Affordable Broadband: FCC Could Improve Performance Goals and Measures, Consumer Outreach, and Fraud Risk Management

FCC's Affordable Connectivity Program (ACP) offers eligible low-income households discounts on the cost of their broadband service and certain devices. FCC reimburses participating internet service providers for providing these discounts. Since launching, the program has grown to include over 14-million subscribers. In 2023, we reported that FCC established some performance goals and measures for the program. However, the goals and measures did not fully align with key attributes of effective performance management, which we identified from our prior reports. For example, FCC's goals and measures lacked specificity and clearly defined targets, raising questions about how effective these goals and measures would be at helping FCC gauge the program's achievements and identify improvements. Consequently, we recommended that FCC ensure that ACP performance goals and measures align with key attributes of effective performance goals and measures. In February 2024, we confirmed that FCC had implemented this recommendation, making changes to better align the program's performance metrics with key attributes of performance management. Specifically, FCC revised the performance measures for the program to include specific, numeric targets and timeframes, making their performance metrics more objective, clear, and measurable. Additionally, although FCC did not revise the ACP's performance goals, clarifying how the goals would be measured made it clearer how the goals are results-oriented and contribute to the crosscutting nature of ACP and other FCC efforts, such as the Lifeline program. Having updated its performance metrics, FCC will be better able to assess and effectively demonstrate ACP's achievements to Congress and other stakeholders.

FCC's Affordable Connectivity Program (ACP) offers eligible low-income households discounts on the cost of their broadband service and certain devices. FCC reimburses participating internet service providers for providing these discounts. Since launching, the program has grown to include over 14-million subscribers. In 2023, we reported that FCC has engaged in various outreach efforts to raise ACP's awareness and translated its outreach materials into non-English languages to reach eligible households with limited-English proficiency. However, we reviewed a selection of these materials and the process to translate them and found that they did not fully align with leading practices for consumer content or for developing translated language products. For example, the translations' quality varied due to lack of clarity and incompleteness. Also, FCC's translation process lacked elements that could have improved the materials. Specifically, FCC's process did not include a plan to identify the translation's goals, audience, and which languages would be supported. FCC did not require documentation to verify that the contractor completed its quality assurance processes. Although FCC considered external feedback on translations after publication, the agency did not test the product with a group that represented its intended audience to incorporate feedback before it was finalized. FCC also did not solicit feedback from its intended audience to incorporate into a final product prior to publication, so it could not update and finalize the product based on that feedback. Consequently, we recommended that FCC revise the language translation process for developing ACP non-English outreach materials to include the following steps: (1) develop a plan for designing and producing translated products; (2) incorporate review and quality assurance steps into the translation process and document completion of these steps during each process; (3) develop and test the products with others who represent the intended audience; and (4) update and finalize the products based on development and testing results. In December 2023, FCC provided documentation of its new plan and corresponding process for developing multilingual ACP translated materials. The new process includes review and quality assurance steps, such as reviews by subject-matter experts and linguists, and interviews with language subject-matter-experts or native language speakers who represent the target audience, which FCC's translation vendors are supposed to complete and document. According to FCC officials, to verify compliance with the quality assurance process, FCC contracting officers may request documentation from the translation vendors as part of their contract monitoring. After review and testing, vendors are responsible for updating and finalizing their translation products based on the feedback and sharing the final translation products with FCC. Having more fully aligned FCC's translation process for ACP outreach material with leading practices will provide FCC better assurance that its products are of sufficient quality to be useful to consumers with limited English proficiency who may want to enroll in the program.

FCC's Affordable Connectivity Program (ACP) offers eligible low-income households discounts on the cost of their broadband service and certain devices. FCC reimburses participating internet service providers for providing these discounts. Since launching, the program has grown to include over 14-million subscribers. In January 2023, we reported that FCC had completed a variety of outreach activities to raise awareness of ACP, but it had not developed an outreach plan to guide those activities. According to FCC officials, FCC has largely leveraged the outreach infrastructure from the program's predecessor, the Emergency Broadband Benefit (EBB) program. to inform its new, ACP outreach efforts. These officials said that FCC had not created an ACP outreach plan due to the compressed timelines for launching ACP required by statute. We have previously determined that agencies should have a plan for outreach activities to help them overcome challenges that may emerge and identified nine leading practices for such planning. We noted that FCC had developed an outreach plan for EBB. However, we found this plan did not fully align with these leading practices. Specifically, we found the EBB outreach plan partially aligned with some practices and did not align with others. We recommended that FCC develop a consumer outreach plan, which aligns with leading practices for consumer outreach planning, to educate eligible consumers about ACP. In December 2023, FCC officials provided us the Consumer Outreach Plan for ACP. We reviewed the plan and determined that it aligned with all nine of the leading practices for planning effective consumer outreach. For example, the plan set goals for ACP outreach based on household enrollment targets, specifically for the overall eligible population and for first-time internet users. The plan also includes metrics for measuring success geared toward program awareness and enrollment, as well as specific metrics for certain portions of the plan (such as paid media and outreach grants). With this new outreach plan in place, FCC will be better positioned to make decisions about which mix of outreach tools will be most effective in helping FCC meet its goals of raising awareness of and participation in ACP.

The Federal Communications Commission's (FCC) Affordable Connectivity Program (ACP) offers eligible low-income households discounts on the cost of their broadband service and certain devices. FCC reimburses participating internet service providers for providing these discounts to households that subscribe to the program. In January 2023, we reported that FCC had taken steps to manage fraud risks in ACP. For example, FCC assessed fraud risks in ACP in May 2022. However, some of FCC's efforts did not fully align with selected leading practices in GAO's Fraud Risk Framework. Specifically, FCC had not developed a process to conduct fraud risk assessments at regular intervals or when there are changes to the program. FCC has not established such a process because responsibilities for these assessments were not clearly defined. FCC had also not identified specific tools, methods, and sources for gathering information about fraud risks. Although FCC assessed fraud risks in ACP in May 2022, the agency had not previously assessed fraud risks in the program or its predecessor, the Emergency Broadband Benefit program. As such, we recommended that FCC should develop and implement a process, with clearly defined responsibilities and sources of information on fraud risks, for conducting fraud risk assessments for ACP at regular intervals and when there are changes to the program or operating environment. In May 2023, we confirmed that FCC had developed and implemented such a process. Specifically, FCC implemented policies and procedures that establish responsibilities for fraud risk assessments across FCC, including, for example, identifying who is responsible for each program and establishing that those responsible need to set a cadence for fraud risk assessments to ensure assessments are done at regular interval and when there are significant changes to the program or operating environment. In February 2023, FCC program officials adopted the assessment cadence applicable to ACP. The policies and procedures further establish that the program team serves as the primary party responsible for identification of sources of information on fraud risks, and we confirmed that the program team had taken steps to refresh its data sources. As a result of these actions, FCC will be better able to effectively prevent and detect fraud in this over $14 billion program.

FCC's Affordable Connectivity Program (ACP) offers eligible low-income households discounts on the cost of their broadband service and certain devices. FCC reimburses participating internet service providers for providing these discounts. Since launching, the program has grown to include over 14-million subscribers. We and others have previously reported on another similar FCC program's susceptibility to fraud, and some stakeholders have raised concerns about program integrity for ACP. In January 2023, we reported that FCC had taken steps to manage fraud risks in ACP, but that its efforts did not fully align with leading practices in GAO's Fraud Risk Framework. Specifically, while FCC assessed ACP fraud risks in May 2022, it had not developed an antifraud strategy to address the risks identified in its assessment. According to the Fraud Risk Framework, a leading practice for managers who effectively manage fraud risk is to develop and document an antifraud strategy that describes the program's activities for preventing, detecting, and responding to the risks identified in the fraud risk profile. Developing an antifraud strategy that aligns with the leading practices in the Fraud Risk Framework would help ensure that FCC effectively manages the risks identified in its fraud risk profile. Such a strategy would also fully and clearly establish roles and responsibilities for those involved in fraud risk management activities for ACP. Consequently, we recommended that FCC develop and implement an antifraud strategy for ACP that aligns with leading practices in the Fraud Risk Framework. These practices include documenting and communicating the program's activities for preventing, detecting, and responding to fraud and establishing roles and responsibilities of those involved in fraud risk management activities. In July 2023, FCC provided us the antifraud strategy it developed in response to this recommendation. The strategy aligns with GAO's Fraud Risk Framework, and includes a section that shows how the components of the strategy align with specific components of the GAO framework. These include components geared toward fraud prevention, detection, and response, among others. The strategy also includes a section on roles and responsibilities, which identifies specific offices within FCC that are responsible for implementing activities within the strategy. Having developed and implemented this strategy, FCC is better positioned to manage fraud risks and ensure the best use of ACP funds.

FCC's Affordable Connectivity Program (ACP) offers eligible low-income households discounts on the cost of broadband and reimburses providers who offer the discount. The program includes over 14 million subscribers. In January 2023, we reported that FCC had not developed processes to monitor certain antifraud controls including those for preventing duplicate subscribers. FCC's efforts to manage ACP fraud risks did not fully align with leading practices in GAO's Fraud Risk Framework. While FCC assessed ACP fraud risks in May 2022, we identified concerns related to FCC's consideration of how its existing antifraud controls mitigated identified risks. Specifically, we identified issues related to major antifraud controls for ACP, and found that FCC had not developed processes to monitor certain controls, including those related to preventing duplicate program subscribers. FCC uses its enrollment database to prevent duplicate subscribers in ACP, as the ACP discounts are limited to one per household. However, we analyzed a snapshot of enrollment data as of April 1, 2022 and identified over 2,500 potential duplicate subscribers. The specifics of these potential duplicates varied, although the majority of them had at least slight variations in personally identifiable information (PII), like name or date of birth. We analyzed ACP reimbursements for a non-generalizable sample of 60 pairs of these potentially duplicative subscribers. We identified that providers received simultaneous reimbursements for 26 pairs of potential duplicates with variation among PII. However, FCC did not consider these issues in its fraud risk assessment because it did not comprehensively monitor these controls. The issues we identified called into question whether the controls were having their intended effect to prevent and detect fraud and mitigate identified fraud risks. Consequently, we recommended that FCC develop and implement processes to monitor its antifraud controls related to preventing duplicate subscribers in ACP. In June 2023, FCC submitted corrective action documentation detailing its process for monitoring duplicate subscribers in ACP. This process, conducted on a monthly basis, involves analyzing the entire population of enrolled subscribers against a matching methodology to identify duplicates, and then de-enrolling the duplicate subscribers and holding payments (that is, reimbursements) to those duplicates. The process also involves analyzing the root cause of the duplicates that appeared in the subscriber database, in order to make continuous technical fixes to prevent future duplicates. As a result of following this process, FCC has begun continuously identifying duplicate subscribers for corrective action. Having put into place a process to better monitor its antifraud controls related to duplicate subscribers, FCC can provide better assurance that its antifraud efforts are effectively preventing, detecting, and responding to fraud and safeguarding program funds.

FCC's Affordable Connectivity Program (ACP) offers eligible low-income households discounts on the cost of broadband and reimburses providers who offer the discount. The program includes over 14 million subscribers. In January 2023, we reported that FCC had not developed processes to monitor certain antifraud controls including identity verification. FCC's efforts to manage ACP fraud risks did not fully align with leading practices in GAO's Fraud Risk Framework. While FCC assessed ACP fraud risks in May 2022, we identified concerns related to FCC's consideration of how existing controls mitigate identified risks. Specifically, we identified issues related to major controls for ACP, including identity verification. In 2020, FCC launched the National Lifeline Eligibility Verifier (Verifier) tool in response to concerns about fraud in Lifeline, which, like ACP, also provides discounted services to low-income households. FCC uses a modified version of the Verifier to process ACP applications. The Verifier relies on automated connections to federal and state benefits databases and other automated sources to validate an applicant's identity. However, there are multiple ways to apply for ACP, and depending on which method is used, the application may go through the Verifier, a manual review for applicants who cannot be automatically verified, or an FCC-approved alternative verification process. For applicants applying through the Verifier, FCC uses a third-party vendor to verify the applicant's identity by using personal information, like name and date of birth, entered on the application. According to agency officials, applicants who do not apply through the Verifier are not subject to this identity verification, although participating providers who use their alternative verification processes to determine eligibility and enroll subscribers directly are expected to use verification processes at least as stringent as the Verifier. Our analysis of ACP enrollment data identified subscribers with questionably old and young dates of birth, such as dates of birth that showed over 200 subscribers were over age 110 and 20 subscribers were under age 10. We also identified ACP subscribers who provided partial Social Security numbers that do not match records from the Social Security Administration. Specifically, our analysis found that over 874,000 (over 10 percent) of the approximately 8.5 million ACP subscribers who included the last four digits of their Social Security number did not match records in the Social Security Administration's Enumeration Verification System. These mismatches represent a fraud risk that monitoring processes may flag for further review. However, FCC did not consider these issues in its fraud risk assessment because it did not comprehensively monitor these controls. The issues we identified call into question whether the controls are having their intended effect to prevent and detect fraud and mitigate identified fraud risks. We recommended that FCC develop processes to monitor its antifraud controls related to subscriber identity verification in ACP. In June 2023, FCC submitted documentation of its process for monitoring subscriber identity verification for ACP. This process involved an initial review of the issues our report identified and a root cause analysis to determine why the problems occurred. FCC's review successfully identified the reason for the problem, which was linked to a specific type of ACP applicant. According to FCC's corrective action documentation, the issues we identified have been resolved through a technical fix to monitor identity information for this type of ACP enrollee. This technical fix was implemented in FCC's system in May 2023, and in July 2023, FCC officials said they have confirmed this technical fix is working. Having put into place a process to better monitor its antifraud controls related to identity, FCC can provide better assurance that its antifraud efforts are effective.

FCC's Affordable Connectivity Program (ACP) offers eligible low-income households discounts on the cost of broadband and reimburses providers who offer the discount. The program includes over 14 million subscribers. In January 2023, we reported that FCC's efforts to manage ACP fraud risks did not fully align with leading practices in GAO's Fraud Risk Framework. While FCC assessed ACP fraud risks in May 2022, we identified concerns related to FCC's consideration of how its existing antifraud controls mitigated identified risks. Specifically, we identified issues related to major antifraud controls for ACP and found that FCC had not developed processes to monitor certain controls, including those related to validating subscribers' addresses. Among other things, FCC uses USPS data to validate addresses prior to enrollment in the program, as the ACP discounts are limited to one discount per household. However, our analysis of ACP enrollment data against USPS data identified various issues, such as addresses flagged as PO Boxes or commercial mailboxes or having missing or invalid secondary information (such as an apartment number). Although not all such cases may be indicative of potential fraud, they represent issues that monitoring processes should flag for further review. For example, PO Box and commercial mailbox addresses raise questions about where the broadband service is being provided, and secondary address information is important for FCC to identify potentially duplicative subscribers. These issues can hinder efforts to enforce ACP's one-per-household rule. However, FCC did not consider these issues in its fraud risk assessment because it did not comprehensively monitor these controls, such as address validation. The issues we identified called into question whether the controls were having their intended effect to prevent, detect, and mitigate fraud risks. Consequently, we recommended that FCC develop and implement processes to monitor its antifraud controls related to subscriber address validation in ACP. In April 2024, we confirmed that FCC had taken action to implement these processes. Specifically, FCC implemented processes that include (1) automated preventive controls to block addresses that include potential indicators of fraud or violations of program rules, (2) reviews of additional alerts that FCC receives from its third-party identity verification vendor that flag potential indicators of fraud or violations of program rules, and (3) regularly recurring Program Integrity Assurance reviews of addresses that include potential indicators of fraud or violations of program rules. As needed, FCC seeks de-enrollment of subscribers with invalid addresses. Having put into place these processes, FCC has better assurance that its antifraud efforts are effectively, preventing, detecting, and responding to fraud and safeguarding program funds.

FCC's Affordable Connectivity Program (ACP) offers eligible low-income households discounts on the cost of broadband and reimburses providers who offer the discount. The program includes over 14 million subscribers. In January 2023, we reported that FCC's efforts to manage ACP fraud risks did not fully align with leading practices in GAO's Fraud Risk Framework. While FCC assessed ACP fraud risks in May 2022, we identified concerns related to FCC's consideration of how its existing controls mitigated identified risks. Specifically, we identified issues related to major antifraud controls for ACP, and found that FCC had not developed processes to monitor these controls, including those related to duplicate subscriber prevention, identity verification, and address validation. We identified weaknesses in these controls, including potential duplicate subscribers, subscribers allegedly receiving fixed broadband at PO Boxes and commercial mailboxes, and subscribers with broadband providers' retail locations as their primary or mailing addresses. FCC did not consider these types of issues as part of its fraud risk assessment because it had not established monitoring processes for these controls. The Fraud Risk Framework calls for managers to monitor the effectiveness of antifraud activities and to use the results of monitoring to improve the design and implementation of fraud risk management activities. As such, we recommended that FCC should use information obtained from monitoring processes to improve the design and implementation of fraud risk management activities in ACP, including its fraud risk assessment and subsequent antifraud strategy. In December 2023, FCC submitted documentation detailing how it has used information obtained from its recently implemented monitoring processes to improve its fraud risk management activities. For example, FCC developed and implemented an antifraud strategy and processes to monitor antifraud controls related to preventing duplicate subscribers, subscriber identify verification, and subscriber address validation. FCC then tasked the contractor that developed its May 2022 fraud risk assessment with updating the assessment to reflect these processes. This involved collecting and analyzing information to identify how risks were affected by these processes to understand the current ACP fraud risk landscape. The resulting updated fraud risk assessment report included an evaluation of the effectiveness of antifraud activities and the associated effects to risk likelihood and impact, and details on updated risks and the current risk state for the program. As a result of using information from its monitoring processes to improve its fraud risk management activities, FCC has greater assurance that its antifraud efforts are preventing, detecting, and responding to fraud, and safeguarding its over $14 billion program.