review: n/a; 
Amount of at-risk payments recouped or in review (dollars): n/a. 

Type of risk for payments made: SSNs used by multiple recipients; 
Number of IHP registrations identified as being at risk: 20; 
Number of at-risk IHP registrations reviewed by FEMA: 20; 
Number of IHP registrations FEMA deemed proper: 11; 
Amount of at-risk payments FEMA deemed proper (dollars): $146,887; 
Number of at-risk IHP registrations with payments recouped or in 
review: 5; 
Amount of at-risk payments recouped or in review (dollars): $18,177. 

Type of risk for payments made: Bank accounts used by multiple 
recipients; 
Number of IHP registrations identified as being at risk: 147; 
Number of at-risk IHP registrations reviewed by FEMA: 147; 
Number of IHP registrations FEMA deemed proper: 133; 
Amount of at-risk payments FEMA deemed proper (dollars): $1,160,797; 
Number of at-risk IHP registrations with payments recouped or in 
review: 14; 
Amount of at-risk payments recouped or in review (dollars): $86,863. 

Type of risk for payments made: Addresses where more than 1 applicant 
received home-repair assistance; 
Number of IHP registrations identified as being at risk: 128; 
Number of at-risk IHP registrations reviewed by FEMA: 128; 
Number of IHP registrations FEMA deemed proper: 99; 
Amount of at-risk payments FEMA deemed proper (dollars): $995,276; 
Number of at-risk IHP registrations with payments recouped or in 
review: 29; 
Amount of at-risk payments recouped or in review (dollars): $328,914. 

Type of risk for payments made: Address and last name used by multiple 
recipients and cumulatively receiving more than $31,900; 
Number of IHP registrations identified as being at risk: 418; 
Number of at-risk IHP registrations reviewed by FEMA: 200; 
Number of IHP registrations FEMA deemed proper: 146; 
Amount of at-risk payments FEMA deemed proper (dollars): $2,699,422; 
Number of at-risk IHP registrations with payments recouped or in 
review: 54; 
Amount of at-risk payments recouped or in review (dollars): $888,856. 

Type of risk for payments made: Receipt of funeral assistance through 
a second registration in the same household; 
Number of IHP registrations identified as being at risk: 18; 
Number of at-risk IHP registrations reviewed by FEMA: 18; 
Number of IHP registrations FEMA deemed proper: n/a; 
Amount of at-risk payments FEMA deemed proper (dollars): n/a; 
Number of at-risk IHP registrations with payments recouped or in 
review: n/a; 
Amount of at-risk payments recouped or in review (dollars): n/a. 

Type of risk for payments made: Receipt of home-repair assistance and 
claiming to lack private homeowners insurance while maintaining 
federally backed mortgage; 
Number of IHP registrations identified as being at risk: 534; 
Number of at-risk IHP registrations reviewed by FEMA: 55; 
Number of IHP registrations FEMA deemed proper: 32; 
Amount of at-risk payments FEMA deemed proper (dollars): $259,418; 
Number of at-risk IHP registrations with payments recouped or in 
review: 23; 
Amount of at-risk payments recouped or in review (dollars): $87,381. 

Type of risk for payments made: Inaccurate flags for National Flood 
Insurance Program (NFIP) compliance; 
Number of IHP registrations identified as being at risk: 1,322; 
Number of at-risk IHP registrations reviewed by FEMA: 64; 
Number of IHP registrations FEMA deemed proper: 56; 
Amount of at-risk payments FEMA deemed proper (dollars): $269,041; 
Number of at-risk IHP registrations with payments recouped or in 
review: 8; 
Amount of at-risk payments recouped or in review (dollars): $137,788. 

Source: GAO analysis of FEMA data. GAO-15-15. 

n/a = not available: 

Note: Because some of the payments we identified as at risk appear in 
more than one category, the sum of the dollar amounts for each 
category in the table is greater than the sum of the entire population 
of at-risk payments, which counts the payments included in multiple 
categories only once. 

We could not independently confirm FEMA's conclusions without 
additional investigation for each payment. 

FEMA reviewed the 203 duplicates that were not flagged, but did not 
provide us with its assessment of the results for each applicant. 
Rather, FEMA presented its results in aggregate. As such, we do not 
have data about the dollar totals involved with cases FEMA deemed 
proper or attempted to recoup. Further, its explanations as to why the 
applicants were not flagged were not sufficient to conclude that the 
payments were proper. For example, FEMA claimed that 125 of the 203 
duplicates resided in different states and, as such, FEMA did not 
consider the payments to be duplicative. We continue to believe that 
cross-state checks are necessary to detect potentially improper or 
fraudulent payments, as an individual with homes in two states should 
only be eligible for assistance related to the primary residence. 
Further, FEMA explained that 44 of the 203 duplicates had been flagged 
for manual review for cross-disaster checks (other disasters prior to 
Hurricane Sandy), but that would not preclude the records from being 
flagged as duplicates within this disaster, as we found. Similarly, 
FEMA found that 16 of the 203 cases matched applications from 
disasters for which assistance was no longer available and were not 
flagged as cross-disaster duplicates because the matching disasters 
were closed. Again, our analysis found the duplicates within the data 
for only this disaster. FEMA confirmed that 30 applicants should have 
been flagged as duplicates and is investigating why the records were 
not flagged. 

FEMA's review of funeral assistance using a second registration in the 
same household looked only for duplication of benefits instead of the 
extent to which second registrations were provided inappropriately 
within a household. While FEMA found no duplication of benefits for 
these payments, FEMA officials did not address our primary concern 
with these payments in its review and we did not include the results 
in this table. 

[End of table] 

[End of section] 

Appendix IV: Comment from the Department of Homeland Security: 

U.S. Department of Homeland Security: 
Washington, DC 20528: 

November 26, 2014: 

Seto Bagdoyan: 
Director, Forensic Audits and Investigative Services: 
U.S. Government Accountability Office: 
441 G Street, NW: 
Washington, DC 20548: 

Re: Draft Report GAO-15-15, "Hurricane Sandy: FEMA Has Improved
Disaster Aid Verification but Could Act to Further Limit Improper 
Assistance" 

Dear Mr. Bagdoyan: 

Thank you for the opportunity to comment on this draft report. The 
U.S. Department of Homeland Security (DHS) appreciates the U.S. 
Government Accountability Office's (GAO's) work in planning and 
conducting its review and issuing this report. 

The Department appreciates GAO's recognition that the controls the 
Federal Emergency Management Agency (FEMA) has implemented since 
Hurricane Katrina have significantly helped reduce and prevent 
improper and potentially fraudulent payments. FEMA is committed to 
demonstrating responsible stewardship over taxpayer dollars and
fulfilling its legal responsibility to recover improperly disbursed 
funds, while remaining mindful of the impact this process can have on 
the delivery of disaster assistance and the affected individuals and 
families. 

The draft report contained five recommendations with which the 
Department concurs. Specifically, GAO recommended that the FEMA 
Administrator: 

Recommendation 1: Collaborate with SSA [Social Security 
Administration] to assess the cost and feasibility of checking 
recipient SSNs [Social Security Numbers] against EVS [Enumeration 
Verification System] and the full death file to more accurately
identifY recipients who used SSNs that were ineligible or belonged to 
likely deceased individuals, document the results of this assessment, 
and if determined to be cost-beneficial take steps to implement a 
partnership to use SSA data. 

Response: Concur. FEMA's Recovery Directorate will engage with the SSA 
through the Individuals and Households Program (IHP) to assess the 
feasibility and costs of validating SSNs against the EVS and the full 
death file. Additionally, FEMA's Recovery Directorate will work with a 
third-party vendor to assess the feasibility of improving results on 
the SSN validations under an existing contract vehicle. Pursuing both
approaches will enable FEMA to find the most cost beneficial approach 
to reducing improper payments associated with ineligible SSNs or 
deceased individuals. Estimated Completion Date (ECD): December 31, 
2015. 

Recommendation 2: Assess the cost and feasibility of addressing 
limitations in FEMA's control for identifying duplicate information in 
applications in high-risk data fields--such as SSN, bank-account 
information, address, and phone number--that may currently allow 
individuals or households to improperly receive multiple payments, and 
if determined to be cost-beneficial take steps to address the system 
design limitation. 

Response: Concur. FEMA's Recovery Directorate will engage with 
developers using specific examples provided by the GAO to ascertain 
why duplicate applications were not caught. Based on the review, 
FEMA's Recovery Directorate will consider appropriate system 
improvements to address the issue. The review will be complete by 
January 2015 and the schedule for any system changes will follow 
subject to the availability of funds. ECD: To Be Determined. 

Recommendation 3: Redesign the compliance flag in the IHP system to 
clearly identify and document applicants' compliance with the NFIP 
[National Flood Insurance Program] requirements at the time when 
assistance for flood-damage was provided through IHP. 

Response: Concur. FEMA's Recovery Directorate will work with the 
developers to ensure that as additional checks are run during the 
lifecycle, the system will record changes so they are easily viewed 
and queried to show the appropriate status for each phase of the 
application process. ECD: May 31 , 2016. 

Interim Milestones: 
1. Begin requirements gathering process: 01/31/2015. 

2. Baseline requirements & Obtain Cost Estimate from development 
contractor: 05/31/2015. 

3. Fund development via eCaps (management decision on appropriateness 
of cost compared to value of the change & other development and policy 
priorities): 07/31/2015. 

4. Complete development & testing: 12/31/2015. 

5. IT IV&V Testing & Deployment Approvals: 03/31/2016. 

6. Production Deployment (this change would coincide with our large 
Sustainment release, scheduled between March and May each year): 
05/31/2016. 

Recommendation 4: Establish data reporting requirements for states, 
including specific fields needed and a standard process for comparing 
information across programs, including IHP and STEP [Sheltering 
Temporary Essential Power], to better position FEMA to evaluate such 
pilot programs and to help prevent potential duplicative payments. 

Response: Concur. The FEMA Office of Chief Information Officer is 
enhancing its IT infrastructure to facilitate bi-directional data 
sharing with State partners. This work started in FY2013 and continues 
through FY20 16 in the form of new capabilities built into FEMA's 
target datacenter infrastructure architecture. Current DHS 
requirements for a Minimum Background Investigation for any partners 
connecting to the DHS network has added urgency to finding immediate 
policy and technical bridge solutions and these solutions will be 
folded into a future target state enterprise architecture. The FEMA
Office of Chief Information Officer will have the bi-directional data 
sharing capability in production in September 2016. ECD: September 30, 
2016. 

Interim Milestones: 

1. IT Governance approval of target infrastructure and data domain 
design of the FEMA enterprise architecture: 02/28/2015. 

2. DHS policy and technical solution resolution and approval for 
implementation of target design: 06/30/2015. 

3. Completion of logical design of infrastructure and data domains for 
implementation: 10/31/2015. 

4. FEMA Cyber Security assessment and approval target infrastructure 
and data domain design: 02/29/2016. 

5. Completion of Data Center infrastructure and data domain 
enhancements in Development Environment: 05/31/2016. 

6. Completion of all testing of Data Center infrastructure and data 
domain enhancements in Test Environment: 05/31/2016-09/30/2016. 

7. Deployment of target enterprise infrastructure data sharing 
capability in Production Environment: 09/30/2016. 

Recommendation 5: Evaluate options, including costs and feasibility, 
to identity an approach for verifying the accuracy of self-reported 
information FEMA receives on whether applicants have private 
homeowners insurance. Such options could include posing additional 
questions to applicants, sharing data with federal agencies to identity
federally-backed mortgages, or developing a data-sharing approach with 
private insurance companies. 

Response: Concur. FEMA recognizes the value in obtaining insurance 
data and has performed extensive research on ways to access insurance 
data from private sector companies to determine whether an applicant 
has homeowners and auto insurance at the time of registration. 
Unfortunately, thus far, this option has presented several hurdles. 

FEMA engaged a third party company with extensive public-records-
related information but a chief overriding problem with this option 
was that access to the insurance database was participatory. As such, 
not only would FEMA have to pay for access to the data, in exchange 
for providing this service, FEMA would be required to provide 
information on existing NFIP policyholders and claims, including 
personally identifiable information. FEMA's Office of Chief Counsel 
determined in August 2014, and later in coordination with the Program 
Office in October 2014, that the data-sharing agreements required by
the third-party company mentioned above precluded FEMA from 
participation, as those agreements violated both the applicable NFIP 
System of Records Notice and the Privacy Act. 

FEMA has also looked to developing a data-sharing approach with 
individual private insurance companies. However, this approach was not 
found to be cost effective. 

Another option considered was to acquire data from other Federal 
agencies to identifY if a disaster survivor has a federally backed 
mortgage. However, this would only cover a small percentage of the 
insured population. In addition, having a mortgage does not influence 
an applicant's eligibility for IHP assistance, whereas having 
insurance may. 

FEMA also contemplated creating new self-reported questions, such as 
questions about a survivor's mortgage. This option, however, does not 
give the Agency third-party verification of insurance status and would 
provide a new self-certified data element which would increase 
registration time and require approval from the Office of Management 
and Budget. Without independent verification, this does not achieve the
desired objective and would only extend the registration process. 

FEMA's Recovery Directorate is receptive to exploring other ways to 
obtain and verifY insurance data; however, it has exhausted all 
currently known options in this regard. Therefore, we request that GAO 
consider this recommendation resolved and closed. 

Again, thank you for the opportunity to review and comment on this 
draft report. Technical comments were previously provided under a 
separate cover. Please feel free to contact me if you have any 
questions. We look forward to working with you in the future. 

Sincerely, 

Signed by: 

Jim H. Crumpacker, CIA, CFE: 
Director: 
Departmental GAO-OIG Liaison Office: 

[End of section] 

Appendix V: GAO Contacts and Staff Acknowledgments: 

GAO Contact: 

Seto J. Bagdoyan, (202) 512-6722 or bagdoyans@gao.gov: 

Staff Acknowledgments: 

In addition to the contact named above, Joah Iannotta (Assistant 
Director), Dean Campbell, Robert Heilman, Miriam Hill, Grant Mallie, 
Maria McMullen, James Murphy, Anna Maria Ortiz, and Rebecca Shea made 
key contributions to this report. 

[End of section] 

Footnotes: 

[1] For example, see GAO, Hurricane Sandy Relief: Improved Guidance on 
Designing Internal Control Plans Could Enhance Oversight of Disaster 
Funding, [hyperlink, http://www.gao.gov/products/GAO-14-58] 
(Washington, D.C.: Nov. 26, 2013); and Catastrophic Disasters: 
Enhanced Leadership, Capabilities, and Accountability Controls Will 
Improve the Effectiveness of the Nation's Preparedness, Response, and 
Recovery System, [hyperlink, http://www.gao.gov/products/GAO-06-618] 
(Washington, D.C.: Sept. 6, 2006). 

[2] GAO, Hurricanes Katrina and Rita Disaster Relief: Improper and 
Potentially Fraudulent Individual Assistance Payments Estimated to Be 
Between $600 Million and $1.4 Billion, [hyperlink, 
http://www.gao.gov/products/GAO-06-844T] (Washington, D.C.: June 14, 
2006); Expedited Assistance for Victims of Hurricanes Katrina and 
Rita: FEMA's Control Weaknesses Exposed the Government to Significant 
Fraud and Abuse, [hyperlink, http://www.gao.gov/products/GAO-06-655] 
(Washington, D.C.: June 16, 2006); Hurricanes Katrina and Rita: 
Unprecedented Challenges Exposed the Individuals and Households 
Program to Fraud and Abuse; Actions Needed to Reduce Such Problems in 
Future, [hyperlink, http://www.gao.gov/products/GAO-06-1013] 
(Washington, D.C.: September 27, 2006); and Hurricanes Katrina and 
Rita Disaster Relief: Continued Findings of Fraud, Waste, and Abuse, 
[hyperlink, http://www.gao.gov/products/GAO-07-252T] (Washington, 
D.C.: Dec. 6, 2006). 

[3] In 2011, Congress passed the Disaster Assistance Recoupment 
Fairness Act of 2011, which allowed FEMA to waive recoupment of part 
of this total. The act permitted FEMA to waive debts under certain 
circumstances, but not if the debt involved fraud, the presentation of 
a false claim, or misrepresentation. FEMA stated that approximately 
$90 million was waived pursuant to the act. 

[4] [hyperlink, http://www.gao.gov/products/GAO-06-655], [hyperlink, 
http://www.gao.gov/products/GAO-06-1013]. 

[5] GAO, Hurricanes Gustav and Ike Disaster Assistance: FEMA 
Strengthened its Fraud Prevention Controls, but Customer Service Needs 
Improvement, [hyperlink, http://www.gao.gov/products/GAO-09-671] 
(Washington, D.C.: June 19, 2009). Our assessment was limited to 
undercover attempts to receive benefits and interviews with recipients 
of assistance; it did not include an examination of all assistance 
payments disbursed to survivors. 

[6] Pub. L. No. 113-2, div. A, 127 Stat. 4 (2013). Amounts from the 
Disaster Relief Appropriations Act of 2013 represent the 
appropriations as originally enacted and not adjusted to account for 
sequestration. 

[7] Since the data for IHP assistance was provided by FEMA in November 
2013, IHP assistance has increased to 182,911 recipients as of August 
2014. 

[8] An improper payment is defined by statute as any payment that 
should not have been made or that was made in an incorrect amount 
(including overpayments and underpayments) under statutory, 
contractual, administrative, or other legally applicable requirements. 
It includes any payment to an ineligible recipient, any payment for an 
ineligible good or service, any duplicate payment, any payment for a 
good or service not received (except for such payments where 
authorized by law), and any payment that does not account for credit 
for applicable discounts. Improper Payments Information Act of 2002, 
as amended (codified at 31 U.S.C. § 3321 note). Office of Management 
and Budget guidance also instructs agencies to report as improper 
payments any payments for which insufficient or no documentation was 
found. Fraud involves an intentional act or representation to deceive 
with the knowledge that the action or representation could result in 
gain. An improper payment may be the result of fraud. 

[9] The President declared that sections of 11 states (New Jersey, New 
York, Connecticut, Rhode Island, Maryland, Massachusetts, New 
Hampshire, West Virginia, Delaware, Pennsylvania, and Virginia) and 
the District of Columbia were adversely affected by Hurricane Sandy. 

[10] SSA's full death file contains all of SSA's death records, 
including state-reported death information. 

[11] We selected prisons in New York, New Jersey, and Connecticut 
because these three states were most affected by Hurricane Sandy. 

[12] STEP was a pilot program intended to reduce the demand for other 
FEMA-provided housing, such as congregate shelters or TSA, and allow 
individuals to return to or remain in their homes.The program provided 
basic repairs to disaster-affected residences to make them habitable. 

[13] PKEMRA was enacted as Title VI of the Department of Homeland 
Security Appropriations Act, 2007, Pub. L. No. 109-295, § 601, 120 
Stat. 1355, 1394 (2006). 

[14] Pub. L. No. 93-288, 88 Stat. 143 (1974) (codified as amended at 
42 U.S.C. §§ 5121-5207). 

[15] GAO, Individual Disaster Assistance Programs: Framework for Fraud 
Prevention, Detection, and Prosecution, [hyperlink, 
http://www.gao.gov/products/GAO-06-954T] (Washington, D.C.: July 12, 
2006); Federal Information System Controls Audit Manual (FISCAM), 
[hyperlink, http://www.gao.gov/products/GAO-09-232G] (Washington, 
D.C.: February 2009); Standards for Internal Control in the Federal 
Government, [hyperlink, 
http://www.gao.gov/products/GAO/AIMD-00-21.3.1] (Washington, D.C.: 
November 1999); and Standards for Internal Control in the Federal 
Government, [hyperlink, http://www.gao.gov/products/GAO-14-704G] 
(Washington, D.C.: September 2014). 

[16] FEMA regulations define Household to mean all persons who lived 
in the predisaster residence who request assistance, as well as any 
persons, such as infants, spouses, or part-time residents who were not 
present at the time of the disaster but who are expected to return 
during the assistance period. 

[17] FEMA is required to adjust the maximum amount for assistance 
provided under the IHP annually based on the Consumer Price Index for 
All Urban Consumers. 

[18] The end of the period of assistance for Hurricane Sandy was April 
30, 2014, for New York, New Jersey, and Connecticut; May 3, 2014, for 
Rhode Island; and May 20, 2014, for Maryland. 

[19] FEMA defines a congregate shelter as any private or public 
facility that provides refuge to evacuees but that normally serves a 
nonrefuge function, such as schools, churches, or stadiums. 

[20] STEP was still a pilot program as of September 2014. 

[21] For an overview of GAO's work on NFIP, see GAO, Economic 
Development: Overview of GAO's Past Work on the National Flood 
Insurance Program, [hyperlink, 
http://www.gao.gov/products/GAO-14-297R] (Washington, D.C.: Apr. 9, 
2014). 

[22] This estimate was based on a statistically significant sample and 
with a 95 percent confidence interval. [hyperlink, 
http://www.gao.gov/products/GAO-06-844T]. 

[23] [hyperlink, http://www.gao.gov/products/GAO-06-954T]. 

[24] [hyperlink, http://www.gao.gov/products/GAO-06-1013]. 

[25] GAO, Hurricanes Katrina and Rita Disaster Relief: Continued 
Findings of Fraud, Waste, and Abuse, [hyperlink, 
http://www.gao.gov/products/GAO-07-300] (Washington, D.C.: Mar. 15, 
2007). 

[26] [hyperlink, http://www.gao.gov/products/GAO-09-671]. 

[27] In accordance with best practices from auditing and antifraud 
organizations, having a strong training program is an element of an 
effective fraud-prevention strategy. See, for example: Institute of 
Internal Auditors, American Institute of Certified Public Accountants, 
and Association of Certified Fraud Examiners, Managing the Business 
Risk of Fraud: A Practical Guide and Institute of Internal Auditors, 
Internal Auditing and Fraud. We did not evaluate this fraud prevention 
course or the fraud and abuse avoidance training as a part of this 
report. 

[28] Department of Homeland Security, Office of the Inspector General, 
Improvements to Internal Controls for FEMA's Individuals and 
Households Program Registration Process, OIG-09-110 (Washington, D.C.: 
September 2009). 

[29] This percentage was calculated using the actual results, not the 
rounded numbers displayed in the text. 

[30] Office of Management and Budget guidance for fiscal year 2013 
defines gross annual improper payments in a program exceeding (1) 2.5 
percent of program outlays and $10 million of all payments or (2) $100 
million regardless of the percentage of total payments as "significant 
improper payments." 

[31] There are some instances in which an individual may be eligible 
to receive rental assistance despite being incarcerated when 
registering, such as when an individual is the head of a household 
applying on behalf of family members affected by the disaster. 

[32] [hyperlink, http://www.gao.gov/products/GAO-06-844T]. 

[33] We worked with state departments of corrections in New York, New 
Jersey, and Connecticut to access data on individuals who were 
incarcerated from October 29, 2012, through April 29, 2013. 

[34] SSA has historically collected death information about SSN-
holders so it does not pay Social Security benefits to deceased 
individuals and to establish benefits for survivors. SSA receives 
death reports from a variety of sources, including states, family 
members, funeral directors, post offices, financial institutions, and 
other federal agencies. We refer to SSA's complete file of death 
records as "the full death file." A subset of the full death file that 
may not include death data received by the states, which SSA calls 
"the Death Master File," is available to the public. For more 
information on SSA's death files, see GAO, Social Security Death Data: 
Additional Action Needed to Address Data Errors and Federal Agency 
Access, [hyperlink, http://www.gao.gov/products/GAO-14-46] 
(Washington, D.C.: Nov. 27, 2013). 

[35] [hyperlink, http://www.gao.gov/products/GAO-06-844T]. 

[36] We identified 29 of the 45 recipients by matching the SSN used in 
their application with those listed on the full death file. The other 
16 recipients were identified by using results of EVS, which 
identified some applicants as using an SSN that did not correspond to 
the applicant's name or date of birth. For some of the applicants with 
mismatched identifying information, EVS provided a valid SSN for the 
name and date of birth of the applicant. We used the EVS recommended 
valid SSN to compare these applicants with the full death file and 
found that the 16 recipients matched an individual who appeared on the 
full death file. 

[37] Joint field offices are locations where federal, state, and local 
officials convene to administer their respective disaster-assistance 
programs. 

[38] The Social Security Act requires SSA to share its full death 
file, to the extent feasible, with federal benefit-paying agencies for 
the purpose of preventing improper payments, if the agency reimburses 
SSA for its reasonable costs and the arrangement does not conflict 
with SSA's duties with respect to state data, as authorized by 42 
U.S.C. § 405(r)(3). According to SSA officials, for FEMA to access 
these data, the agency must first make a formal request to SSA, 
explaining how it would use these data, and have agreements in place 
with SSA that outline the circumstances of a data-sharing agreement. 
SSA would then determine whether FEMA's proposed use of the 
information is in accordance with the allowable use outlined in the 
act. See [hyperlink, http://www.gao.gov/products/GAO-14-46] for more 
information on this process. 

[39] According to SSA officials, FEMA could initiate the process of 
establishing a reimbursable data-exchange agreement for SSN 
verifications by submitting a data-exchange request form found on 
SSA's website. SSA's Office of Data Exchange would then work with FEMA 
staff to identify how best to meet FEMA's needs. For example, in April 
2007 the State Department established an exchange agreement with SSA 
that allowed the State Department's electronic passport-processing 
system to automatically query EVS to verify that a passport 
applicant's SSN, name and date of birth match the records at SSA. See 
GAO, State Department: Pervasive Passport Fraud Not Identified, but 
Cases of Potentially Fraudulent and High-Risk Issuances Are under 
Review, [hyperlink, http://www.gao.gov/products/GAO-14-222], 
(Washington, D.C.: May 1, 2014). 

[40] According to FEMA regulations, a household may only register one 
time to receive IHP assistance, with some possible exceptions related 
to temporary housing assistance. 

[41] In 2007, we recommended that FEMA conduct checks like this across 
disasters to ensure that damage covered for one disaster--for example, 
Hurricane Katrina--was not covered for a later disaster--for example, 
Hurricane Rita, which happened 1 month later. [hyperlink, 
http://www.gao.gov/products/GAO-07-300]. 

[42] GAO, Federal Information System Controls Audit Manual (FISCAM), 
[hyperlink, http://www.gao.gov/products/GAO-09-232G] (Washington, 
D.C.: February 2009). We did not perform a complete review of 
information-system controls in this analysis. 

[43] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. 

[44] There are legitimate situations in which a duplicate address or 
phone number would not suggest abuse. For example, two unrelated 
people, such as a homeowner and someone renting a room, may live at 
the same address and share a phone number and both may have been 
eligible for rental assistance in the event that the home was damaged 
in the storm. 

[45] In two instances, recipients shared last names and bank accounts. 
In two other instances, recipients shared a last name, address, and 
phone number. And in the other instance, the recipients shared a last 
name and phone number. 

[46] 42 U.S.C. §§ 4012a and 5154a; 44 C.F.R. §§ 206.110(k) and 
206.113(b)(7) and (8). The flood-insurance requirement applies to IHP 
recipients residing in participating communities of the National Flood 
Insurance Program (NFIP) whose damaged property is located in a 
special flood hazard area. IHP recipients must purchase flood 
insurance, for at least the assistance amount, for the structure (if 
the IHP recipient is the owner) or for its contents (if the IHP 
recipient is a renter).The requirement extends to the flood-damaged 
property for the life of the property. If the property is sold, the 
flood-insurance requirement is passed on to the new homeowner. If a 
renter does not return to the property, he or she is no longer 
required to purchase flood insurance. 

[47] An applicant who was noncompliant with a flood-insurance 
requirement could still be eligible for IHP assistance for flood-
related damage to repair items that are not covered by flood 
insurance, such as wells or septic systems, as well as for types of 
assistance that are not dependent on whether an applicant has flood 
insurance, such as rental assistance or assistance with medical, 
dental, childcare, or disaster-related funeral costs. 

[48] One NFIP-related database tracks information on flood-insurance 
requirements that result from receiving IHP flood damage assistance in 
a federal disaster; the other has information on all flood-insurance 
policies reported to the NFIP. The IHP database accesses information 
from these two NFIP-related databases based on the address of the 
damaged property. The NFIP-related databases are jointly managed by 
FEMA's Federal Insurance and Mitigation Administration and the Small 
Business Administration. 

[49] As a consequence of receiving assistance for flood-related damage 
caused by Hurricane Sandy, these individuals will be required to 
purchase and maintain flood insurance for future disasters. This flood-
insurance coverage must be at least the amount of IHP flood-related 
assistance received for damage from Hurricane Sandy. 

[50] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. 

[51] GAO's guide for designing evaluations states that an evaluation 
gives an agency the opportunity to improve program performance and 
provides a useful tool to determine whether the program has resulted 
in the desired benefits for participants and the public. GAO, 
Designing Evaluations: 2012 Revision, [hyperlink, 
http://www.gao.gov/products/GAO-12-208G] (Washington, D.C.: Jan. 31, 
2012). 

[52] STEP was implemented by localities. Each locality hired and 
directed contractors to provide repair services to residents. 

[53] Individuals may receive rental assistance through IHP after 
receiving STEP assistance in some circumstances. Because the authority 
for each program comes from different sections of the Stafford Act, 
the amount of STEP assistance individuals received did not count 
toward the $31,900 maximum available through IHP. There may be 
practical reasons to allow individuals to receive rental assistance 
after STEP services are provided. For instance, according to New York 
city officials, some individuals remained in hotels after repairs were 
finished because their homes still harbored mold, which was not 
addressed by STEP. 

[54] 79 Fed. Reg. 16015 (Mar. 24, 2014). 

[55] Our analysis excludes assistance to homeowners for flood damage 
to properties located in a special flood hazard area because such 
flood damage is typically not covered by private homeowners insurance. 
Also, individuals who received IHP assistance for home repair or 
personal property and reported having private insurance may have 
received assistance for damages not covered by their insurance, which 
is allowable. 

[56] Certain provisions found in homeowners policies can also affect 
coverage. For example, while the most common private insurance 
policies typically exclude damage caused by flood and cover damage 
caused by wind, some insurance policies contain a clause that denies 
coverage for damage that is simultaneously caused by both an excluded 
peril (such as flood) and a covered peril (wind). According to 
insurance industry experts, this type of clause can present a 
particular challenge for owners of coastal properties when hurricanes 
occur. See GAO, Homeowers Insurance: Multiple Challenges Make 
Expanding Private Coverage Difficult, [hyperlink, 
http://www.gao.gov/products/GAO-14-179] (Washington, D.C.: Jan. 30, 
2014). 

[57] [hyperlink, http://www.gao.gov/products/GAO-06-954T]. 

[58] For more information on this example, see GAO's Government Data 
Sharing Community of Practice Minutes from the November 20, 2013 
meeting. Minutes can be found at: [hyperlink, 
http://www.gao.gov/assets/670/660429.pdf]. 

[59] We chose to use data provided by state departments of correction 
in New York, New Jersey, and Connecticut because those states were 
most heavily impacted by Hurricane Sandy. 

[60] PKEMRA was enacted as Title VI of the Department of Homeland 
Security Appropriations Act, 2007, Pub. L. No. 109-295, § 601, 120 
Stat. 1355, 1394 (2006). 

[61] GAO, Individual Disaster Assistance Programs: Framework for Fraud 
Prevention, Detection, and Prosecution, [hyperlink, 
http://www.gao.gov/products/GAO-06-954T] (Washington, D.C.: July 12, 
2006); Federal Information System Controls Audit Manual (FISCAM), 
[hyperlink, http://www.gao.gov/products/GAO-09-232G] (Washington, 
D.C.: February 2009); and Standards for Internal Control in the 
Federal Government, [hyperlink, 
http://www.gao.gov/products/GAO/AIMD-00-21.3.1] (Washington, D.C.: 
November 1999). 

[62] Pub. L. No. 93-288, 88 Stat. 143 (1974) (codified as amended at 
42 U.S.C. §§ 5121-5207). 

[63] GAO, Individual Disaster Assistance Programs: Framework for Fraud 
Prevention, Detection, and Prosecution, [hyperlink, 
http://www.gao.gov/products/GAO-06-954T] (Washington, D.C.: July 12, 
2006); and Designing Evaluations: 2012 Revision, [hyperlink, 
http://www.gao.gov/products/GAO-12-208G] (Washington, D.C.: Jan. 31, 
2012). 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation, and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the 
performance and accountability of the federal government for the 
American people. GAO examines the use of public funds; evaluates 
federal programs and policies; and provides analyses, recommendations, 
and other assistance to help Congress make informed oversight, policy, 
and funding decisions. GAO's commitment to good government is 
reflected in its core values of accountability, integrity, and 
reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's website [hyperlink, http://www.gao.gov]. Each 
weekday afternoon, GAO posts on its website newly released reports, 
testimony, and correspondence. To have GAO e-mail you a list of newly 
posted products, go to [hyperlink, http://www.gao.gov] and select 
"E-mail Updates." 

Order by Phone: 

The price of each GAO publication reflects GAO's actual cost of 
production and distribution and depends on the number of pages in the 
publication and whether the publication is printed in color or black 
and white. Pricing and ordering information is posted on GAO's 
website, [hyperlink, http://www.gao.gov/ordering.htm]. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 
MasterCard, Visa, check, or money order. Call for additional 
information. 

Connect with GAO: 

Connect with GAO on facebook, flickr, twitter, and YouTube.
Subscribe to our RSS Feeds or E mail Updates. Listen to our Podcasts.
Visit GAO on the web at [hyperlink, http://www.gao.gov]. 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 
Website: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]; 
E-mail: fraudnet@gao.gov; 
Automated answering system: (800) 424-5454 or (202) 512-7470. 

Congressional Relations: 

Katherine Siggerud, Managing Director, siggerudk@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, DC 20548. 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, DC 20548. 

[End of document]