Export-Import Bank: The Bank Needs to Continue to Improve Fraud Risk Management

According to the Bank, it serves as a financier of last resort for U.S. firms seeking to sell to foreign buyers but that cannot obtain private financing for their deals. Its programs support tens of thousands of American jobs and enable billions of dollars in U.S. export sales annually, the Bank says. The Bank is also backed by the full faith and credit of the United States government, meaning that taxpayers could be responsible for Bank losses.

The Export-Import Bank Reform Reauthorization Act of 2015 included a provision for GAO to review the Bank's antifraud controls within 4 years, and every 4 years thereafter. This report examines the extent to which the Bank has adopted the four components of GAO's Fraud Risk Framework—commit to combating fraud; regularly assess fraud risks; design a corresponding antifraud strategy with relevant controls; and evaluate outcomes and adapt. GAO reviewed Bank documentation; interviewed a range of Bank managers; and surveyed Bank employees about the extent to which the Bank has established an organizational culture and structure conducive to fraud risk management.

In managing its vulnerability to fraud, the Export-Import Bank of the United States (the Bank) has adopted some aspects of GAO's A Framework for Managing Fraud Risks in Federal Programs (Fraud Risk Framework). This framework describes leading practices in four components: organizational culture, assessment of inherent program risks, design of tailored antifraud controls, and evaluation of outcomes. As provided in the framework, for example, the Bank has identified a dedicated entity within the Bank to lead fraud risk management. GAO also found that Bank managers and staff generally hold positive views of the Bank's antifraud culture. However, GAO also found that management and staff hold differing views on key aspects of that culture. These differing views include how active the Bank should be in addressing fraud. For example, Bank managers told GAO the Bank's current approach has been appropriate for dealing with fraud. However, about one-third of Bank staff responding to a GAO employee survey said the Bank should be “much more active” or “somewhat more active” in preventing, detecting, and addressing fraud. These and other divergent views indicate an opportunity to better ensure the Bank sets an antifraud tone that permeates the organizational culture, as provided in the Fraud Risk Framework.

GAO found the Bank has taken some steps to assess fraud risk. For example, the Bank's practice has generally been to assess particular fraud risks and lessons learned following specific instances of fraud encountered, according to Bank managers. However, the Bank has not conducted a comprehensive fraud risk assessment, as provided in the framework. The Bank has also been compiling a “register” of risks identified across the organization, including fraud. This register, however, does not include some known methods of fraud, such as submission of fraudulent documentation, thus indicating it is incomplete. Without planning and conducting regular fraud risk assessments as called for in the framework, the Bank is vulnerable to failing to identify fraud risks that can damage its reputation or harm its ability to support U.S. jobs through greater exports. As provided in the framework, managers should determine where fraud can occur and the types of internal and external fraud the program faces, including an assessment of the likelihood and impact of fraud risks inherent to the program.

At the conclusion of GAO's review, Bank managers said they will fully adopt the GAO framework. They said they plan to complete a fraud risk assessment by December 2018, and to determine the Bank's fraud risk profile—that is, document key findings and conclusions from the assessment—by February 2019. Work to adopt other framework components will begin afterward, the managers said. However, they did not provide details of how their efforts will be in accord with leading practices of the framework. As a result, GAO makes framework-specific recommendations in order to enumerate relevant issues and to present clear benchmarks for assessing Bank progress. This complete listing of recommendations is important in light of the Bank's recent embrace of the framework; recent changes in Bank leadership; and expected congressional consideration of the Bank's reauthorization in 2019.

GAO makes seven recommendations, centering on conducting a fraud risk assessment, tailored to the Bank's operations, to serve as the basis for the design and evaluation of appropriate antifraud controls. The Bank agreed with GAO's recommendations, saying it will take steps to improve its fraud risk management activities.

The mission of the Export-Import Bank of the United States (the Bank) is  to support American jobs by facilitating the export of U.S. goods and  services. According to the Bank, it serves as a financier of last resort for  U.S. companies that are seeking to sell to foreign buyers but that cannot  obtain private financing for their deals—thus assuming credit and country  risks the private sector is unable or unwilling to accept. To support these  exports, the Bank offers loan, loan guarantee, and insurance programs.  According to the Bank, its programs support tens of thousands of  American jobs and enable billions of dollars in U.S. export sales annually.

The Bank is backed by the full faith and credit of the United States  government, meaning that taxpayers could be responsible for losses  arising from Bank operations. Since 2011, the Bank’s congressionally  authorized exposure limit—the total amount it may have outstanding in  credit and insurance authority—has increased from $100 billion and now  stands at $135 billion. Total actual exposure as of September 30, 2017,  was $72.5 billion. By number, a large majority of Bank transactions  involve smaller companies and smaller amounts of assistance. By dollar  amount, however, large transactions dominate activity, according to the  Bank.

The Bank requires periodic reauthorization from Congress. Congress last  did so in 2015, after debate that included discussion of fraud risks at the  Bank. As part of its 2015 reauthorization, Congress included a provision  in the statute for us to review the adequacy of design and effectiveness of  the Bank’s antifraud controls, within 4 years of reauthorization, and every  4 years thereafter.

This report examines the Bank’s management of fraud risks in its export  credit activities, by evaluating the extent to which the Bank has adopted  the four components described in GAO’s A Framework for Managing  Fraud Risks in Federal Programs (Fraud Risk Framework). Specifically,  we evaluate the extent to which the Bank has (1) established an  organizational culture and structure conducive to fraud risk management;  (2) planned regular fraud risk assessments and assessed risks to  determine a fraud risk profile; (3) designed and implemented a strategy  with specific control activities to mitigate assessed fraud risks; and (4)  evaluated outcomes using a risk-based approach and adapted activities  to improve fraud risk management.

To evaluate the extent to which the Bank has adopted the components  described in GAO’s Fraud Risk Framework, we assessed Bank fraud risk  management practices against provisions of the framework, which also  incorporates concepts from Standards for Internal Control in the Federal  Government (also known as the “Green Book”). We reviewed Bank  policy and governance documentation, plus other documentation;  reviewed GAO and Bank Office of the Inspector General (OIG) reports on  fraud and fraud risk management topics; and interviewed a range of Bank  managers, at both the senior-management level and those overseeing  relevant Bank operating units. We also surveyed Bank employees about  their perceptions of the Bank’s organizational culture and attitudes toward  fraud and fraud risk management. Specifically, we surveyed all non- senior-management Bank employees (that is, those below the level of  senior vice president, who are responsible for implementing, but not  determining, Bank policy), and obtained a sufficient response rate—73.5  percent—to capture a range of employee views. We present tallies of  survey results for particular questions, as well as individual comments, in  the main text of this report based on their relevance to the respective  subject matter. See appendix I for a full discussion of our scope and  methodology, including our survey methodology. Complete results of our  survey are presented in appendix II.

We conducted this performance audit from October 2016 to July 2018 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Export credit agencies such as the Bank are usually government  agencies, although some private institutions operate export credit  programs on their respective governments’ behalf, according to a Bank  report on global export credit competition. These agencies offer financing  for domestic companies to make sales to foreign buyers, in the form of  products such as loans, guarantees, and insurance for exporters,  according to the Organisation for Economic Co-operation and  Development, which monitors international export credit activity.

The Bank is one of several federal agencies promoting U.S. exports.  According to the Bank, as of December 31, 2016, it had identified 96  export credit agencies worldwide. There have been significant changes in  the role of export credit agencies since 2007 and the global financial crisis  and the European debt crisis, according to the Bank. This is because  ready access to credit before the global financial crisis has given way to  caution in lending among private-sector banks, and also because other  nations have adopted export credit agencies as a tool for national growth.

For fiscal year 2014—which the Bank says is the most recent year in  which it operated with full authority— the Bank reported authorizing  nearly $20.5 billion in financing in support of an estimated $27.5 billion  worth of U.S. exports and nearly 165,000 American jobs. For fiscal year  2017, operating under reduced authority, the Bank reported authorizing  more than $3.4 billion in financing to support $7.4 billion of exports and an  estimated 40,000 jobs.

The Bank, which has about 430 employees, was established under the  Export-Import Bank Act of 1945. Under the act, the Bank must have a  “reasonable assurance” of repayment when providing financing; it must  supplement, and not compete with, private capital; and it must provide  terms that are competitive with foreign export credit agencies. Also  relevant to whether the Bank provides assistance is whether foreign  competitors of the U.S. exporter are receiving export credit assistance  from their home nations, and thus the American exporter would need  assistance to stay competitive. Over time, Congress has directed the  Bank to support certain specific types of exports. Such requirements  include using at least 25 percent of its authority to finance small-business  exports; promoting exports related to renewable energy sources; and  promoting financing for sub-Saharan Africa.

As described in figure 1, to support U.S. exports, the Bank offers four  major types of financing: direct loans, loan guarantees, export-credit  insurance, and working capital guarantees. Bank products generally have  three maturity periods: Short-term transactions are for less than 1 year;  medium-term transactions are from 1 to 7 years long; and long-term  transactions are more than 7 years.

For fiscal year 2017, the Bank reported it had exposure in 166  countries. Figure 2 shows Bank exposure by product type, geographic  region, and economic sector, for fiscal year 2017. Its greatest exposure,  by product type, was in loan guarantees. By geographic region, the  largest exposure was the Asian market. By economic sector, exposure  was biggest in aircraft products.

Because the Bank’s mission is to support U.S. jobs through exports, there  are foreign-content eligibility criteria and limitations on the level of foreign  content that may be included in a Bank financing package. For medium-  and long-term transactions, for example, the Bank limits its support to 85  percent of the value of goods and services in a U.S. supply contract, or  100 percent of the U.S. content of an export contract, whichever is less.  There are also requirements that certain products supported by the Bank  must be shipped only on U.S.-flagged vessels.

Defaults occur when transaction participants fail to meet their financial  obligations. The Bank must report default rates to Congress quarterly. It  calculates the default rate as overdue payments divided by financing  provided. If the rate is 2 percent or more for a quarter, the Bank may not  exceed the amount of loans, guarantees, and insurance outstanding on  the last day of that quarter until the rate falls under 2 percent. As of March  31, 2018, the Bank reported its default rate at 0.438 percent.

The Bank is overseen by a Board of Directors (the Board), which has a  key role in approving Bank transactions, because directors must approve  medium- and long-term transactions of greater than $10 million. Since  July 2015, however, the Board has lacked a quorum (at least three  members), which has precluded approval of these large transactions.

Also due to the lack of a quorum, new transaction activity has shifted  away from larger transactions, according to Bank managers.

The Bank’s total exposure has recently declined by about a third, from  $113.8 billion at the end of fiscal year 2013 to $72.5 billion at the close of  fiscal year 2017, according to the Bank. In part during the period when  the Board has lacked a quorum and been unable to approve large  transactions, the amount of earnings the Bank has transferred to the  Department of the Treasury has declined steadily, according to Bank  figures. Since 2012, the amount the Bank transferred to the Treasury  peaked at $1.1 billion in fiscal year 2013. In successive years, that  transfer fell to $674.7 million in fiscal year 2014, $431.6 million in fiscal  year 2015, and $283.9 million in fiscal year 2016, before reaching zero in  fiscal year 2017. As the Board vacancies have continued, a backlog of  Board-level transactions has grown, reaching an estimated $42.2 billion  as of December 2017.

The Board also has a key role in risk management, with members serving  on the Bank’s Risk Management Committee, which oversees portfolio  stress testing and risk exposure, according to the Bank. Board members  also approve the appointment of the chief risk officer (CRO), the chief  ethics officer, and members of advisory committees.

During the course of our review, in addition to the Board quorum issue,  Bank senior leadership changed. According to the Bank, the following  took place: The acting chairman of the Board and president of the Bank  resigned. The vice chairman, first vice president, and acting agency head  also later resigned. Subsequently, a new executive vice president, chief  operating officer, and acting agency head was named. Following that, an  acting president and Board chairman was named.

Fraud Risk Management Standards and Guidance

Fraud and “fraud risk” are distinct concepts. Fraud—obtaining something  of value through willful misrepresentation—is challenging to detect  because of its deceptive nature. Fraud risk exists when individuals have  an opportunity to engage in fraudulent activity, have an incentive or are  under pressure to commit fraud, or are able to rationalize committing  fraud. When fraud risks can be identified and mitigated, fraud may be less  likely to occur. Although the occurrence of fraud indicates there is a fraud  risk, a fraud risk can exist even if actual fraud has not yet been identified  or occurred.

According to federal standards and guidance, executive-branch agency  managers are responsible for managing fraud risks and implementing  practices for combating those risks. Federal internal control standards call  for agency management officials to assess the internal and external risks  their entities face as they seek to achieve their objectives. The standards  state that as part of this overall assessment, management should  consider the potential for fraud when identifying, analyzing, and  responding to risks. Risk management is a formal and disciplined  practice for addressing risk and reducing it to an acceptable level.

We issued our Fraud Risk Framework in July 2015. The Fraud Risk  Framework provides a comprehensive set of leading practices, arranged  in four components, which serve as a guide for agency managers  developing efforts to combat fraud in a strategic, risk-based manner. The  Fraud Risk Framework is also aligned with Principle 8 (“Assess Fraud  Risk”) of the Green Book. The Fraud Risk Framework describes leading  practices in four components: commit, assess, design and implement,  and evaluate and adapt, as depicted in figure 3.

The Fraud Reduction and Data Analytics Act of 2015, enacted in June  2016, requires the Office of Management and Budget (OMB) to establish  guidelines for federal agencies to create controls to identify and assess  fraud risks, and to design and implement antifraud control activities. The  act also requires OMB to incorporate the leading practices of the Fraud  Risk Framework in those guidelines. In July 2016, OMB published  guidance on enterprise risk management and internal controls in federal  executive departments and agencies. Among other things, this guidance  affirms that managers should adhere to the leading practices identified in  the Fraud Risk Framework. The act also requires federal agencies to  submit to Congress a progress report each year, for 3 consecutive years,  on implementation of the controls established under the OMB guidelines.

The Bank Has Identified a Dedicated Entity to Lead Fraud Risk Management, but Management and Staff Disagree on Aspects of an Antifraud Culture

The Bank has identified a dedicated entity to lead fraud risk management  activities, as called for in the first component of GAO’s Fraud Risk  Framework. In addition, employees generally have a positive view of  antifraud efforts across the Bank, according to our employee survey.  However, we also found that management and staff have differing views  on key aspects of the Bank’s antifraud culture. In particular, we identified  issues inconsistent with the notion of “an antifraud tone that permeates  the organizational culture,” as the Fraud Risk Framework calls for, in  which there is agreement across the organization on key fraud issues and  practices. These areas of disagreement on aspects of the Bank’s  antifraud culture include how active the Bank should be in preventing,  detecting, and addressing fraud; and the adequacy of time for  underwriting, which the Bank says is its primary safeguard against fraud.  Bank managers said that our findings provide an opportunity for additional  staff training on fraud issues.

The Bank Has Identified a Dedicated Entity to Lead Fraud Risk Management Activities

The Bank has identified two managers who serve as a dedicated entity  for leading fraud risk management activities, managers told us. These are  a vice president of the Credit Review and Compliance division (CRC) and  an assistant general counsel in the Bank’s Office of the General Counsel  (OGC). According to Bank managers, they work together under the  direction of the CRO, who was permanently named to the position on a  part-time basis in September 2016. GAO’s Fraud Risk Framework  provides that the dedicated entity can be an individual or a team,  depending on the needs of the agency. Hence, the Bank’s arrangement is  consistent with the framework. Before recently identifying the two  managers as the dedicated entity, Bank managers told us there was no  centralized entity responsible for fraud risk management. Likewise, Bank  written procedures, dated February 2015, for preventing, detecting, and  prosecuting fraud provided there is no “central figure in charge” of such  efforts. The CRO told us that he oversees the two managers in their work  as the dedicated entity.

We also found that the two managers named to form the dedicated entity  are involved in one of the key activities contemplated by the Fraud Risk  Framework. Overall, these activities include serving as a repository of  knowledge on fraud risks and controls; leading or assisting with trainings  and other fraud-awareness activities; and coordinating antifraud  initiatives. The two managers have helped develop and provide training,  some of which is mandatory and targeted directly at fraud issues,  managers told us. The Bank provides semiannual fraud training through  OGC for claims-processing staff, Bank managers also said. Other  training, while nominally not directed at fraud, can nevertheless involve  fraud issues, Bank managers told us. For instance, managers told us  recent training on shipping matters included a review of fraudulent  shipping documentation, which is one way fraud can be perpetrated.

Bank Managers and Staff Express Positive Views of Antifraud Culture, but They Hold Different Views on Key Aspects of That Culture

GAO’s Fraud Risk Framework calls for creating an organizational culture  to combat fraud, such as by demonstrating senior-level commitment to  fighting fraud and involving all levels of the agency in setting an antifraud  tone. Bank managers, in interviews, and staff, in our employee survey,  generally expressed positive views of the Bank’s antifraud culture. For  example, according to Bank managers, the Bank has maintained an  antifraud culture, which they attribute to factors including: fraud and ethics  training; internal controls; tone set at the top by management; a  realization after fraud cases in the 2000s that the Bank cannot be solely  reactive to fraud; and the pursuit of fraud cases by the Bank and its OIG.

Our survey results indicate that Bank employees also generally have a  positive view of antifraud tone across the Bank and attention paid to  combating fraud. For example:

Eighty percent said Bank management in general has established a  clear antifraud tone, to the extent of “a great deal” or “a lot.”

Employees said that based on senior management’s actions,  preventing, detecting, and addressing fraud is “extremely” or “very”  important to the Bank (86 percent).

Staff expressed “a great deal” or “a lot” of confidence in senior  management (76 percent), managers in their division (85 percent),  and their peers (82 percent), to respond to fraud on a timely and  appropriate basis.

Illustrative Comments from GAO’s Survey of Bank Employees  “The Bank has become much more sensitized to the risks of fraud over the last 10  years.”  “The progress made on combating fraud is tremendous. When I started, no one  really cared, and fraud was common…. Now, blatant attempts at fraud are a rarity.”  “There is a high degree of concern at all levels of the Bank regarding potential fraud,  which has resulted in good oversight.”

We also found indications of disagreement among managers and staff  about how active the Bank should be in preventing, detecting, and  addressing fraud. Overall, Bank managers told us, the Bank’s current  approach has been appropriate for dealing with fraud. In particular, an  OGC manager told us that with its underwriting and due diligence  standards—the process for assessing and evaluating an application  before approval—and established fraud procedures, the Bank has an  appropriate strategy to mitigate fraud risks it knows about or envisions  occurring. However, about one-third of survey respondents (35 percent)  said the Bank should be “much more active” or “somewhat more active” in  preventing, detecting, and addressing fraud. Less than half (44 percent)  said the current level of activity should remain the same. Asked whether  what they see as the Bank’s current approach for overseeing fraud and  fraud risk, based on the level of responsibilities of various parties  involved, is the most effective way to do so, about 6 in 10 (62 percent)  said yes. While Bank managers characterized our survey results as  positive, these divergent views indicate room for strengthening antifraud  culture, in light of the Fraud Risk Framework’s goal of achieving shared  views across the organization.

Illustrative Comments from GAO’s Survey of Bank Employees  “The Bank should be much more active in preventing, detecting, and addressing  fraud, because the Bank handles business transactions that involve taxpayers’  money.”  “The Bank needs more funding for technology to help with fraud prevention and  additional Bank staff to spot/monitor fraud.”  “The first- and second-level managers have not done all they could to ensure fraud  prevention. The front-line credit officers are the ones in the best position to detect  fraud and management does not always support it.”  “A more proactive approach to fraud detection, rather than a reactive approach,  would be more prudent. This means trying to sniff out fraud  the preapplication  and underwriting stages.”

Another area where we identified differing views is in the adequacy of  time for underwriting. Preapproval underwriting, and the due diligence  done as part of that process, is the Bank’s main control against fraud,  according to Bank managers and procedures. However, during our  review, Bank managers also acknowledged in interviews that their  business involves potentially competing objectives: performing sufficient  due diligence to prevent and detect fraud prior to approving transactions,  while still processing transactions in a timely manner to meet customers’  needs and achieve the Bank’s mission.

Some comments we received in our employee survey illustrated the  tension between the competing objectives of thorough due diligence and  timely processing of transactions.

Illustrative Comments from GAO’s Survey of Bank Employees  “Detecting fraud is a very high priority, as is appropriate. But overemphasis on  managing that risk would lead to a sense of paranoia when approaching any new  risk.”  “Given all the other obligations we have, even more time spent on fraud detection  means less time for other transaction-related work, with only marginal benefit.”   “Risk is part of the business, and being overly cautious leads to never taking any risk  and consequently not serving the customers.”  “Fraud is important to discuss, but it should not become the main force driving the  organization. There needs to be more of a risk-based analysis when determining  how much to concentrate on fraud.”

According to a Bank report on global export credit competition,  transaction processing time is an important factor in customers’ decisions  to choose the Bank over foreign export-financing agencies. In recent  years, the Bank has significantly reduced processing time. Bank statistics  show that the percentage of transactions completed in 30 days or fewer  grew from 57 percent in fiscal year 2009 to 91 percent in fiscal year 2016.  For 100 days or fewer, the rate has increased from 90 percent to 99  percent over the same period.

Bank managers told us they seek to strike the right balance between the  competing objectives and believe they have done so. For example,  according to the CRC division, the Bank chooses to perform some of its  fraud-detection and mitigation activities after application approval—such  as through reviews of transactions selected on both a random and risk- based basis—in order to not unduly delay processing applications. Under  Bank practices, document review can be abbreviated, and, after  underwriting approval, lenders may accept certain transaction  documentation, such as invoices or shipping documents, at face value  unless something appears suspicious, managers told us. In the particular  case of processing short- and medium-term transactions, the Bank is alert  to “red flag” items—known warning signs, such as use of nonbank  financial institutions, or participants that are trading entities rather than  original equipment manufacturers, managers told us. But otherwise, the  Bank limits the extent of its application investigation, according to the  Bank’s OGC. In particular, as the Bank’s OGC told us, the Bank is  required by law to make medium-term offerings a “simple product.”  There is pressure both legally and commercially to process transactions  quickly, because, otherwise, an exporter could lose its business  opportunity, the Bank’s OGC told us. In many of these transactions, both  the exporter and buyer are small, the OGC also said, so it is more difficult  to get information. As a result, according to the OGC, the Bank relies  more on self-reporting by transaction parties. For these reasons, the  Bank’s OGC told us, for both short- and medium-term products, there are  not as many “inherent checks and balances” in the process. We note that  based on previous GAO work, self-reporting can present an opportunity  for fraud.

However, our survey results suggest that significant portions of Bank staff  question whether the Bank is striking the right balance in providing  sufficient time for preapproval review of transactions. Specifically, Bank  staff raised concerns about the amount of time dedicated to the key task  of preapproval review of applications. For each of the Bank’s three major  product maturity categories, we asked whether the application process  provides enough time for Bank staff to conduct thorough due diligence on  potential fraud risks. For short-term products—which Bank managers  said, as a category in general, have been the most susceptible to fraud  recently—less than half (47 percent) said there is “always” or “usually”  enough time; and about 20 percent said there is “sometimes,” “seldom,”  or “never” enough time. For both medium- and long-term products,  about 6 in 10 (56 percent and 61 percent, respectively) said the  application process “always” or “usually” provides enough time. As  noted, while Bank managers characterized our survey results as positive,  these views indicate an opportunity for the Bank to further set an antifraud  tone that permeates the organizational culture.

Illustrative Comments from GAO’s Survey of Bank Employees  “More due diligence should be required in order to qualify for the U.S. government’s  support.”  “The Bank is more concerned with increasing sales than preventing fraud.”

Our survey also identified that while nearly half (48 percent) of  respondents rated fraud as a “very significant” or “significant” risk to the  Bank, there may be misunderstanding among employees on where  responsibility lies for fraud risk management. We asked employees to  describe the extent to which each of six offices or groups—OGC, the  OIG, the Office of Risk Management, Bank senior management, all bank  staff and managers collectively, or others—are responsible for overseeing  fraud risk management activities at the Bank. The OIG received the  highest response, with 73 percent saying it has “a great deal of  responsibility.” Bank managers told us this result is to be expected,  because staff associate issues of fraud with the OIG. However, these  survey results suggest confusion—lack of a shared view, from the  standpoint of antifraud culture—around the OIG’s role, which includes  investigating suspected fraud, rather than overseeing the Bank’s fraud  risk management activities. The OIG acknowledged to us that its role  does not include responsibility for overseeing fraud risk management  activities at the Bank.

Asked about our findings overall, Bank managers told us they view our  survey results as positive because the results indicate employees have a  strong awareness of fraud and the risk it presents to the Bank. For  example, regarding the results about the role of the OIG, they noted that  staff are actively encouraged to report suspected fraud through  channels—first to OGC, for subsequent referral to the OIG. Thus,  employees would understand the OIG as being responsive to fraud, and  Bank managers believe this likely accounts for the survey result.

Nevertheless, they said, our survey results provide an opportunity for  more detailed training, to better communicate with staff. In particular, the  Bank managers told us such training would focus on the Bank’s approach  to fraud, plus the Bank’s organizational structure for addressing fraud.  The training will also clarify that the OIG has an investigative function as  well as an auditing function, they said. Our employee survey results  underscore the potential benefit of further fraud training. Among  respondents who said they have received fraud or fraud risk-related  training provided by the Bank in the last 2 years, three-quarters said it  was “extremely” or “very” relevant to their job duties. Nearly two-thirds (63  percent) said it was “extremely” or “very” useful to their duties. Overall,  about half (52 percent) of respondents said fraud or fraud risk-related  information obtained from management, or any Bank resources, has  increased their understanding of fraud “a great deal” or “a lot.”

The differences we identified in perceptions of fraud risk and fraud  management responsibilities do not, by themselves, implicate the  performance of any particular antifraud control, or suggest that any  additional control is necessary. However, to the extent views on  significant antifraud issues, such as how active the Bank should be in  preventing, detecting, and addressing fraud, or adequacy of time devoted  to underwriting, differ across the organization, the Bank cannot ensure  that it is best setting an antifraud tone that permeates the organizational  culture, as provided in the Fraud Risk Framework. In particular, as the  framework describes, antifraud tone and culture are important parts of  effective fraud risk management. These elements can provide an  imperative among peers within an organization to address fraud risks,  rather than have the organization rely solely on top-down directives.

The Bank Has Taken Some Steps to Assess Known Fraud Risks but Has Not Conducted a Comprehensive Fraud Risk Assessment

The Bank has taken some steps to assess fraud risk. However, it has not  conducted a fraud risk assessment, tailored to its operations, or created a  fraud risk profile, both as provided in the second component of GAO’s  Fraud Risk Framework. Further, under the framework, recent changes  in the Bank’s operating environment indicate a heightened need to do so.  We also found that although the Bank has been compiling a “risk register”  intended to catalog risks it faces across the organization, this compilation  does not include some known fraud risks, indicating that the Bank’s  assessment is incomplete. In addition, we found that while the Bank has  adopted a general position on the degree of risk it will tolerate, its current  risk tolerance is not specific and measurable, as provided by federal  internal control standards. Bank managers told us they will revise their  fraud risk management practices to fully adopt the Fraud Risk  Framework.

The Bank Has Taken Some Steps to Assess Known Fraud Risks but Does Not Conduct Regular, Comprehensive Fraud Risk Assessments

A leading practice of the Fraud Risk Framework calls for agencies to  conduct fraud risk assessments at regular intervals, as well as when there  are changes to the program or operating environment, because  assessing fraud risks is an iterative process. Managers should  determine where fraud can occur and the types of internal and external  fraud the program faces. This includes an assessment of the likelihood  and impact of fraud risks inherent to the program; that is, meaning both  fraud risks known through fraud that has been experienced, as well as  other fraud risk that can be identified, based on the nature of the program.

According to a Bank report, FY2016 Enterprise Risk Assessment, the  Bank is more susceptible to fraud, due to “the nature of the Bank’s  mission, the high volume of transactions it executes, and the need for  various groups within the Bank to work together to successfully defend  against fraud.” The Bank’s short- and medium-term products are more  susceptible to fraud, according to Bank managers. Other indicators of  fraud, according to the managers, include domestic geography,  transactions that involve truck shipments; international geography, since  conducting adequate due diligence can be more difficult in remote  locations; and when there are smaller, less well-known parties on both  sides of the transaction.

In this environment, the Bank has taken some steps to assess known  fraud risks. Generally, the Bank’s practice has been to assess particular  fraud risks and lessons learned following specific instances of fraud  encountered, according to Bank managers. Because it has focused on  fraud already encountered, the Bank’s practice has not been of the  comprehensive nature provided in the Fraud Risk Framework.

As an example of its current approach, according to Bank managers, the  Bank experienced “significant fraud” in the early 2000s. This was chiefly  in the medium-term program, and to a lesser degree, the short-term  program, the managers said. As a result, the Bank made changes that  reduced the fraud significantly, they said. Otherwise, according to the  CRO, fraud has been addressed within product lines, as appropriate.  Under its current approach, the Bank’s risk assessments do not include  areas where fraud has not already been detected, according to Bank  managers. They acknowledged that approach could expose the Bank to  fraud risks for activities not yet discovered.

A key difference between the Bank’s current approach, as illustrated  above, and leading practices as provided in the Fraud Risk Framework,  can be seen in how fraud risks are assessed. As described later, the  Bank has been compiling risks it faces across the organization, with fraud  risk among them. These efforts have focused on soliciting views of Bank  staff. By contrast, the framework envisions a more comprehensive  approach. Effective fraud risk assessments identify specific tools,  methods, and sources for gathering information about fraud risks,  according to the framework. Among other things, this can include data on  trends from monitoring and detection activities. Under the framework,  programs might develop surveys that specifically address fraud risks and  related control activities. It may be possible, the framework suggests, to  conduct focus groups, or engage relevant stakeholders, both internal and  external, in one-on-one interviews or brainstorming about types of fraud  risks.

Thus, we found, the Bank’s current process for assessing fraud risk has  been generally reactive and episodic, rather than regularly planned and  comprehensive. Rather than adopt a more proactive approach, the Bank  has instead relied on the normal processing and review of transactions— which build in experience with previous fraud schemes—as the truest test  for identifying fraud issues or concerns, according to Bank managers.

Recent changes in the Bank’s program and operating environment also  heighten the need for comprehensively assessing fraud risks, according  to the Fraud Risk Framework. Such changes include the Bank’s inability  to approve large transactions due to the absence of a quorum. This has  meant transaction activity has shifted to smaller transactions, which carry  a greater risk of fraud, according to bank managers. Additionally,  Congress recently mandated that the Bank increase its focus on small  businesses, whose transactions present a different risk profile than those  of the Bank’s large customers, according to Bank managers. Further,  the Bank’s transaction backlog could also become an issue in the future.  If a Board quorum is restored, there could be pressure to process  transactions quickly in order to clear the backlog, which could undermine  the quality of the underwriting process, according to documentation from  the Office of the CRO.

According to our review, the Bank’s current antifraud controls further the  goal of protecting Bank resources and providing “reasonable assurance”  of repayment. However, without planning and conducting regular fraud  risk assessments, as identified in GAO’s Fraud Risk Framework, the  Bank is vulnerable to not identifying material risks that can hurt  performance or its ability to fulfill its mission. As Bank managers acknowledged to us, the Bank faces acute reputational risk if new  instances of large or otherwise significant fraud emerge.

The Bank Has Been Working to Identify Major Organizational Risks, but Its Identification of Fraud Risks Is Incomplete

The Bank has taken some steps in an effort to identify, manage, and  respond to risks, including those related to fraud. It has been developing  a “risk register”—a compilation of risks across the organization. It has  also recently completed an “enterprise risk assessment” through an  outside consultant. However, these efforts do not reach the full extent of  the relevant leading practices of the Fraud Risk Framework. Specifically,  the framework call for agencies to identify inherent fraud risks of a  program, examine the suitability of existing fraud controls, and then to  prioritize “residual” fraud risks—that is, risks remaining after antifraud  controls are adopted.

For the risk register, individual business units contribute items, such as  indicating types of risk and likelihood, and methods to mitigate the risk.  The register, through the Bank’s Office of Risk Management, notes the  risk of fraudulent deals generally, characterizing the likelihood as  “somewhat likely,” but having the possibility of “major” financial,  operational, legal, and reputational impacts. However, particular methods  of fraud known to the Bank through experience—such as applicants  submitting fraudulent documentation—are absent thus far. This indicates  the register is incomplete, from the standpoint of identifying where fraud  can occur and the types of internal and external fraud risks the program  faces, as provided in GAO’s Fraud Risk Framework. Other inherent fraud  risks, such as those posed by the Bank’s more limited understanding of  transactions made when it delegates lending authority to other  institutions, are also absent from its risk register. Work continues on  developing the risk register, Bank managers told us. However, adoption  of the risk register has been delayed, due to a reorganization of Bank  management and the vacancies on the Board. Without a more  comprehensive assessment of inherent fraud risks, the Bank cannot be  assured of the extent to which existing controls effectively mitigate  inherent risks.

According to the chief risk officer, the Bank’s risk register is part of a more  wide-ranging “enterprise risk management” strategy, which includes  documenting a range of risks across the organization, including fraud. In  March 2017, as part of this strategy, the Bank completed the enterprise  risk assessment. Based on assessments by senior Bank managers, it  identifies fraud risk—defined as a “significant and high-profile fraud”  conducted against the Bank—as one among a range of risks facing the  Bank. Consistent with Bank managers’ representations to us, the  enterprise risk assessment ranks the likelihood of fraud risk as low  against other risks the Bank faces—fourth out of five among “operational”  risks, and 24th out of 26 total identified risks. Figure 4 depicts how the  Bank evaluates these operational risks, in a schematic pairing likelihood  of the event with expected impact if they were to occur. In this context, fraud risk is the least prominent risk among the top operational risks  identified.

In addition to operational risks, the enterprise risk assessment also details  six high risks facing the Bank overall. Among them are new or unfamiliar  deal structures, which may present increased repayment risk; and doing  business in new and unfamiliar technologies, sectors, and industries  where the Bank has limited experience. Although fraud is not explicitly  identified as a risk, we note these new activities could provide an opening  for those seeking to commit fraud.

During our review, Bank managers maintained that the enterprise risk  assessment represents a “comprehensive fraud risk assessment”  undertaken by the Bank. They also, however, acknowledged that this  assessment does not contain all the elements of a fraud risk assessment  as described in GAO’s Fraud Risk Framework. For instance, as noted,  the Bank has not conducted a comprehensive assessment of inherent  fraud risks, tailored to its operations.

We note that because, as described above, the Bank has not undertaken  a fraud risk assessment as envisioned by the Fraud Risk Framework, its  ranking of fraud risk compared to other risks may change after it has  completed such an assessment. This is because a comprehensive  assessment may identify new fraud risks or produce revised assessments  of known fraud risks, both of which could affect relative rankings of other  risks.

The Bank’s Fraud Risk Tolerances Are Not Specific and Measurable

A leading practice of the Fraud Risk Framework calls for agencies to  determine fraud risk tolerance. Further, federal internal control  standards state that managers should consider defining risk tolerances  that are specific and measurable. In addition, under the framework,  tolerance cannot be determined until the agency has identified inherent  fraud risks and assessed their likelihood or impact.

As part of its overall risk management activities, the Bank has adopted a  general position on its fraud risk tolerance. Specifically, Bank managers told us that, by its nature, the Bank accepts more risk than the  commercial sector; and some level of fraud is to be expected because it  is not reasonable to eliminate all fraud in its programs. The instances of  fraud encountered by the Bank in recent years have centered on small  exposures, according to bank managers. Thus, the current level of fraud  the Bank experiences is “defensible,” given the Bank’s mission and  number of transactions it undertakes, according to the CRO. Bank  managers said that fraud activity has steadily declined over the last  decade, based on what they cited as fraud indicators that are reviewed by  the Bank’s OGC.

Bank managers also pointed to claims as another indication of declining  fraud activity. Transaction participants file claims for losses covered under  Bank loan guarantee and insurance products, such as if a borrower fails  to make required payments. The Bank considers fraud to be a subset of  transactions that result in claims, and managers cited declining claims  activity over the last decade as an indirect measure of fraud activity.  Table 1 shows a history of claims paid for fiscal years 2008 through 2017.

Overall, Bank managers told us that in light of the decline in fraud they  described, the task facing the Bank is to make sure that staff do not lose  their focus on fraud and become too comfortable.

We asked the Bank to provide statistics supporting the claimed long-term  decline in fraud activity, based on fraud indicators. In response, managers  told us the indicators are actually not “precise or numerical measures.”  Instead, OGC noted the office is aware of fraud activity through  “consultations and  general sense of day-to-day business.” As for  claims, we note that not all fraud activity may result in claims.  Consequently, an analysis of claims alone may not reveal a complete or  accurate view of fraud activity. In addition, although Bank statistics we  reviewed show a decline in number of claims filed from fiscal year 2014  through nearly the end of fiscal year 2017, the decline is likely attributable  to the lapse in the Bank’s authority in fiscal year 2015, according to a  Bank report.

While the Bank has adopted a general position on its fraud risk  tolerance—that the current level of fraud is defensible, given the Bank’s  mission—its current risk tolerances are not specific and measurable.  Without more specific and measurable risk tolerances, the Bank cannot  be assured of the extent to which any fraud risks exceed the Bank’s fraud  risk tolerance. For example, a measurable risk tolerance could express  willingness to tolerate an estimated amount of potentially fraudulent  activity, given resource constraints in eliminating all fraud risks.

The Bank Will Revise Its Practices, According to Managers

After initially telling us that the Bank’s fraud risk management practices  are working well and do not need modification, Bank managers later told  us they will revise their approach. They now plan to conduct periodic  fraud risk assessments and assess risks to determine a fraud risk profile,  as provided in GAO’s Fraud Risk Framework, they said. Asked what  prompted the changes, the CRO attributed them to our inquiries plus the  Bank’s own growing experience with enterprise risk management. Bank  managers also noted that since 2013, there has been an evolution in  Bank antifraud controls, as part of what they refer to as a continuous  improvement process.

Specifically, the Bank’s new effort will include a range of new fraud  management activities, according to the managers, starting with a fraud  risk assessment and also including determining a fraud risk profile, on a  priority-risk basis. The Bank also plans to identify residual risks and  mitigating factors. In addition, according to the managers, this new work  in addressing fraud risk is planned to include developing specific fraud  risk tolerance or tolerances, with a metric for measuring such tolerance.  As for implementation of the planned new approach, Bank managers  stated they plan to complete a fraud risk assessment by December 2018  and to determine the Bank’s fraud risk profile by February 2019.

However, Bank managers did not provide us with documentation  describing in detail how they plan to ensure their fraud risk assessments  and fraud risk profile are consistent with GAO’s Fraud Risk Framework.  For example, we requested documentation of any specific plans to adopt  any of the four components of GAO’s framework. Bank managers told us  they plan to work with an outside consultant, and provided an outline of  planned activities. However, the information did not describe how the  Bank will ensure its risk assessments and profile include a full range of  inherent fraud risks, including known fraud risks that are absent from its  current risk register. Similarly, the managers did not provide  documentation describing how the Bank’s fraud risk assessments and  profile will include risk tolerances that are specific and measurable.

Our employee survey results highlight the importance of the Bank’s  planned new approach. In comments, some respondents noted the  changing nature of fraud, underscoring the importance of taking a wider,  more proactive approach to fraud, which the Fraud Risk Framework  encourages.

Illustrative Comments from GAO’s Survey of Bank Employees  “There are tricks that financial fraudsters would use that many of our staff are  unaware of.”  “The biggest risk is that we cease to see fraud controls as an ever-evolving process.”  “Types of fraud are constantly changing.”  “To assume that thieves don’t evolve is inane, and to assume that you have the best,  most evolved mechanisms for combating fraud is presumptuous.”

Given the importance, under a more proactive approach, of being able to  identify and react to new forms of fraud, we also asked employees how  well they believe Bank senior management understands new or changing  ways of attempting or committing fraud. About two-thirds (67 percent)  said senior Bank management understands “very well” or “for the most  part,” with the remaining respondents undecided or believing otherwise.

The Bank Has Instituted Some Antifraud Controls but Not Developed a Strategy Based on a Fraud Risk Assessment, and Has Opportunities to Improve Fraud Awareness and Data Analytics

The Bank has instituted a number of antifraud controls but has not  developed an antifraud strategy based on a fraud risk profile, or  implemented specific control activities to achieve such a strategy. This is  because, as discussed earlier, it has not yet completed a fraud risk  assessment tailored to its operations. As described in the third  component of GAO’s Fraud Risk Framework, agencies should design and  implement a strategy with specific control activities to address risks  identified in the fraud risk assessment. We also found the Bank has  opportunities to improve antifraud controls through greater fraud  awareness and use of data analytics. Leading practices for fraud risk  management under the third component include fraud awareness and  data analytics activities, which can enhance the agency’s ability to  prevent and detect fraud.

The Bank currently employs a number of antifraud controls, both before  and after transaction approval, which Bank managers told us include:

Specific antifraud activities within individual business units, as they  operate their respective programs.

Review of transactions, including checking for fraud activity, following  transaction approval.

Later-stage review, such as examinations and recommendations by  the Bank’s OIG.

Preapproval antifraud efforts: Underwriting is the initial step in  preventing fraud, and underwriters have a heightened awareness of fraud  and irregularities, Bank managers told us. Under the Bank’s antifraud  procedures, underwriters in the business units should be aware of fraud  risks in their transactions and be alert to indications of fraud. Prior to  approval, transactions and their participants go through several  evaluations. These can assist underwriters in preventing fraud, according  to Bank procedures. Figure 5 describes selected preapproval  evaluations.

According to the Bank, additional preapproval measures include  analyzing lenders, focusing on sufficiency of due diligence or what appear  to be a high level of claims; requiring collateral on most medium-term  transactions; not allowing online applications to proceed unless applicants  provide required information; and using a two-step approval process, in  which both the underwriter and the underwriter’s supervisor must approve  certain transactions.

Postapproval antifraud efforts: Postapproval monitoring is generally not  directed specifically at fraud, but plays a key role in fraud detection.  Specifically, Bank managers told us that the Bank typically learns of fraud  through the claims process—that is, after transactions are approved.  Figure 6 describes postapproval monitoring.

Later, third parties, such as the Bank’s OIG, review transactions and  operations, the chief risk officer told us. The Bank has developed a policy  and expectations for employee conduct in matters of possible fraud,  imposing a duty to report any “suspicion” of fraud to OGC or the OIG. In  particular, OGC is not selective about what information it passes to OIG,  a manager told us—anything about Bank transactions is referred, no  matter the strength of the evidence.

In our employee survey, some respondents expressed concern that there  is reliance on postapproval monitoring, versus greater scrutiny at the time  of application.

Illustrative Comments from GAO’s Survey of Bank Employees    The current division of responsibilities “is not the most effective way for the Bank to  oversee fraud and fraud risk, as responsibility needs to be given to the teams on the  front end—such as the individual relationship managers and loan officers—not on  the back end.”    The current arrangement “seems to be more of an after-the-fact approach to  potentially (if reluctantly) detecting fraud than any proactive encouragement to  actively prevent fraud.”

Although the Bank has instituted these pre- and postapproval antifraud  controls, they may not provide the most effective protection available.  According to GAO’s Fraud Risk Framework, the leading practice is for  agencies to design and implement antifraud controls based on a strategy  determined after performing a fraud risk assessment and creating a fraud  risk profile. However, as previously discussed, the Bank has not yet  completed such an assessment to determine such a profile.  Consequently, the Bank cannot develop an antifraud strategy and  associated controls that meet the leading practice until it has completed a  fraud risk assessment and documented the results in a fraud risk profile.

As noted earlier, Bank managers told us they now recognize the need to  conduct assessments and develop a fraud risk profile for the Bank, and  that they plan to complete this work by February 2019. They further told  us that, after conducting a risk assessment and developing a fraud risk  profile, they plan to design and implement antifraud controls as may be  indicated by the assessment, in keeping with the framework’s third  component. Until the Bank creates an antifraud strategy based explicitly  on a fraud risk assessment and corresponding fraud risk profile, and has  designed and implemented specific control activities to prevent and detect  fraud, it is at risk of failing to address fraud vulnerabilities that could hurt  its performance, undermine its reputation, or impair its ability to fulfill its  mission.

The Bank Has Opportunities to Improve Fraud Awareness among Its Staff

As provided in GAO’s Fraud Risk Framework, increasing awareness of  potential fraud schemes can serve a preventive purpose, by helping to  create a culture of integrity and compliance, as well as to enable staff to  better detect potential fraud. The Bank currently takes some steps to  share information on fraud risks across the institution, through a variety of  mechanisms, but it has opportunities to further improve information  sharing to build fraud awareness.

Training, cited earlier, is a leading practice of the Fraud Risk Framework,  by which an agency can build fraud awareness. In particular, the  framework cites requiring that all employees, including managers, attend  training when hired and then on an ongoing basis thereafter. As  discussed earlier, the Bank now conducts some training, and Bank  managers told us they see our survey results as an opportunity to provide  additional training. By extending training requirements to all employees,  the Bank can seek to build awareness as broadly as possible, and with  that, further reinforce antifraud tone and culture. Currently, according to  our assessment of information the Bank provided, it does not offer  dedicated fraud training across the organization, for all employees and on  an ongoing basis.

Another way to build fraud awareness is information sharing. For  example, a manager in the Bank’s OGC told us he monitors fraud activity  and communicates relevant fraud-related information to other units in the  Bank, based on considerations such as whether a situation could be  repeated in other cases. However, there are limitations in information- sharing. For example, the Bank’s OGC told us it restricts how widely it  shares information on parties placed on an internally generated “watch  list” of parties that should be scrutinized. The Bank also cannot share  information provided by OIG on parties in a confidential law enforcement  database as being under investigation, managers said, because those  parties may not know they are under investigation. The reasons for such  caution, according to managers, include the Privacy Act of 1974 and  fear of creating a “de facto debarment list” absent any formal findings of  fraud. In addition, CRC division managers told us that when the division  discovers fraud-related information, it communicates such information to  appropriate Bank staff.

Despite concerns, we found there are opportunities for greater  compilation and sharing of information, and employees said in our survey  that they believe wider sharing of fraud-related information would be  beneficial to building fraud awareness and performing their duties. For  example, one way of boosting fraud awareness would be if Bank  managers comprehensively tracked referrals of suspected fraud matters  to the OIG and shared case outcomes with Bank staff, Bank managers  told us. However, Bank managers told us they do not currently maintain  and share such information on cases of suspected fraud referred to the  OIG. Relatedly, GAO’s Fraud Risk Framework notes the opportunity for  an agency to collaborate with its OIG when planning or conducting  training, and promoting the results of successful OIG investigations  internally.

Some program managers also told us maintaining a repository of known  fraud cases could aid in compliance and transaction approvals, but the  Bank does not maintain and share this information with staff. In addition,  as Bank managers acknowledge, compiling and maintaining information  collected through the Bank’s database checks on transaction participants  could serve as a library of useful information. However, Bank managers  told us they do not currently maintain and share such information.

In our survey, we asked employees whether Bank management provides  any information on outcomes of fraud cases involving the Bank or Bank  staff. Nearly half of respondents (49 percent) said no. About a third (35  percent) said yes. Among a subset of employees who reported that their  job duties include direct responsibility for fraud matters, the “Yes” figure  was higher but still less than a majority (41 percent). Some survey  respondents noted lack of information-sharing about fraud practices and  case outcomes, including that staff processing transactions must rely on  personal memory for fraud issues that arose in previous transactions.

Illustrative Comments from GAO’s Survey of Bank Employees  “In some cases, there is no way to track bad actors or suspected fraudsters unless  someone working the new transaction remembers that there was an issue with the  actor in a previous transaction.”  “Management seems to not want to discuss any fraud with staff. Instead, they should  use the opportunity to educate staff about fraud that occurs and show the  consequences that result. They need to be more open.”  “While the Bank has put a lot of best practices in place, more could be done to more  regularly communicate to staff about changing practices in committing and detecting  fraud.”  “Outcomes are rarely relayed to staff.”

Underscoring the value of sharing information, our survey also found that  when Bank management does share fraud-related information, Bank staff  tend to find it useful in carrying out their duties. For those reporting that  management does share fraud information, more than half of respondents  (54 percent) said they found such information was “extremely” or “very”  helpful in their job duties. Similarly, for those who reported they can  readily access fraud-related information on their own from internal Bank  resources, nearly two-thirds (63 percent) said the information was  “extremely” or “very” helpful.

In response to our inquiries, Bank managers said they plan to evaluate  the feasibility of maintaining and sharing case outcome and database  query information. In addition, they said OGC is exploring how it might  share more fraud-related information, but in a protected way. In particular,  the Bank wants to be able to share information on “integrity factors,”  especially at the underwriting level. One way to do this might be  distribution of fraud case studies as a refresher for staff, they said.

Until the Bank makes greater efforts to share information on known fraud  schemes or bad actors, the Bank forgoes the opportunity, as described in  the Fraud Risk Framework, to build staff awareness that could enhance  antifraud efforts in these ways. For example, by not sharing the outcomes  of suspected fraud matters referred to the OIG, the Bank forgoes the  opportunity to build awareness through lessons learned from actual  cases, which could give staff especially relevant insight into future  attempts at fraud.

The Bank Has Opportunities to Improve Data Analytics to Fight Fraud

GAO’s Fraud Risk Framework cites data analytics as a leading practice  for preventing and detecting fraud; in particular, to mitigate the likelihood  and impact of fraud. We found the Bank makes limited use of data  analytics for antifraud purposes. For example, it conducts analyses of  claims cases, according to Bank managers, and, as noted earlier,  considers fraud to be a subset of transactions that result in claims.  Documentation of such activity provided to us by the Bank includes  analyses and statistical summaries, such as number and types of claims  filed, and tallies of claim decisions (for example, approved, denied).

However, the Bank does not perform data analytics, which are additional  leading practices described in the Fraud Risk Framework.

According to one manager, the Bank does not perform data analytics on  its transaction-related data because the Bank OIG does not provide a  specific transaction number (or “deal number”) necessary to link fraud  cases it successfully pursues to the specific transactions from which the  OIG action arises. Without that link, the Bank cannot distinguish  transactions proven to be fraudulent from other, nonfraudulent  transactions in its data, the Bank manager said. The link would be  necessary for data-analytics purposes, the manager said. This inability to  tie proven fraud cases to individual transactions, based on inability to  obtain the key identifying information from the OIG, is a significant  weakness in the Bank’s postapproval transaction monitoring, the  manager further said.

The Bank and its OIG take different views on this linking information. The  Bank has asked the OIG to provide these specific transaction numbers in  an effort to link proven fraud cases to its transaction data, according to  one Bank manager. OIG officials, meanwhile, told us they always notify  the Bank when a conviction is made, and provide as much information as  possible and appropriate under the circumstances, including company  name and individual name. OIG officials also noted that, even without the  specific transaction number the Bank requests, the Bank should  nevertheless be able to use OIG-provided case data to search its own  transaction files and successfully locate corresponding transactions.

In response to our inquiries, Bank managers said they are now  considering a move into data analytics, including predictive analytics, to  guard against fraud. However, until the Bank has a feasible and cost- effective means of linking OIG cases to specific transactions, its ability to  use data-analytics for antifraud purposes will be limited. Without the  ability to make use of data-analytics, the Bank forgoes the opportunity to  develop a best-practices antifraud tool that could aid in identifying  potential fraud retrospectively, on transactions already approved, or  prospectively, in advance of approval.

The Bank Has Opportunities to Improve Monitoring and Evaluating Outcomes of Its Fraud Risk Management Activities

The fourth and final component of GAO’s Fraud Risk Framework calls for  ongoing monitoring and periodic evaluations of the effectiveness of  antifraud controls. This monitoring and evaluation should be from the  specific perspective of antifraud controls established based on a  comprehensive fraud risk assessment. Such activities can serve as an  early warning system to help identify and resolve issues in fraud risk  management—whether they involve current controls or prospective  changes. Ongoing monitoring and periodic evaluations provide  assurances to managers that they are effectively preventing, detecting,  and responding to potential fraud. Further, according to the framework,  effective monitoring and evaluation focuses on measuring outcomes and  progress toward achieving objectives.

Because the Bank has not completed a comprehensive fraud risk  assessment, or designed antifraud controls based on such an  assessment, it is not in a position to fulfill this final component. Even at  that, however, we found the Bank does not generally evaluate the  effectiveness or efficiency of its current fraud risk management practices.  For example, OGC and CRC managers—who form the dedicated entity  for managing fraud risks (as described earlier in component one)—both  told us they are unaware of any procedure to periodically assess the  effectiveness of the Bank’s fraud risk management policies. In addition,  the Bank currently has no formal method for tracking fraud activity,  according to a Bank manager. Thus, the Bank is not in a position to  explicitly judge the effectiveness of antifraud controls. Further, as  described earlier, Bank managers told us the fraud indicators they do  track are not precise or numerical measures and that, instead, OGC is  aware of fraud activity through a general sense of daily business.

Following our inquiries, Bank managers told us they plan to revise their  approach to monitoring, evaluating, and adapting their fraud risk  management practices. They said they now plan to evaluate the  effectiveness of those practices, following adoption of the second and  third components of GAO’s Fraud Risk Framework, and with the intent to  adapt controls as indicated necessary, in accordance with the  framework’s fourth component. Timing will depend on implementation of  the underlying fraud risk assessment, Bank managers told us. The Bank  cannot be assured that its antifraud controls are optimal until it has  fulfilled component four of GAO’s Fraud Risk Framework in the  comprehensive fashion envisioned, following previous full implementation  of components two and three. In particular, it cannot be assured that  current practices are adequate, based on inherent program risks.

Proactively and strategically managing fraud risks can aid the Bank’s  mission of supporting American jobs by facilitating U.S. exports, by  reducing not only the risk of financial loss to the government, but also the  risk of serious reputational harm to the Bank. The Bank has taken some  steps to address fraud that are among leading practices identified in  GAO’s Fraud Risk Framework. But overall, the Bank has approached  fraud risk management on a fragmented, reactive basis, and its antifraud  activities have not been marshalled into the kind of comprehensive,  strategic fraud risk management regime envisioned by GAO’s Fraud Risk  Framework and its leading practices.

Chiefly, this is because the Bank has not anchored its fraud risk  management policies in a comprehensive fraud risk assessment and  corresponding risk profile, tailored to its operations, and then  implemented controls designed to address the specific fraud risks  identified in the assessment. Some fraud risk facing the Bank is already  known, such as fabricated documentation. But as the Bank  acknowledges, in addition to fraud risk inherent in its complex lines of  business, it also faces significant risk from new or unfamiliar deal  structures it may employ, and in new and unfamiliar technologies and  industries it may service, where it has limited experience. Regular,  comprehensive fraud risk assessments will address not only known types  of fraud, but also seek to identify where fraud can occur and the types of  fraud the program faces, including likelihood and impact.

Accordingly, until the Bank begins conducting thorough, systematic  assessments of its fraud risks, and compiles a risk profile prioritizing such  risks, it cannot be assured that it satisfactorily understands its  vulnerabilities to fraud and any gaps in its capabilities for addressing  them. Following on from that, without developing and implementing an  antifraud strategy that builds on the findings of the comprehensive risk  assessments and risk profile, the Bank cannot be assured that its  antifraud control activities are optimally designed for, and targeted to, the  actual fraud risks its faces—meaning that it could be failing to address  significant risks or targeting the wrong ones. Finally, without establishing  outcome-oriented metrics and then regularly reviewing progress toward  meeting these goals, the Bank cannot be assured that its antifraud control  activities are working as intended.

As we concluded our review, the Bank, encouragingly, said it would adopt  the more proactive approach described by GAO’s Fraud Risk Framework.  Thus, the Bank now needs to follow through on its stated intent to change  its practices, and accomplish the tasks, described to us by Bank  managers, as intended and in a timely fashion. This is true not only for  current operations, but also prospectively, for the large transaction  backlog the Bank faces, which Bank managers will process if or when the  Bank’s quorum issue is resolved, and which could stress Bank fraud  controls.

The Bank’s identification of a dedicated entity to lead fraud risk  management activities can be an important step in the right direction if  that move now becomes the start of a sustained commitment. By fully  adopting the elements of the framework, the Bank can strengthen its  antifraud culture, better understand fraud risks facing its products and  programs, and reshape how it monitors and evaluates the outcomes of its  fraud risk management activities. In doing so, it will be better positioned to  protect taxpayers and its multi-billion-dollar portfolio, while still meeting its  mission to support American jobs and exports.

Even though Bank managers have already told us they plan to implement  the framework, they did not provide us documentation describing in detail  how they will ensure their fraud risk assessment and fraud risk profile are  consistent with leading practices of the framework—such as by ensuring  the risk assessment considers all inherent fraud risks and the risk profile  reflects risk tolerances that are specific and measurable. Thus, we  include the following framework-specific recommendations in order to  comprehensively enumerate relevant issues we identified, as well as to  present clear benchmarks of accountability for assessing Bank progress.  This complete listing is important in light of the Bank’s recent embrace of  the framework; changes in the Bank’s executive leadership and  vacancies on the Bank Board; and expected congressional consideration  of the Bank’s reauthorization in 2019.

We are making the following seven recommendations to the Bank:  The acting Bank president and Board chairman should ensure that the  Bank evaluates and implements methods to further promote and sustain  an antifraud tone that permeates the Bank’s organizational culture, as  described in GAO’s Fraud Risk Framework. This should include  consideration of requiring training on fraud risks relevant to Bank  programs, for new employees and all employees on an ongoing basis,  with the training to include identifying roles and responsibilities in fraud  risk management activities across the Bank. (Recommendation 1)

As the agency begins efforts to plan and conduct regular fraud risk  assessments and to determine a fraud risk profile, the acting Bank  president and Board chairman should ensure that the Bank’s risk  assessments and profile address not only known methods of fraud,  including those that are absent from its current risk register, but other  inherent fraud risks as well. (Recommendation 2)

As the agency begins efforts to plan and conduct regular fraud risk  assessments and to determine a fraud risk profile, the acting Bank  president and Board chairman should ensure that the risk profile includes  risk tolerances that are specific and measurable. (Recommendation 3)

The acting Bank president and Board chairman should ensure that the  Bank develops and implements an antifraud strategy with specific control  activities, based upon the results of fraud risk assessments and a  corresponding fraud risk profile, as provided in GAO’s Fraud Risk  Framework. (Recommendation 4)

The acting Bank president and Board chairman should ensure that the  Bank identifies, and then implements, the best options for sharing more  fraud-related information—including details of fraud case referrals and  outcomes—among Bank staff, to help build fraud awareness, as  described in GAO’s Fraud Risk Framework. (Recommendation 5)

The acting Bank president and Board chairman should lead efforts to  collaborate with the Bank’s OIG to identify a feasible, cost-effective  means to systematically track outcomes of fraud referrals from the Bank  to the OIG, including creating a means to link the OIG’s proven cases of  fraud to the specific Bank transactions from which the OIG actions arose.  If any such means are found to be feasible and cost-effective, the acting  Bank president and Board chairman should direct appropriate staff to  implement them, with such information to be used for purposes consistent  with GAO’s Fraud Risk Framework, such as data analytics.  (Recommendation 6)

The acting Bank president and Board chairman should ensure that the  Bank monitors and evaluates outcomes of fraud risk management  activities, using a risk-based approach and outcome-oriented metrics, and  that it subsequently adapts antifraud activities or implements new ones,  as determined to be appropriate and consistent with GAO’s Fraud Risk  Framework. (Recommendation 7)

We provided a draft of this report to the Bank for review and comment. In  written comments, summarized below and reproduced in appendix III, the  Bank agreed with our recommendations. The bank also provided  technical comments, which we incorporated as appropriate.

In its written comments, the Bank said it will take several steps to  implement our recommendations to improve its fraud risk management  activities. For example, the Bank stated it would continue to evaluate and  implement methods to promote and sustain an antifraud tone that  permeates the Bank’s organizational culture. In assessing fraud risks, the  Bank stated it will include not only known risks, but also other inherent  risks not yet known to have led to fraud. Following a fraud risk  assessment as provided in GAO’s Fraud Risk Framework, the Bank  stated that it will develop antifraud controls based on that assessment,  subject to cost-benefit analysis. The Bank also stated that it will monitor  and evaluate outcomes of its fraud risk management activities, and adapt  existing controls or implement new controls as indicated, subject to cost- benefit analysis. The Bank further stated it will identify and implement  ways to share more fraud-related information.

In its written comments, the Bank also raised four concerns about our  work.

First, the Bank stated that it keeps substantial reserves for losses, which  protect against taxpayer costs. We clarified our report to indicate that  Bank officials told us they maintain reserves to protect against taxpayer  costs. We did not evaluate the extent to which these reserves protect  against taxpayer costs because doing so was outside the scope of our  review.

Second, the Bank stated our employee survey does not directly support  some of the conclusions that we draw from responses received, and that  only 24 percent of respondents were in the Export Finance area, which  handles underwriting of Bank transactions. We note that the leading  practices of the Fraud Risk Framework call for involving all levels of the  agency in setting an antifraud tone that permeates the organizational  culture. We also note that the Office of the Export Finance is not the only  division involved in fraud control activities. For example, during our  review, Bank managers told us that employees in the Credit Review and  Compliance division, the Office of the General Counsel, and the Office of  the Chief Financial Officer, among other offices, are also involved in fraud  control activities. Thus, we believe it is appropriate that survey responses  from those who work in these and other offices are included in our survey  results. As noted in our report, Bank managers, in interviews, and staff, in  our employee survey, generally expressed positive views of the Bank’s  antifraud culture, but they hold different views on key aspects of that  culture. We believe that our survey results support these findings, as well  as related conclusions and recommendation (Recommendation 1), with  which the Bank agreed.

Third, the Bank stated that it has been very effective in preventing,  detecting, and prosecuting fraud in Bank transactions. Our review  evaluated the extent to which the Bank has adopted leading practices for  managing fraud risks, as described in the Fraud Risk Framework. We did  not evaluate the operational effectiveness of specific Bank control  activities for preventing, detecting, and prosecuting fraud because doing  so was beyond the scope of our review.

Fourth, the Bank stated that our report and the employee survey did not  clearly and consistently distinguish between fraud and fraud risk, which  may lead to confusion in both the survey responses and the analysis in  the report. However, we define the terms “actual fraud” and “fraud risk” in  our employee survey, which appears in appendix II. Further, as described  in greater detail in appendix I, we pretested and modified the survey to  ensure questions were understood by respondents and that we used  correct terminology. This process allowed us to determine whether survey  questions and answer choices were clear and appropriate. Thus, we  believe the survey results support our findings. Overall, as noted, these  findings include positive views of the Bank’s antifraud culture as well as  differing views on some aspects of that culture.

We are sending copies of this report to the appropriate congressional  committees, the acting president and Board chairman of the Bank, and  other interested parties. In addition, the report is available at no charge on  the GAO website at http://www.gao.gov.

If you or your staffs have any questions about this report, please contact  me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

This report examines management by the Export-Import Bank of the  United States (the Bank) of fraud risks in its export credit activities, by  evaluating the extent to which the Bank has adopted the four components  described in GAO’s A Framework for Managing Fraud Risks in Federal  Programs (Fraud Risk Framework). Specifically, we evaluate the extent  to which the Bank has established an organizational culture and structure conducive to planned regular fraud risk assessments and assessed risks to  determine a fraud risk profile; designed and implemented a strategy with specific control activities to  mitigate assessed fraud risks; and evaluated outcomes using a risk-based approach and adapted  activities to improve fraud risk management.

To examine the extent to which the Bank has adopted the components of  GAO’s Fraud Risk Framework, we reviewed Bank policy and governance  documentation, plus other documentation; reviewed GAO and Bank  Office of the Inspector General reports on fraud and fraud risk  management topics; reviewed relevant reports of the Congressional  Research Service and the Congressional Budget Office; and reviewed  other reports and background information. Documentation we reviewed  included Bank operating procedures, details of database search  procedures, Bank annual reports, reports to Congress, the Bank’s  strategic plan, risk assessments, and other materials.

We also interviewed a range of Bank managers, at both the senior- management level and those overseeing relevant Bank operating units.  These included the Bank’s chief financial officer, its chief risk officer, its  acting chief operating officer, those with specific antifraud responsibilities,  and others responsible for individual business units. These individual  business units included those with responsibilities for monitoring  transactions following approval.

We then assessed our findings on the Bank’s fraud risk management  practices and its antifraud controls against provisions of the Fraud Risk  Framework, which also incorporates concepts from GAO’s Standards for  Internal Control in the Federal Government.

To examine the extent to which the Bank has established an  organizational culture and structure conducive to fraud risk management,  we conducted a web-based survey of Bank employees. In our survey, we  assessed, among other things, perceptions of the Bank’s organizational  culture and attitudes toward fraud and fraud risk management, and  whether employees viewed senior Bank management as committed to  establishing and maintaining an antifraud culture. We surveyed all non- senior-management Bank employees, regardless of their position or  length of employment, who are responsible for implementing, but not  determining, Bank policy (that is, those below the level of senior vice  president). There were 403 employees in our survey population, and we  received 296 responses, thus producing a response rate of 73.5 percent.  We received sufficient representation across Bank offices and divisions,  and, overall, obtained a range of employee views.

To develop our survey instrument, we utilized background research,  leading practices as identified in GAO’s Fraud Risk Framework,  interviews with Bank senior managers, and other sources. We conducted  in-person pretests of survey questions with five Bank employees, varying  in position, Bank office or division, and seniority, at Bank headquarters in  Washington, D.C. We pretested the survey instrument to ensure the  questions were understood by respondents, that we used correct  terminology, and that the survey was not burdensome to complete. This  process allowed us to determine whether the survey question and answer  choices were clear and appropriate. We modified our survey instrument  as appropriate based on pretest results and suggestions made by an  independent survey specialist. The final survey instrument included  closed- and open-ended questions on Bank management and tone-at- the-top; fraud-related training and information; antifraud environment; and  personal experiences with fraud at the Bank. Throughout the survey  instrument, we defined important terms, such as “senior management,” so  respondents could interpret key concepts consistently through the  survey.

We administered the survey, via the World Wide Web, from July 31,  2017, through September 22, 2017. To do so, we obtained from Bank  management a file of Bank employees with relevant identifying  information. Before we opened the survey, the Bank president, at our  suggestion, sent an email to employees notifying them of the forthcoming  survey and encouraging them to respond. We also sent Bank employees  a notification email describing the forthcoming survey, in advance of  sending employees another email providing a unique username and  password to access the web-based survey. To improve the response  rate, we contacted Bank employees by phone who had not yet completed  the survey (nonrespondents), to determine their eligibility, update their  contact information, answer any questions or concerns about the survey,  and seek their commitment to participate. We also sent multiple follow-up  emails to nonrespondents encouraging them to respond, and provided  instructions for taking the survey. These follow-up contacts reduced the  possibility of nonresponse error. We sent our follow-up reminder emails to  the survey population on August 10, 17, and 29, 2017, and September 1  and 14, 2017.

Because we surveyed all non-senior-management employees, the survey  did not involve sampling error. To minimize nonsampling errors, and to  enhance data quality, we employed recognized survey design practices in  the development of the survey instrument and in the collection,  processing, and analysis of the survey data. We calculated frequencies  for closed-ended responses and reviewed open-ended response for  themes and illustrative examples. When we analyzed the survey data, an  independent analyst checked statistical programs used to collect and  process responses. We selected survey excerpts—tallies of answers to  selected questions, plus individual comments received from  respondents—presented in the main text of this report based on  relevance to the respective subject matter.

We conducted our performance audit from October 2016 to July 2018, in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Appendix II: Results of GAO Survey of Bank Employees: “Anti-Fraud Controls at the Export-Import Bank of the United States”

Appendix II: Results of GAO Survey of Bank  Employees: “Anti-Fraud Controls at the  Export-Import Bank of the United States”

As described in appendix I, GAO conducted a survey of employees of the  Export-Import Bank of the United States (the Bank), to obtain their views  on the Bank’s organizational culture and attitudes toward fraud and fraud  risk management. We surveyed 403 employees and obtained 296  responses, for a response rate of 73.5 percent. Our survey did not rely on  a sample, as we distributed it to the entire employee population identified.  Although originally presented through the World Wide Web, the questions  and answer choices that follow are the same wording as shown to Bank  employees. Results are tallied for each question. We omit, however, all  individual responses to open-ended questions, in order to protect  respondent anonymity. Underlined items indicate terms for which  hyperlinked definitions were available in the original survey form.

Please use these definitions when thinking about your answers—

“Fraud” generally means obtaining something of value through willful misrepresentation; and in  particular, misconduct involving Bank transactions.

We mean it to include actual fraud, as found through the judicial system or an administrative  process; as well as “fraud risk” – an opportunity, situation, or vulnerability that could allow for  someone to engage in fraudulent activity.

For this section and elsewhere, two additional definitions— “Senior management” refers to Bank managers at the senior vice president level and above. “Management in general” refers to a broader management group – first-level supervisors and  above.  4.  In your view, to what extent has Bank management in general established a clear anti-fraud tone for the  Bank?

Unsure/don’t know  Valid responses: 296  50.3%  29.4%  10.8%  2.7%  1.4%  5.4%  5.  Based on the actions of Bank senior management in particular, how important do you think preventing,  detecting, and otherwise addressing fraud is to the Bank?

Unsure/don’t know 61.5%  25.0%  7.1%  1.7%  1.0%  3.7%  6.  Based on the actions of the managers of your division in particular, how important do you think preventing,  detecting, and otherwise addressing fraud is to the Bank?

Unsure/don’t know 60.5%  27.9%  5.1%  1.7%  1.4%  3.4%  7.  How clearly has Bank management in general communicated a standard of conduct that applies to all  employees, and which includes the Bank’s expectations of behavior concerning fraud?

Unsure/don’t know  Valid responses: 294  44.6%  33.3%  16.0%  1.7%  1.7%  2.7%  8.  Based on your experience, for each entity below, which category best describes the level of responsibility  the entity has for overseeing fraud risk management activities at the Bank?

9. Thinking about your response to question 8, do you believe your answer represents the most effective way

for the Bank to oversee fraud and fraud risk?

Unsure/don’t know  Valid responses: 295  62.4%  7.1%  30.5%  9(a).  Why, or why not, is this the most effective way for  the Bank to oversee fraud and fraud risk?

10. Within the past two years, have you received fraud- or fraud risk-related training provided by the Bank

23. In your view, should the Bank be more, or less, active in preventing, detecting, and otherwise addressing  fraud or fraud risk?

Unsure/don’t know  9.8%  25.7%  43.6%  1.7%   –  19.3%  23(a).  Why do you feel this is the appropriate level of  activity for addressing fraud or fraud risk?

24. Among all the various activities of the Bank, where do you think preventing, detecting, and otherwise

Excluding “Not applicable to my job or experience”—

Unsure/don’t know  14.9%  32.2%  14.4%  4.6%  1.1%  32.8%  31. If you have additional comments on any of the items above, or on fraud- or fraud risk-related issues at the  Bank generally, please feel free to provide them below.  32. Would you be willing to speak with GAO regarding your answers to the survey, the topics raised above, or  other fraud-related matters?  32(a).  Please provide your name and contact information.

Appendix III: Comments from the Export- Import Bank of the United States

In addition to the contact named above, Jonathon Oldmixon (Assistant  Director), Marcus Corbin, Carrie Davidson, David Dornisch, Paulissa Earl,  Colin Fallon, Dennis Fauber, Kimberly Gianopoulos, Gina Hoover,  Farahnaaz Khakoo-Mausel, Heather Latta, Flavio Martinez, Maria  McMullen, Carl Ramirez, Christopher H. Schmitt, Sabrina Streagle, and  Celia Thomas made key contributions to this report.

The Export-Import Bank of the United States helps U.S. companies that want to sell to foreign buyers but can’t get private financing. According to the Bank, its programs support tens of thousands of U.S. jobs annually. However, the Bank is backed by the U.S. government—so taxpayers could be responsible for losses.

We reviewed the Bank's controls for preventing losses from fraud. The Bank has taken steps to improve fraud risk management, including adopting some practices in our fraud risk management framework. However, it should conduct a comprehensive fraud risk assessment and use that to design antifraud controls. We made 7 recommendations.