SUMMER 2008 JOURNAL OF GOVERNMENT FINANCIAL MANAGEMENT 11

Transcription

1

2 While our ability to computer match, or in modern terms data mine, has come a long way in the past 25 years and now represents a critical part of what has become a burgeoning forensic auditing field, the underlying concepts and the ability to leverage technology to fight fraud, waste and abuse have been with us for a long time. This article explores the application of forensic auditing techniques from the perspective of using these tools to cost-effectively limit fraud, waste and abuse at the outset before a disbursement is made. Ultimately, this should be the goal of internal control and can be an important asset in fighting the war against improper payments. When Jim Durnil called computer matching a management tool, he was right on target. Unfortunately, the use of these tools has typically been the purview of the audit community and not the financial management community. Given the ease and power of these tools, it is hoped that this article will help shift that paradigm so that management becomes the predominant user of forensic auditing as a form of prevention. This article highlights three case studies using recent U.S. Government Accountability Office (GAO) reports, which used forensic auditing to identify internal control weaknesses that were exploited, resulting in improper payments and fraud, waste and abuse. GAO has long applied forensic techniques as a key part of its arsenal of audit tools and in 2005 established a unit dedicated solely to forensic audits and special investigations, given the importance of closely linking these disciplines. I then provide a blueprint for management to follow in implementing its own forensic audit program as a first line of defense against fraud, waste and abuse. GAO Reports Provide Valuable Insight into the Power of Forensic Auditing Now let s look at the three case studies where GAO used forensic auditing to identify and demonstrate the impact of internal control weaknesses and to put a face on these problems in terms that the Congress and the public can easily understand. Case Study 1: Improper and Abusive Use of Premium Class Travel In September 2007, GAO reported that internal control weaknesses throughout government led to improper and abusive use of premium-class air travel. 1 GAO found that about two-thirds of all premium-class travel was not properly authorized or justified, resulting in $146 million of improper and abusive travel. The additional cost of flying first or business class is significant. While in my 40 years of federal service, I never met anyone on a government salary who would willingly spend $7,500 of their own money on a first-class ticket to fly roundtrip from Washington, D.C., to Zurich, Switzerland, when the cost of a coachclass ticket was only $900, a senior executive elected to do exactly that, but on the taxpayers nickel. Would you spend $2,200 to fly first class to Los Angeles from Washington, D.C., when you could get there by coach for only $400? Well, a federal executive decided it was in the government s best interest to incur that expense. Improper and abusive travel extended beyond senior executives. GAO found that a GS-13 used a firstclass, round-trip ticket to fly from Washington, D.C., to Athens, Greece, at a cost of $5,400, when a coach-class ticket would have cost $1,500. An E-6 flew first class from Cairo, Egypt, to Washington, D.C., at a cost of $5,400, when the cost in coach was only $800. GAO determined that while premiumclass travel represented less than 1 percent of total flights taken governmentwide, it accounted for nearly 7 percent of total airline travel cost. Following the GAO report, the U.S. Office of Management and Budget (OMB) immediately acted to strengthen internal control over premium-class travel and made it clear to agencies that the status quo was not acceptable. What is unfortunate is that an audit had to put a face on this problem. The information was readily available to agency management from the databases of the four banks that participate in the federal government s travel card program. It was just a matter of mining the data and then, using statistical sampling, to review specific transactions. In this way, agencies would have known where they stood and whether they had a problem that needed attention, rather than being embarrassed by an audit report that received widespread national media attention. Again, going back to Jim Durnil s 1983 article, data mining can be accomplished quickly and cheaply and is a proven management tool. Case Study 2: Thousands of Federal Contractors, Medicare and Medicaid Providers, and Tax-Exempt Organizations Abuse the Tax System Between March 2007 and November 2007, GAO issued a series of reports and testimonies 2 disclosing that thousands of federal contractors, Medicare and Medicaid providers, and tax-exempt organizations had abused the tax system. This work followed earlier reviews in 2004 to 2006, 3 where GAO reported that thousands of U.S. Department of Defense (DoD) contractors, civilian agency contractors and General Services Administration (GSA) contractors were abusing the tax system. Similar to all of GAO s forensic audit work, these audit products received widespread national media attention, which did not cast government in a positive light. For the periods covered by its work, GAO found that: More than 21,000 Medicare physicians and suppliers owed about $1 billion in federal taxes, and more than 30,000 Medicaid providers SUMMER 2008 JOURNAL OF GOVERNMENT FINANCIAL MANAGEMENT 11

3 (about 5 percent of all such providers) had tax debts totaling more than $1 billion. Nearly 55,000 organizations exempt from federal income taxes had almost $1 billion in unpaid payroll and other taxes. About 27,000 DoD contractors, 33,000 civilian agency contractors and 3,800 GSA contractors owed about $3 billion, $3.3 billion and $1.4 billion in unpaid taxes, respectively. Now what did GAO do to identify abuse of the tax system? It simply matched available agency program information to tax information maintained by the Internal Revenue Service (IRS). It then put a face on tax abusers through case studies and investigations that provided a snapshot of the abuses. For example, GAO identified a tax-exempt organization with more than $15 million of unpaid payroll taxes dating back to the early 2000s for which the top official had an annual compensation package in excess of $1 million. In another example, a hospital had $5 million in tax debts, primarily unpaid payroll taxes, going back a decade. The owners, with two houses valued at more than $2 million, received $2 million in Medicare payments in a recent year. Again, this is something that management, working with the IRS, could have done itself to gain an understanding of the magnitude of any problem and as a mechanism for oversight and enforcement. Given that GAO s first forensic audit of DoD contractors abusing the tax system was completed in 2004, it represented a perfect opportunity for agency management across government to expand the forensic work in government payments and establish programs for continuous oversight, often referred to as continuous auditing. Under continuous auditing programs, management can have its finger on the pulse at all times and be able to take timely action to address fraud, waste and abuse. Case Study 3: Continuing Fraud, Waste and Abuse Associated With Disaster Relief Governments, at all levels, continue to respond to the unprecedented havoc wrought by Hurricanes Katrina and Rita. Disaster assistance and rebuilding efforts will continue for the foreseeable future and will involve additional billions of taxpayer dollars. Beginning with a February 2006 report, GAO issued a series of reports chronicling significant fraud, waste and abuse in the multibilliondollar disaster assistance programs managed by the Federal Emergency Management Agency (FEMA), which is part of the U.S. Department of Homeland Security (DHS). 4 The magnitude and catastrophic nature of this disaster raised the risk of fraud, waste and abuse to the highest level. In DHS parlance, the program was at Code Red from the outset. GAO s work (as well as the work of the DHS inspector general) showed that billions have been lost in virtually every aspect of the disaster assistance and recovery effort. For example, GAO estimated that of the $7 billion in initial payments made by FEMA under the Individuals and Households Program, almost $1 billion were improper and potentially fraudulent. Yes, there were extenuating circumstances, such as reacting expeditiously to the urgent needs of victims who had lost everything. At the same time, GAO noted a number of serious internal control weaknesses that greatly increased opportunities for fraud, waste and abuse. In its work, GAO employed data mining to identify, for follow-up, transactions that on their face were questionable. While, as GAO pointed out, prevention is the key to minimizing fraud, waste and abuse in disaster recovery efforts, the use of forensic techniques, similar to those used by GAO, can complement preventive controls, especially when time is of the essence as in the case of disaster recovery. GAO s data mining included checks for invalid and duplicate Social Security numbers, invalid addresses, duplicate claims and questionable uses of disaster assistance. Everything that GAO did could have been done by management as part of a proactive program to complement needed preventive controls. There is no question, given the seriousness of the situation, that some fraud, waste and abuse were inevitable. The challenge was to limit improper payments to a manageable level, which did not happen, and then to have the forensic tools in place to quickly identify and act upon any problems in a timely manner. Establishing a Forensic Auditing Program as a First Line of Defense Against Fraud, Waste and Abuse Now let s explore what management can do to avail itself of the powers of forensic auditing techniques to better manage the risk of fraud. If you consider the following nine steps, you can be on your way to using forensic auditing to help address fraud, waste and abuse on an ongoing, proactive basis, in a costeffective manner as part of routine internal controls. These nine steps tie directly to what is needed to meet the objectives of OMB Circular A-123, Management s Responsibility for Internal Control, so certain steps, or portions of steps, may already be in place. Before outlining the nine steps, it is important to note that forensic auditing is just one facet of the broader topic of managing fraud risk. Many guidance documents are available to help management address the risk of fraud as well as applying forensic auditing techniques, which amplify the steps in this article. I was honored to recently serve on a task force sponsored by the Institute of Internal Auditors, the AICPA and the Association of Certified Fraud Examiners, which developed a guidance document titled, Managing the Business Risk of Fraud: A Practical Guide. The guide provides a useful summary resource for organizations in considering their exposures to fraud risks. Now let s quickly look at the nine steps to establish a viable, ongoing forensic auditing program. All of these steps are predicated on management at the highest levels being committed to the program in other words getting it that these type of 12 JOURNAL OF GOVERNMENT FINANCIAL MANAGEMENT SUMMER 2008

4 programs are essential in the government environment, where the public is expecting full accountability for and sound use of its tax dollars. Without this commitment, it is doubtful that forensic auditing programs will reach their potential as a tool to help fight fraud, waste and abuse. Step 1: Take Stock of Your Risks Taking stock of your risks is shorthand for a performing a vulnerability assessment for which there is a plethora of available guidance. In simple terms, members of a management team need to step back and ask fundamental questions, such as: What do they lose sleep over? What do they not want to see in The Washington Post? What do they want to make sure happens and happens well? What problems have cropped up in other organizations that could be a problem in this organization as well? What controls does the organization have in place, and what does the team know about how they are working? What changes have taken place in the organization and what new risks have been introduced? Step 2: Determine How Your Risks Can be Exploited Now that you have taken stock of your risks, it is time to determine how the risks can be exploited. You have to think like a fraudster. What would someone do to take advantage of gaps in internal control? For example, the use of a bogus Social Security number and the repeated use of the same Social Security number but with different names are common means of scamming a government entitlement program, and splitting purchases to avoid purchase limit controls can result in waste and abuse. We have seen a cottage industry in Medicare and Medicaid scammers, who through a variety of means fraudulently obtain reimbursements. If there is a lot of money, as in government programs, it is a given that fraudsters will figure out some way to exploit any weaknesses in the system of internal control. Similar to the first step, brainstorming is very important at this stage and requires the involvement of highly experienced members of the management team. Management may also want to consult with experts in fraud who can help them with the brainstorming by bringing a perspective of how a fraudster would typically think and act. SUMMER 2008 JOURNAL OF GOVERNMENT FINANCIAL MANAGEMENT 13

5 Step 3: Determine What Information Is Available to Test for Fraud, Waste and Abuse Make sure you always have a current inventory of information sources and automated data formats at your fingertips. For a well-managed organization, this is something that should be readily available, well understood and viewed as a critical management asset. Remember that the key to forensic auditing is the ability to mine vast amounts of information to determine whether there are anomalies. A related matter that requires close attention is whether there are any limits to data mining either legal, such as legislative limitations related to privacy and/or security issues, or public policy considerations, which auditors sometimes face in their work. For example, there are strict statutory limitations over the use and disclosure of tax information. GAO was able to work through a variety of data access issues in its work. While they can cause roadblocks and, in some cases, limit the use of data mining, these issues can generally be worked through as long as they are addressed early and with the goal of finding a proper solution under the letter and intent of the law. Step 4: Develop Forensic Testing Protocols You now have the information you need to develop focused forensic audit tests. If you have done the first three steps well, step 4 is relatively easy. You know what your risks are, how they can be exploited, and what automated information you have to determine whether the controls have been compromised. Planning the forensic audit tests are what auditors do every day and are simply a series of logical inquiries to determine what has happened, both good and bad. Step 5: Perform Data Mining While some technical knowledge is necessary, data mining is straightforward, and to again quote Jim Durnil, matching techniques can be used to examine extremely large amounts of computerized data quickly and cheaply. This is the easiest step in the forensic audit process; but the results are only as good as the work you have performed as part of the first four steps. If you probe for the wrong things or do not understand the content and quality of the information being data mined, the proverbial garbage in, garbage out will invariably result. Step 6: Analyze the Results of Data Mining If you have planned and executed your tests properly, the output will be the anomalies from the norm those things that just don t look right on the surface. For example, the repetitive use of a single Social Security number to obtain student loans under a variety of names would be an anomaly. This does not mean that something is wrong per se as there could be a reason for this, such as a data entry problem. But it is certainly an indication that something is amiss. Similar to what an audit organization would do, management must follow up on anomalies to determine if something is in fact wrong and why, and the potential magnitude of any problem. Step 7: Use the Results of Data Mining While this seems to be self-evident, management must make full use of its forensic auditing results. First, using the results of data mining as a road map, management will need to strengthen internal controls to plug any holes to avoid future exploitation. This should be done expeditiously as preventive controls are always the best defense against fraud, waste and abuse. Next, management will need to take legal and/or administrative actions to address specific instances or patterns of fraud, waste and abuse. Government employees need to know that they will be held accountable for their actions, whether it is their own improper use of a government credit or purchase card or if it is simply their failure to protect government assets from fraud, waste and abuse. Contractors need to understand that there are serious consequences to submitting potentially fraudulent invoices. Recipients of federal benefits need to understand the government will not cut them any slack if they commit fraud to receive government payments. Audit follow-up has always been a concern. My own experience is that all too often, at best, a problem is addressed prospectively without holding people accountable for past bad actions. An exception has been the response to fraudsters by the Katrina Fraud Task Force, for which prosecution has been aggressively pursued. Step 8: Sharing Experiences and Best Practices Management across government needs to share common experiences and best practices. Fraudsters use common techniques, especially for similar types of programs. Interagency task forces and working groups and intergovernmental organizations, such as AGA s new Partnership for Intergovernmental Management and Accountability, can serve as important catalysts for promoting effective forensic auditing programs. Step 9: Do It All Over Again Forensic auditing needs to be a continuous process. Risks change over time, fraudsters expand their horizons, technology is constantly evolving, and new programs are established and old ones change and/or expand. Some organizations have adopted continuous auditing programs, where certain data files are data-mined in real time so that management continually has its hand on the pulse of its payment systems. A Final Word This article is written for management from the perspective of an auditor, who has seen firsthand the power that forensic auditing holds in advancing government accountability. The techniques used by auditors are equally applicable to management, who should always be the first line of defense against fraud, waste and abuse. Jim Durnil had it right in 1983 when he called forensic auditing a management tool. Take the initiative and seize the opportunity that technology provides today to establish a comprehensive fraud program that has as its centerpiece the use of forensic auditing techniques. The public will be better served and their tax dollars better spent if you do. 14 JOURNAL OF GOVERNMENT FINANCIAL MANAGEMENT SUMMER 2008

6 End Notes 1. Internal Control Weaknesses Governmentwide Led to Improper and Abusive Use of Premium Class Travel, GAO , September Thousands of Medicare Part B Providers Abuse the Federal Tax System, GAO T, March 2007; Thousands of Federal Contractors Abuse the Federal Tax System, GAO T, April 2007; Thousands of Organizations Exempt from Federal Income Tax Owe Nearly $1 Billion in Payroll and Other Taxes, GAO , June 2007; and Thousands of Medicaid Providers Abuse the Federal Tax System, GAO-08-17, November Some DoD Contractors Abuse the Federal Tax System, GAO-04-95, February 2004; Thousands of Civilian Agency Contractors Abuse the Federal Tax System with Little Consequence, GAO , June 2005; and Thousands of GSA Contractors Abuse the Federal Tax System, GAO T, March Expedited Assistance for Victims of Hurricanes Katrina and Rita: FEMA s Control Weaknesses Exposed the Government to Significant Fraud and Abuse, GAO T, February 2006; Hurricanes Katrina and Rita Disaster Relief: Improper and Potentially Fraudulent Individual Assistance Payments Estimated to Be Between $600 Million and $1.4 Billion, GAO T, June 2006; Purchase Cards: Control Weaknesses Leave DHS Highly vulnerable to Fraudulent, Improper, and Abusive Activity, GAO T, July 2006 (work was performed jointly with the DHS Office of Inspector General); Hurricanes Katrina and Rita Disaster Relief: Continued Findings of Fraud, Waste, and Abuse, GAO T, December 2006; Hurricanes Katrina and Rita: Prevention Is the Key to Minimizing Fraud, Waste, and Abuse in Recovery Efforts, GAO T, January 2007; Hurricanes Katrina and Rita Disaster Relief: Continued Findings of Fraud, Waste, and Abuse, GAO , March 2007; and Hurricane Katrina: Ineffective FEMA Oversight of Housing Maintenance Contracts in Mississippi Resulted in Millions of Dollars of Waste and Potential Fraud, GAO , November Jeffrey C. Steinhoff, CGFM, CPA, CFE, a member of AGA s Northern Virginia and Washington, D.C. Chapters, retired in January after more than 40 years of federal service. An AGA Past National President, he served most recently as the managing director, Financial Management and Assurance, U.S. Government Accountability Office. SUMMER 2008 JOURNAL OF GOVERNMENT FINANCIAL MANAGEMENT 15