Disaster Recovery: HUD Should Develop Data Collection Guidance to Support Analysis of Block Grant Fraud Risks
Fast Facts
Congress gave almost $40 billion in block grants to help homeowners with, among other things, repairing or rebuilding homes damaged by natural disasters from 2017 to 2019. The Department of Housing and Urban Development administers the grants.
But these grants are vulnerable to fraud. For example, some households approved for funds didn't report assistance from FEMA that could impact their award.
Also, HUD monitors individual grantees. But it doesn't assess the risks that some contractors—whose work on damaged homes is paid for using grant funds—may pose across these grants.
Our recommendations would help HUD better manage risks to block grants.
Hurricane Irma damaged homes and flooded roadways in Fort Lauderdale, Florida
Highlights
What GAO Found
GAO's analysis of Community Development Block Grant Disaster Recovery (disaster block grant) applicant data identified vulnerabilities to fraud. Out of 8,260 households reviewed, GAO identified
- Potential duplication of benefits. 500 households were approved for Federal Emergency Management Agency (FEMA) assistance that is potentially duplicative of disaster block grant assistance. The FEMA-only assistance for these households totaled over $1 million. The figure shows other potentially duplicative assistance GAO identified.
- Potentially ineligible households. 197 households with estimated income over limits were approved. Estimated income for two of these households exceeded $330,000—far above the income limits.
Households Potentially Receiving Duplicative Benefits from Multiple Programs
Note: The categories in this figure are not mutually exclusive.
GAO also found that the U.S. Department of Housing and Urban Development (HUD) does not require grantees and subrecipients to collect applicant data in a complete and consistent manner to support applicant eligibility determinations and fraud risk management.
GAO's analysis of the disaster block grant contracting network identified key players who are important to HUD's risk-based monitoring because of the greater potential impact they have on the contracting environment. Specifically, GAO identified 16 contractors and 30 subcontractors that are key players within a network of 1,324 entities. While key players' ability to influence or diffuse information can lead to positive outcomes, fraud risk is heightened when information on control vulnerabilities or wrongdoing is more easily shared across the network.
GAO's analysis of the 16 contractors that are key players illustrates how HUD and grantees could better understand the disaster block grant risk environment by collecting contractor and subcontractor data, such as unique entity identifiers. Currently, HUD's approach to identifying and managing risks focuses on monitoring individual grantees and may not fully assess risks across the contracting environment. HUD does not provide specific guidance to grantees on standards or requirements for collecting data. Additional guidance from HUD on what data elements to collect could support grantees' and subrecipients' ability to identify contractors that are debarred, suspended, or excluded from receiving federal contracts.
Why GAO Did This Study
In response to the damage caused by natural disasters in 2017 through 2019, Congress appropriated approximately $39 billion in disaster block grant funds to HUD. The decentralized environment in which HUD's disaster block grants operate creates vulnerabilities to different types of fraud as funds are distributed to grantees, subrecipients, contractors, and subcontractors.
As part of wide-ranging disaster-related work we are conducting, this report focuses on the potential for fraud in CDBG-DR homeowner assistance programs. This report examines, among other objectives, the extent to which (1) applicant data indicate vulnerabilities to fraud and data quality presents challenges to identifying such vulnerabilities and (2) network and other analyses can help HUD manage risks associated with the contracting environment.
GAO conducted data matching and analysis to identify potentially ineligible households for our selected grantees and subrecipients. GAO also conducted network analysis, among other analyses, to help HUD better understand and monitor its decentralized grant environment.
Recommendations
GAO is making seven recommendations to HUD, including that it develop guidance to collect applicant data to support eligibility decisions and contractor data to facilitate identifying risks. HUD agreed with some, but not all of the recommendations. GAO continues to believe all the recommendations are warranted and should be implemented.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of Housing and Urban Development | The Assistant Secretary for Community Planning and Development should develop guidance for CDBG-DR grantees and subrecipients on collecting complete and consistent data to better support applicant eligibility determinations and fraud risk management. (Recommendation 1) |
In February 2025, HUD stated that it continues to work with Office of the Chief Risk Officer (OCRO) to develop a fraud risk management program responsive to GAO and HUD Office of the Inspector General (OIG) fraud-related recommendations. Specifically, HUD's Office of Disaster Recover plans to address fraud risk management within a larger context of agency-wide Enterprise Risk Management (ERM) and to follow OCRO's guidance on ERM, including fraud risk management. Pursuant to HUD OIG Audit Memorandum 2022-FO-0801, HUD agreed to develop and implement a comprehensive fraud risk management program. Specifically, HUD is currently developing a Fraud Risk Playbook along with tools and templates to help program offices design and implement fraud risk management programs, including fraud risk assessments. HUD stated that it will need to customize the tools to meet program-specific needs. Once this customization is complete, HUD plans to train staff and begin rollout to CDBG-DR grantees. HUD anticipates the staff training and the rollout to grantees will be complete by December 2025. HUD's Fraud Risk Playbook will inform guidance for grantees and subrecipients on collecting complete and consistent data to better support applicant eligibility determinations and fraud risk management.
|
| Department of Housing and Urban Development | The Assistant Secretary for Community Planning and Development should update the Monitoring Handbook for Disaster Recovery Community Development Block Grant monitoring activities to provide additional guidance in the selection of contracts for review. This should include factors such as contractors that present increased risk to the CDBG-DR environment, including those where allegations of fraud, waste, or abuse have been made. (Recommendation 2) |
In February 2025, HUD stated that it continues to work with Office of the Chief Risk Officer (OCRO) to develop a fraud risk management program responsive to GAO and HUD Office of the Inspector General (OIG) fraud-related recommendations. Specifically, HUD's Office of Disaster Recover plans to address fraud risk management within a larger context of agency-wide Enterprise Risk Management (ERM) and to follow OCRO's guidance on ERM, including fraud risk management.Pursuant to HUD OIG Audit Memorandum 2022-FO-0801, HUD agreed to develop and implement a comprehensive fraud risk management program. Specifically, HUD is currently developing a Fraud Risk Playbook along with tools and templates to help program offices design and implement fraud risk management programs, including fraud risk assessments. HUD stated that it will need to customize the tools to meet program-specific needs. Once this customization is complete, HUD plans to train staff and begin rollout to CDBG-DR grantees. HUD anticipates the staff training and the rollout to grantees will be complete by December 2025. HUD's Fraud Risk Playbook will inform guidance in the selection of contracts for review and any necessary updates to exhibits in HUD's Monitoring Handbook related to CDBG-DR monitoring activities.
|
| Department of Housing and Urban Development |
Priority Rec.
The Assistant Secretary for Community Planning and Development should identify ways to collect and combine contractor and subcontractor data across grantees and subrecipients to facilitate risk analyses, such as by expanding the Disaster Recovery Data Portal, Disaster Recovery Grant Reporting System, or other appropriate systems. (Recommendation 3) |
In February 2025, HUD stated that it continues to work with Office of the Chief Risk Officer (OCRO) to develop a fraud risk management program responsive to GAO and HUD Office of the Inspector General (OIG) fraud-related recommendations. Specifically, HUD's Office of Disaster Recover plans to address fraud risk management within a larger context of agency-wide Enterprise Risk Management (ERM) and to follow OCRO's guidance on ERM, including fraud risk management. Pursuant to HUD OIG Audit Memorandum 2022-FO-0801, HUD agreed to develop and implement a comprehensive fraud risk management program. Specifically, HUD is currently developing a Fraud Risk Playbook along with tools and templates to help program offices design and implement fraud risk management programs, including fraud risk assessments. HUD stated that it will need to customize the tools to meet program-specific needs. Once this customization is complete, HUD plans to train staff and begin rollout to CDBG-DR grantees. HUD anticipates the staff training and the rollout to grantees will be complete by December 2025. HUD's Fraud Risk Playbook will inform efforts to collect and combine contractor and subcontractor data across grantees and subrecipients to facilitate risk analyses.
|
| Department of Housing and Urban Development |
Priority Rec.
The Assistant Secretary for Community Planning and Development should develop and implement guidance for CDBG-DR grantees and subrecipients to collect contractor and subcontractor data to facilitate identification of contractor and cross-cutting fraud risks through approaches such as network analysis. (Recommendation 4) |
In February 2025, HUD stated that it continues to work with Office of the Chief Risk Officer (OCRO) to develop a fraud risk management program responsive to GAO and HUD Office of the Inspector General (OIG) fraud-related recommendations. Specifically, HUD's Office of Disaster Recover plans to address fraud risk management within a larger context of agency-wide Enterprise Risk Management (ERM) and to follow OCRO's guidance on ERM, including fraud risk management. Pursuant to HUD OIG Audit Memorandum 2022-FO-0801, HUD agreed to develop and implement a comprehensive fraud risk management program. Specifically, HUD is currently developing a Fraud Risk Playbook along with tools and templates to help program offices design and implement fraud risk management programs, including fraud risk assessments. HUD stated that it will need to customize the tools to meet program-specific needs. Once this customization is complete, HUD plans to train staff and begin rollout to CDBG-DR grantees. HUD anticipates the staff training and the rollout to grantees will be complete by December 2025. HUD's Fraud Risk Playbook will inform the agency's efforts to develop and implement guidance for CDBG-DR grantees and subrecipients to collect contractor and subcontractor data to facilitate identification of contractor and cross-cutting fraud risks
|
| Department of Housing and Urban Development | The Assistant Secretary for Community Planning and Development should develop guidance on data elements to be collected by grantees and subrecipients, to determine if a contractor has been suspended, debarred, or excluded from working on government contracts. (Recommendation 5) |
In February 2025, HUD stated that it continues to work with Office of the Chief Risk Officer (OCRO) to develop a fraud risk management program responsive to GAO and HUD Office of the Inspector General (OIG) fraud-related recommendations. Specifically, HUD's Office of Disaster Recover plans to address fraud risk management within a larger context of agency-wide Enterprise Risk Management (ERM) and to follow OCRO's guidance on ERM, including fraud risk management. Pursuant to HUD OIG Audit Memorandum 2022-FO-0801, HUD agreed to develop and implement a comprehensive fraud risk management program. Specifically, HUD is currently developing a Fraud Risk Playbook along with tools and templates to help program offices design and implement fraud risk management programs, including fraud risk assessments. HUD stated that it will need to customize the tools to meet program-specific needs. Once this customization is complete, HUD plans to train staff and begin rollout to CDBG-DR grantees. HUD anticipates the staff training and the rollout to grantees will be complete by December 2025. HUD's Fraud Risk Playbook will inform efforts to develop guidance on data elements to be collected by grantees and subrecipients, to determine if a contractor has been suspended, debarred, or excluded from working on government contracts.
|
| Department of Housing and Urban Development | The Assistant Secretary for Community Planning and Development should ensure that grantees and subrecipients have attended fraud-related training as required. This could include requesting and reviewing attendance documentation from the OIG and grantees. (Recommendation 6) |
In February 2025, HUD provided attendance documentation, including lists of CDBG-DR grantees and subrecipients that attended fraud-related trainings in April and May 2024. While HUD made important progress in 2024 to ensure that grantees and subrecipients have attended fraud-related training, to fully implement our recommendation, HUD needs to demonstrate that it is requesting and reviewing attendance documentation from the HUD OIG and grantees consistently. We will continue to monitor the Department's progress.
|
| Department of Housing and Urban Development | The Assistant Secretary for Community Planning and Development, in coordination with the HUD Office of Inspector General, should ensure that grantees and subrecipients are made aware of available fraud-related training and make training available on demand to grantees and subrecipients. (Recommendation 7) |
In February 2025, HUD provided documentation showing that that agency made CDBG-DR grantees and subrecipients aware of available fraud-related training on its HUD Exchange website. The notice also included an option for CDBG-DR grantees and subrecipients to watch the training on demand. While HUD made important progress in 2024 to ensure that grantees and subrecipients are made aware of available fraud-related training and that it is available on demand, to fully implement our recommendation, HUD needs to demonstrate that it is doing so consistently. We will continue to monitor the Department's progress.
|