BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION...

36
Dan Kaneshiro Senior Policy Analyst OFFICE OF MANAGEMENT AND BUDGET BRIDGING THE GAP FROM ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and Efficiency (CIGIE) 2019 Federal Audit Executive Council (FAEC) Annual Conference September 6, 2019

Transcript of BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION...

Page 1: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

Dan KaneshiroSenior Policy AnalystOFFICE OF MANAGEMENT AND BUDGET

BRIDGING THE GAP FROM ENTERPRISE RISK MANAGEMENT

TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT

Council of the Inspectors General on Integrity and Efficiency (CIGIE)2019 Federal Audit Executive Council (FAEC) Annual Conference

September 6, 2019

Page 2: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

Value Proposition of ERM: “Two Things”

2

One of the value propositions of Enterprise Risk Management (ERM) is even in early stages of maturity, it can drive the following two things:

1) Risk-Informed Discussions2) Risk-Informed Decisions

PRESIDENT'S - -~---

MANAGEMENT AGENDA

Page 3: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

A-123: Enterprise Risk Management Model

3

Overview:• 7 Cyclical Components

• Establish the Context• Identify Risks• Analyze and Evaluate• Develop Alternatives• Respond to Risks• Monitor and Review• Continuous Risk

Identification and Awareness

• 3 Enterprise Components• Communicate and Learn• Extended Enterprise• Risk Environment/Context

Illustrative Example of an Enterprise Risk Management Model

Communicate and Learn

1. Establish Context

4. Develop Alternatives

2. Identify Risks

3. Analyze and Evaluate

5. Respond To Risks

6. Monitor and Review

Page 4: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

A-123: Fraud Risk Management Requirements

4

• Risk Profiles – Agencies must include an evaluation of fraud risks including: • Fraud as defined by the GAO Green Book.• A risk-based approach to design and implement financial and administrative

control activities to mitigate identified material fraud risks. • Fraud risk may be organized under the operational objectives of the risk profile.• Agencies may determine that they have low likelihood or impact of fraud.

• GAO Fraud Risk Framework – Agencies should adhere to leading practices when: • Establishing entity level controls. • Establishing risk tolerances in disaster situations.

VII. Other Considerations.• Agencies must consider fraud risk in strategic plans and ensure appropriate

officials receive training on fraud indicators and risks related to:• Conducting Acquisition Assessments.• Managing Grant Risks in Federal Programs.

III. Establishing and Operating An Effective System of Internal Control.• Establishing Entity Level Control.

• Managing Fraud Risk in Federal Programs.

PRESIDENT'S - -~---

MANAGEMENT AGENDA

Page 5: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

Integration with ERM: Fraud Working Group

5

FRAUDJoin the FRDAA-WG

PRESIDENT'S - -~---

MANAGEMENT AGENDA

TODAY

Page 6: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

Risk Appetite and Risk Tolerance

6

Risk Appetite

• The broad-based amount of risk an organization is willing to accept in pursuit of its mission/vision.

• Established by the organization’s most senior level leadership

• Serves as the guidepost to set strategy and select objectives.

• Acceptable level of variance in performance relative to the achievement of objectives.

• Established at the program, objective or component level.

• Management considers the relative importance of the related objectives and aligns risk tolerance with risk appetite.

Risk Tolerance

PRESIDENT'S - -~---

MANAGEMENT AGENDA

Page 7: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

Establishing Tolerances in Disaster Situations

7

The GAO Fraud Risk Management Framework includes an example of Risk Tolerance and Risk Matrices in the Context of Natural Disaster Assistance which both aligns and complements current guidance in A-123 and M-18-14.

• A-123 and M-18-14: “Risk tolerance reflects a Federal manager's willingness to accept a higher level of fraud risks and may vary depending on the circumstances of the program.”

• A-123 and M-18-14: “When determining risk tolerances in disaster situations, managers must weigh the program's operational objectives against the objective of lowering the likelihood of fraud.”

PRESIDENT'S - -~---

MANAGEMENT AGENDA

As-<.<"SS

Example of Risk Tolerance and Risk Matrices in the Context of Natural Disaster Assistance When res~ to natural cfs;Jsten. an =1ssi5tancE- pt"C93m h.H various contro4 xtiv.aie to JffVent and detect &--..lld.ffnt appicaticns. fer it!. serv.cM. which indudi! pn:Mding inanci.JI .ass.istanc@ fer t'l!fflporaty housing to p@Ople whose homes_,. d.>maged o, de5l!oyed_ Mln"llers may gen..-.ly defino liN,ir nsk 1011,r:11,c,, os -.,.,., loW" with rog•rd ., providing b!fflpOraty houoing ~ ., po,,nti>ly hudulont applicants Thoroloro. th@y _.• 31 applic.>nts to ll'lde<go a homo in<pOdion to vo,ify d"""'II" ptior to lho prowi<i<>n of any-. <inco lh• Wl<podi(,n< 3N! a eontrol .>etiviy !hat p,o-. • 119' i..01 of conainty tll.lt lhe a<si<tY>Ce i< acru,lyoc,ing 10 those in need

H DW'ft@r. ~ rroy h.Jv@ a hV'ff fraud nsk tolennoe, wch as "'low. raffler th.In ~@ry low. · for IMking p.3yments to po~nblly fr.JucMent iJPplicant:s d the nilnciJ.J.ls liw in ;i seventy darnagtd Mf'll. since individuals "' iwse areas are likefy to h;JIH!! iJl'I urg@fll ne@d" fer tmlpoc.-y hciusng; assistmc@_ In such CSwmstances. managers may weigh rh@ pn,gr,m's o!hor oporaticnal obi@cliv• of upodiliou<ly prnvidirlg .. .,.tan<:@ ag,.,,., lh• objodivo of bwomg tho ikolilood 01 fraud. bKause acliwit:M 10 lowel" tn@ risk rel~ to fraudulenl .Jlll)lic.Jtions. such .;as, conduc:b\g inspections. m.r, c.JUSe

[email protected], service_ GivM a ,ow• fra.\lCI riY ~ .n appos@d to "v@l'Y low.• .:1 ~ may dt!eid@ tc ~ or forego home insptdions. which may M timt,.OOllSlffling cw difficult 10 conduct in in.JCOl!Ssible .Jr@as. Instead,. the manag« may aBoc.rie rHCU"Ces tD a control acilvlly With ii lawll' lewl of cerbmty than c sp@'CbOm,. such as usng gPospatial imagery 10 identify severely d.Jmaged .arus and mate eigbllity determinaoons_

F",gure 3 lllusirat2s concepis desailed so far w~ a two-dmen~ nsk mamx. a oonvnon tedlmque m.111\ligers m.iy

employ 10 visu-Jly plot nus acawd"9 "'thff lilehhood •nd impact_• As notod. lhe spocaicmelhodolc,gym.,._. use lo .sw,;s lraud mks COi) •"'Y· This pa,tiQlbr -,di-,. uwn,j for•~ """'®ols who •re l<nowlodgeable i>bcx,t • pfog-r.-r1, sud'1 as -tlont 1ft • .still' respon.sl>le for mplementng conb'd itetiYIWS, ind for helping rtliin.t~ undersbnd me link be1Wet-n speafic nsb i1nO their mp.x:t.,. The fnl: matrix 1Hus1ra.:es a mk to+er.100e of "very ~ ~ dw second rnatnx sllow> • 1ow'" ml< l<lleraric:e, •> di>als>ed ,n !he exampe -~. S... the '1>esogn ilOd lmplemenr soaion for fw1hor diswSSXJR on ~ respan.s,es 1D fraud ri5b lhai e-ithir exCi!Ed or ara wrttwi the: nsk toleranar:.

Figure 3: Example of TWOsDimensional R,sk Matrices 1/wy low risk tole~ nce

Impact tm~ct

Net TOltr.anC:. ==-==-:-:

~~~g,lt'.Jstr..e8'10Cl, ff"..b .se r-~0R1,a,e~o:1:.ed:on a ~t.ea:c.ae lrl;JI:~ ndlcs~~M>a~r.;liOlrll:l-f'lq!'sl'~U.i!Ul:.lt.at ~ lll tM.ICll'!f'tlffl~Ye1h!ll"O'::tO ~loCICCl'.at1:ll'llioe~7'URUCCf'U,eQ.ffl~l'ci4'-~~1ot1~e'.atl'allllnbblaRf~ ~l'rl._ 'ilbcnt?:Uwtpoc:ea l:19tt1Cr, i-;r-..agcncm~Ol'tm'r..i"'A: 'mC'J~ !WW" IIIPP"ur:t MOIICl:r"~~CCMHr ~ ft:D

1>=.~ n ~ t111t.".l'l:~OCW"e'o!~r .r...aum1r.11.nomm.~r:r«n't!IID:r!$oelftfflnst::li, ~H1ot'•~1nC1cnoo-..e » wuir:,zc~ucn .W',~~tr~ c,,~so!'ne:t.! {~ GAO--W-i'IW0,7.o7l

l ._r$C "'"1s-O ~~fQl',r.-~:;:.ft1J'hl",IOr-::a,, ;\ICl.i-; ,i;n'ey;. • c~«i~~~tricr~'t:q~nQl:~~m'l~lrtc~ a e ttl«Mtorfull )fl'W!!x:taflM !r:!!IIIJO"l'I:~ c:ratldfl~ ~~!il'l'!e'ltlN.t ~CHe l'!,l!>vYlt "'1e1N1Jat.1o1~m~~ 8IOtt l ~fnbt'Wttef~eJ1.MI! /'drct:t~~t:nl)'JQtllhwd~U M:ICOl'lhl~s-=-anai IQfflCJ.

A Frame,<011< tor Man.,_.. ~ Fral.l.l R s l.; n federal Program. I GAO.I~ 14

Page 8: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

8

The House With a Basement and an Attic

Innovation

Compliance

Non-Compliance

Efficiency

PRESIDENT'S - -~---

MANAGEMENT AGENDA

Page 9: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

The Red Iceberg

9

Page 10: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

QuestionsDan Kaneshiro [email protected]

Page 11: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

Together We Can Be More EffectiveIn Addressing Improper Payments

including Fraud

September 6, 2019

BUREAU OF THE •

Fiscal S~!Y.t~c~ U.S. DEPARTMENT 0

Page 12: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

L E A D ∙ T R A N S F O R M ∙ D E L I V E R12

Program Integrity

Focrus of the ~ Antifraud Playbook

~ Enterprise Risk Management (ERM)

Page 13: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

Page 13 L E A D ∙ T R A N S F O R M ∙ D E L I V E R

The Antifraud Playbook Contents

16 Antifraud Plays Organized into Four Phases

https://cfo.gov/fraudprevention

Program lntegrit~f The Antifroud

Plo\:Jbook Phased Approach

Page 14: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

Page 14 L E A D ∙ T R A N S F O R M ∙ D E L I V E R

Play 5 Think Like a Fraudster

Fraud Risk Map Example Fraud creates "leaks" of funding, reducing a vailable f unds for legitimate activities

SCHEME

The payroll staff prolongs the pay of

a n employee who has just left the

agenc!:I, ond alters the payment

record so that the direct deposit

information is replaced with bank

account information of his/her own.

ACTORS

r-----------7

The Nonfinancial Impact of Fraud

Fraud encompasses the loss of an!:Jthing of value, even

non-financial value - such as Pl/ -which can create other risks, such

as reputotionol, compliance, or operational failures and challenges.

L ____ _ ______ ..J

FRAUD RISK ENTRY PO INT

Pa!:Jro/1 Records

Payroll Staff

SC HEME

FRAUD RISK ENTRY POINT Time Sheets

Employees pad time sheets.

usually in small enough

increments to escape the

notice of supervisors.

FRAUD RISK ENTRY POINT

Payro/f System

0 -Employee

ACTORS

0 -SCHEME

The payroll staff creates a fake employee in

the payroll records and falsifies the

payment record so that the direct deposit

information is replaced with bank account

information of his/her own.

ACTORS

Page 15: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

Page 15 L E A D ∙ T R A N S F O R M ∙ D E L I V E R

Play 6 – Discover What You Don't Know15

GAO Guidance

ldentif\j

inherent

fraud

risks

Assess likelihood

ond impact of inherent

risks

Determine

fraud risk

tolerance

Determine

and prioritize

residual

fraud risks

Document

program's

fraud risk

profile

Pla!,Jbook Checklist

D Leverage !-JO~ff Fraud Ri~k Map (Sec PlaH 6) to urdcmtcnd the p otentia l cntrH p•~ints for fraud □ Id entify !jOUr p rf-rf:!rred ri,-;;k o~:::=,e,-:.sm~rH Lf:!chniq1J~ (s~~ K;.,~l Point~) (Jnd -

o G other informution on the cont rds u n d prucest-es i11 pk.ice o Determ ine if a nd hov-.' t he controls a nd processes in place could be exploited or

o:.;i r i:;LJ11wer1ll:!d

o Determ ine the likeliho,:id and impact oi given sch emes being successful

For ex,:im ple, yo1.1 could condl1ct foc1.1.::: groL1ps •Nith stakeholder!: t hat know t he con-:rols and fJroc;er.-i-.:.f:!i-.:. r l;:!k1L1;:d lo 1111:! I ruLJJ ◊(..: hl;:!r111;:!Q ~CJll pl-:;11 Lu 0 :-:;r,,1;:l:,r,, o r1d di~{.:l11:,i-.;. tt,E:;> -:.:<;ri lrol:-:; ~irid

proccsse~ i n p lace rc btod t o t h o fraud !:.cherncB ident ified, t h ~ ~tr:mgth of t hose controlB, cmd Lhi? p.;.::.li?n lial liki?lifwod c111d impzx:L o ( LhP- ,c;ch ic;m-?..s.

0 Doc1,.1ment 1:he 1·esul1:s c t ~our ri:::;k o s:::;e :::;:::;rnen1:. 1--or exo r11ple, !:JOlJ con docu-rr1:=nt finol lik!::!,lihoo d •ond impact sc:::rcs for givc·n f ~aud s,:hcmcs in -ocditbn to an~ identified ccntrob ,sppB in !-jOLir r rOlJd Ri.sk lv1op (See llluslr{Alion) .

D Trcnslcte :he truu<J scherm:'!s into spi::H.:ific ~i~h=.. ~o r ex.ornple, it th1::! truud scheme !:,lOU were di:.cuss.in2 rclotcd too contractor ovcrbilling for services. the specif ic risks ~JCU migh: i :::lc'lt ify ind ude

o C cntroctors bill for g cods. or services t hot wc~c nc•t provided. v..-hich results in finoncio l Ii~,::.::. lo l hl;! OSJl:!r·v!:J

o Ccntroctors overbill for gc,od s o r servicef;; that were p rovided, whic'l re:,ult s in financic l lo,c;s lo l h8 ogar~cu .

l ! lE:!J:;E:!.:::;p E:!vilir..; ri 1:>ko .:::;l,ou ld olisin lo nu~ lrol1ti l::iGlll;!rllt!O 0-s-:::.ei::1:>t>tl, bul t.:.:.111 ou l Ll 1e spt!-:..:i f iv rii:;k a:.so ciot ed •uith the f;;Cfieme. In the examples above. t he r i!:k ,...,e identified wos .;i nonc·a 1 lo$s, bu l i l con be onuLhing fjCJLJ mou di~CU~iS Or id~n Liru in U(;ur o :;;~il':'~~:~men l a~ 0 pCJler"'ili:·JI risk or t he p•o rticular fraud :.chcmo.

D Prioritize r isks b ased on t he rcsu It!:. of t he •:JSsessmont . Fer cxa m pb, !-jOU can p ricritiz.o rk;b:, con bf? lKJSf!d on likf:!l ihocd and impac l ::.corf?.S or ::;;lra tegic p ri~)r itie:,;_

Not e; \·V~ reo;.;u mmemJ focusing o n re~iduul ri!;;k!;; ot t hi!;:; t-iosie becuus~ tho~e ure t he risks !JCU

1r,•·11 be focugod on 11itigoting. sec Kq .i Poi nts.

C Establish thrcBholds above which t he -~omp oncnt (Sec :,la ~ 8) ~ow a r•o a!:.:::C!:.!:.ing focb it i!:: nf:!c:~s::.o r u, (rnm o c:o:~L n r r Hf)1J lo Linne, .sLnnrlr,o in L, Lo n vn id o nd v•A'lfJL ~J:"'. tJ nrP. willin:3 lo o:-:c~pl o r ~h o rF:t i n te r m ~ o t tr,;.11.1c ri:'-:,k.

NGloP.-'. You will noP.-vf:!r 9eL to "t.i?'O" f-aud, .so uou m :)fJ di?c ici? not Lo dediCfJLe rf?Sf;.ur ce,,:, Lo r i-sk,,:, t hot on:! J eernecJ unli kelu or low-impocl

D Document prioritizod risk.:i includin2 kcH p ieces of infonY1o tion such as the likeli hood ::wd

imp•:.:Jct ~cor e , t.he e)rist i-19 c::.mtrols, ur,!d id en : i ti!:1d !:_lo p s. oncJ r!:!:::.ponse - :.,r rniti9ct ion

activitic:. - !;-JCU 1;vil l p ut in place to addrc :i:. the risk.

0 D ocument U,;Nr lro i...JJ ri.:::;k p rul i le l>o:;;ecJ 011 uv ~ir riQk .uleror,vf:!, priori li/eJ riQ<Q -:..ir1J (;-.,t>ru ll

rc~ults cf t he c~3cs~rncnt pro::::c~B.

Page 16: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

L E A D ∙ T R A N S F O R M ∙ D E L I V E R16

Payment Integrity Center of Excellence

VISIONto be a trusted Governmentwide partner to provide actionable business insights and solutions

that transform how Government agencies approach identification, prevention, stopping, and

recovery of improper payments and related fraudulent activity.

GOALSImprove the integrity of Government-wide financial transactions by providing business insight

and solutions that assist Government agencies in identifying, preventing, and recovering improper

payments.

MISSIONto provide Governmentwide partnership, guidance, and solutions that aid in the prevention of

improper payments and fraud, waste and abuse.

VISION

MISSION

GOALS

Page 17: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

L E A D ∙ T R A N S F O R M ∙ D E L I V E R17

Payment Integrity Stakeholders & Services

• Investigative Analysis Support • Case Referrals · • Expert Witness Testimony • Prosecution Support • Training

OPERATIONAL SYSTEMS

STAKEHOLDER ENGAGEMENT & PARTNERSHIPS

/\G!:t\:Cll:S

BUSINESS INSIGHT

DATA ANALYTICS

• Non-Receipt Claims • Reclamations • Misdirected Payments • Automated Enrollments • NACHA training

• Payment and Post Payment Analysis • Data discovery • Manage Check Forgery Insurance Fund • Support check to ACH conversion

CUSTOMER DRIVEN

SOLUTIONS

FUNDS RECOVERY

Page 18: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

L E A D ∙ T R A N S F O R M ∙ D E L I V E R18

Payment Integrity Throughout the Payment Lifecycle

1

2

3

4

5

6

Identify Improper PaymentsIdentify the payment or payee that should not be paid

Prevent (Pre-Award, Pre-Payment)Prevent the award or payment before sending to Treasury

Recall (At time of Payment)Hold for further analysis or cancel payment before disbursement

Recover (Post-Payment)Request recovery of funds from the Financial Institution

InvestigateRefer for investigation if criminal activity is determined

ShareShare outcomes and discoveries with stakeholder community

Identify people who shouldn’t be paid & payments that should not have been made

I

I

I

------------ =--------~~--,",ftL'' -:fi!=~~~:;["~;:-.~!-¥.!~.£~

Page 19: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

L E A D ∙ T R A N S F O R M ∙ D E L I V E R19

Payment Integrity Solution Lifecycle

Repeatable process for development of Payment Integrity Solutions

0 UNDERSTAND BUSINESS PROBLEM

Collaborate with customers, understand business needs

~ DEVELOP CUSTOMER-CENTRIC SOLUTION

~ Develop innovative analytical solutions with business insights

e 0 0

IMPLEMENT SOLUTION

Provide actior1able arid tangible outcomes lhal solve opfm-itional busirn~ss problems.

MEASURE VALUE

Evaluate results and effectiveness of process improvements

IMPROVE

Share best practices witt1 stakeholders tt1rough tn:iining and outreach

Page 20: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

L E A D ∙ T R A N S F O R M ∙ D E L I V E R20

Payment Integrity Info-Apps In Action

Problem:Zip Codes identified as

“at risk” for theft

Solution:Zip Code / Check Number View

Problem:Apartment building

identified as “suspect”

Solution:Address View

Problem:SSN identified as victim of

identity theft

Solution:Payee View

Problem:Increased fraud suspected on

a given RTN

Solution:Bank View

Problem:Hurricane requiring monitoring

of a geographic region

Solution:Agency Geographic View

Info-Apps have

answers!

Agencies and IGs have Payment Integrity Questions…

------.-- -- ...... ...... ......... ........

Page 21: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

L E A D ∙ T R A N S F O R M ∙ D E L I V E R21

Payment Integrity Info-Apps in Action

'

'

Users supply parameters such as date

and event range, agency, to monitor

' Info-App p rovides post payment monitoring and alerts for disaster event

User can drill down for a list of payees with uncashed or

returned checks

Monitor Payees Impacted by Natural Disasters .Beg.in Dale End Date Agt>Ol")' ALC

109ID 112011 11::1 109/1612018 ,~ !ALL v j 01000001 " 02020001 03000003 04000001 04000002 " 10025697

Evc-nl

LORENCE ~e,.,,,~ " July 18 CA. w .. lfiles

Hn~n V¢1Ca!OO Eas:I. Coast Sl0t1n HARVEY

'""" MARIA y

CA Muelsll08S

r 09011(11~ 091(12018 ~\ t\LLAl('S) lh.V.\Ull l lm.ll\.' lL'i 1,,_1..,, __ • ..,,_

~ .-::.:.=-

,.,..

" -'"" f!Jo)

M Ii;»

ii!«

" u u, if

.,.,,,, 1811014

1117-Z

=-Hh!

1!1tt Hl J,111~1

-•~.m " ......

..,.,1. "' ~,,., 11511+ u worm,

11, , 0 ... .. ,~,\\U( , u t11 .. , Lllll!IIIAl l<lll (i'f l~, m , .. ,

I I I S I $ !!f:: ..... ■Mi om - ••01

Check Relums b)' Ruson .. CflWG -, I eb

Page 22: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

L E A D ∙ T R A N S F O R M ∙ D E L I V E R22

High Dollar Payments to High Fraud Risk Financial Institutions

Apply repeatable process and utilize core competencies

Problem

Agency discovered fraudulent large dollar payments disbursed to pre-paid debit cards:• Payees may be unaware of identity theft and payments made on their

behalf• Payments may be misdirected or unauthorized / non-entitled• Agencies may be unaware of high-risk RTN with high percentage of fraud

Solution

Info-App monitors high dollar payments to Financial Institutions with high risk of fraud:• List of FIs maintained through network of agencies and law enforcement• Identified payments over $5K to high-risk FIs• Identified fraud indicators (return reasons, non-receipts claims,

fraudulent enrollments)• Conducted payee profile analysis (Have other agencies paid this person

to the same FI?)

Results

Provided cross governmental payee profile risk analysis:• Conducted pilot with several agencies to test cross-government data

sharing• Analyzed fraud trends (RTN, geographic area, payment types)• Worked with agency stakeholders and IGs to identify, recover, and

investigate

Page 23: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

L E A D ∙ T R A N S F O R M ∙ D E L I V E R23

Common Challenges

Seven Topics of Common Interest

Payments to the Deceased

Inter-Agency Benefit Eligibility

Payee Validation (Banking Info, Address)

High Risk Financial Institutions

Compromised Payees and Accounts

Payee Characteristics (DOB, DOD, Incarcerated, etc.)

Updates to 31 CFR Part 210

How can we partner to solve

Payment Integrity issues? // _______________ _

........... - t"t ~ ---------

w ·-----------• ~

Page 24: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

L E A D ∙ T R A N S F O R M ∙ D E L I V E R24

Deceased Payee Analysis

How can we prevent Payments to the

Deceased?

Data Quality AnalysisEvaluate payees and dates of death to ensure consistent info

Recovery EffortsDetermine if funds were recovered from post payment events

Compile data sourcesUtilize multiple sources of deceased payee data

How big is the problem?Identify payments made after

date of death

Who is paying them?Identify agencies and

payment types

Evaluate eligibility rulesDetermine if payments to

deceased individuals were appropriate

Step 1 – Understand the Business Problem

t

t

t

0 0 0 0

t

t

t

Page 25: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

L E A D ∙ T R A N S F O R M ∙ D E L I V E R25

What’s Next?

Participate in CAP Goal 9 Workgroups• Strategic Data Use• Monetary Loss – Root Causes

Provide subject matter expertise

OMB Workgroups

Initiate Customer Driven ProjectsApply repeatable Payment Integrity Solution LifecycleUtilize core competencies to execute solutionsDemonstrate tangible value through prevention and recovery

Implement Customer Solutions

Quarterly MeetingsReview cross government initiatives

Solicit agency requirementsShare best practices

Agency Partnership Engagement

Page 26: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

DHS Anti-Fraud EffortPartnering to Prevent

and Address USG Fraud

Page 27: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

Established a DHS OIG Anti-Fraud Plan

Launch of Specialized Units

Strategic Efforts:• Create a Culture of Anti-Fraud Measures• Work with DHS to Identify and Assess fraud risks• Implement internal and external mechanisms for

Preventing and Detecting fraud• Insight into Actions: indictments, convictions,

recoveries and future prevention

Questions

Overview

Page 28: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

Mission: Proactively identify, investigate and prosecute fraud

schemes and corrupt activities that pose significant risk and major financial impact to DHS;

Develop expertise in every field office and provide highly specialized tools and other support to the field, enabling INV to conduct high impact fraud and corruption cases around the country.

Anti-Fraud Plan

Page 29: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

Establish and maintain a multi-disciplinary team of fraud experts:

• Special Agents well-versed in conducting complex fraud investigations

• Forensic Auditors/Forensic Accountants• Intel Analysts• Data Scientists• Digital Forensic Analysts• Program Analysts • Admin Support Staff

Strategic Efforts - Culture

Page 30: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

Collaborate with OIG Audits to help identify high-impact fraud and contract corruption (sensitizes OA to fraud schemes) Collaborate with OIG & law enforcement community to

identify latest schemes Review DHS OIG Hotline with “Big Fraud Perspective” Attend fraud conference/forums to identify latest

schemes Meet with DHS stakeholders to identify vulnerabilities Identify data sources that can be mined

Strategic Efforts – Identify & Assess

Page 31: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

Implement a strong fraud awareness effort throughout DHS Partner with DHS Office of Chief Procurement Officer

and Heads of Contracting Activities Establish a close partnership with DHS Suspension and

Debarment Officials Develop Fraud Working Groups within DHSUse analytics to proactively detect significant frauds

and corruption

Strategic Efforts – Prevent & Detect

Page 32: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

Strategically target, build and conduct major fraud and corruption investigations

• Work with law enforcement counterparts and DoJ to facilitate investigations and prosecutions

• Use specialized fraud expertise to enable DHS OIG field offices throughout the U.S.

• Utilize DHS Component investigative organizations to support fraud investigations

Strategic Efforts – Insight into Action

Page 33: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

Case Study

Fusion Team Makeup – $100M benefits fraud

Senior Special Agent– Data Scientist (1)– Digital Forensics Analyst (1)– Intelligence Analyst (2)– Forensic Accountant (2)– Field Agents (multiple)

.... ..,,;

/)1,.-

·, tl y .. .,,,,.. . ~ ' ·

{omelancl "'ecurity

.....

. -;.

Page 34: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

Case Study

Contractor Impersonation

• Fraudsters obtain legitimate solicitations

• Fax/Phone/Email and delivery address are replaced

• Sent to contractors• Fraudsters “accept” and take

delivery of products

Hom el an cl 1ecurity

'•~••11 ~ * F B O r "'~"' ED IZ PPS.GO\ ",..,_,., --,_.., ......... j...,. ... ,..,. v! fJfl

~ ,,..,..., ~.,)) 0

................... .._..__ ............... . } A~ !M'ANrll;al 90"W.• ir-. pi:c:I( ~ POll!ll 1Qf UMOIW.-..r1 ¥!Cl~

10h6W~Ar;tiill,_IJM(>IISUl«;of~f ---~fflltM. Th$ ~~,_.....,..,_o.a_..,«4.,.:s:m:IIJa...,_,•.,.,:eop~

SA~ fl{QSlllA.llOH IS r:lt((: Thoto• •NOFU 11t, ....... . ...._,,,_..._...._.,

.. ,_....,__.,.~ISMlOOW,•tOllf__,.._,.tom.a~~,o ,..,..,.&AMQOlt,Ncall'.Oll9 r.-111•e~tioa,Qllllltllt'Olltl-»t1111creu~• IN,lfO'l'a,._,,.. •••• l!llffi .. .,...tl-...,,., •c.no. n........,.. ..... ICllll .. f"tOar-11 ~ n lJ fREf TO REGISTfJt WI MM p,c, .... ,

@w,~'l(t' ---... ~~­.___...,.. ... .., _,., --© ta,~ lll(f01lh

• Qd: ....... u. ... ,-11 •• • -...S.'Ae.--

?.:;) IIIIW.LWW...U.~" "'--.--~ ....... O..,...t-.• _____ , IF·Ji IL

#90 ___ ....,_

c:-......... o.-.it-110-. ...........

Page 35: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

“There is no kind of dishonesty into which otherwise good people more easily fall than that of defrauding the government.”

- Benjamin Franklin

Questions and Discussion35

Page 36: BRIDGING THE GAP FROM ENTERPRISE RISK ... Fraud...ENTERPRISE RISK MANAGEMENT TO ACHIEVING MISSION OBJECTIVES: FRAUD RISK MANAGEMENT Council of the Inspectors General on Integrity and

Contact Information

Office of Management And BudgetDan Kaneshiro

Bureau of the Fiscal Service Tammie JohnsonManagement and Program [email protected]@fiscal.treasury.gov304-480-7139

James Long