What are some of the best practices for our municipality when receiving complaints regarding fraud and waste? What are some of the appropriate investigatory steps that we should be taking when we receive them?

Best practices that municipalities should consider include establishing oversight programs and conducting audits of the municipality’s disbursements.  Audits and oversight are necessary components of the federal grant life cycle to ensure accountability for publicly funded programs and to mitigate the risk of fraud, waste, and abuse. Oversight authorities, including Federal Agencies’ Inspectors General, are independent reviewers charged with developing a risk framework to assess factors such as:

• Was the funding used as intended?
• Were resources used in a prudent, responsible, and reasonable manner?
• Were the applicable laws and regulations followed, including local laws?
• Is the use of funding clearly reported and documented?

When an audit or oversight inquiry happens, some things municipalities can consider include:

• Identifying an Inquiry Response team. Clearly designate roles and responsibilities, including a team lead to respond to inquiries. Such an Inquiry Response Team could establish a clear process, direct action internally, collect and review documentation or responses, and communicate both internally and externally regarding the inquiry. A best practice would be to ensure that this team has the resources they need, including adequate time and bandwidth, to dedicate sufficient time to coordinate your municipality’s response. 
• Understanding the scope and the breadth of the inquiry. Auditors, oversight bodies, or Freedom of Information Act requests are expected to communicate the goals, intent, subject, or framework they are using to perform their oversight role. Municipalities can consider whether the Inquiry Response Team clearly understands the questions being asked and responds directly to the questions. As a best practice, the Inquiry Response Team would also be able to identify and respond when a question is beyond the scope of the inquiry or inconsistent with the rules and requirements of the award.
• Ensuring clear expectations for inquiry response. Municipalities can consider ways to communicate and work closely with the auditor or oversight body to establish clear expectations on timelines, methods of communication, and the format and content of responses.
• Reviewing policy, guidance, and FAQs of the funding program. As a best practice, the Inquiry Response Team would be comfortable with the details of the guidance provided and be able to cite or reference that guidance in their response to the inquiry. For example, presenting a cost incurred in response to a question would also clearly identify how that cost was an eligible use of funding and cite the policy or guidance that permits it.
• Ensuring response answers the question in a clear, concise, focused, and straightforward way. As a general best practice, municipalities can strive to present information as simply and as clearly as possible, and make sure it answers the question being asked. Auditors and oversight authorities may not understand the local context, and they will not assume how to connect information if it is not provided to them. For example, if presenting financial information to an auditor for costs that may have been proportionally allocated to a federal fund, municipalities can consider ways to make sure that the auditor understands the math and methodology behind the allocation and that the reasoning behind the response is spelled out for the auditor.

For municipalities managing disaster response and recovery funding, one of the ways to respond to an audit is to prepare for one before it arrives. Because auditors and oversight authorities often utilize a risk framework to assess when audit or inquiries should take place, documenting steps to mitigate risk are often times helpful in reducing the burden if and when an audit arrives. Some considerations municipalities can take into account include:

• Documenting internal policies and procedures for the management of federal funding. Providing internal policies and procedures on how critical actions are taken, such as purchasing, spending, review and approval processes, will be helpful in demonstrating to an auditor that internal controls were in place. For most municipalities, those policies and procedures already exist, and may only need to be slightly expanded to account for additional processes specific to the federal funding. If your municipality developed a new process specific to the management of the fund, consider documenting that as well.
  • For example, auditors are often concerned with how goods or services funded by federal dollars are procured. An auditor may review a municipality’s existing procurement policy and process, conflict of interest policy, and contract management processes to ensure they were followed and are also compliant with the federal requirements or terms and conditions of the funding. To help prepare for an audit, collecting existing policies and adding in any specific additional processes put in place for the use of federal funds may help demonstrate the oversight and internal controls an auditor is looking for.
  • Example Case: A mid-size county used COVID-19 relief funding to establish a rental assistance and relief program for households that were severely financially impacted by COVID-19. The county documented how the program would be communicated and accessible to the public, application and documentation requirements, evaluation processes to determine compliance with program criteria and ensure no duplication of benefits, and the notification process to award or deny assistance. As the program was rolled out, the County identified that the process on approving release of funds to awardees, including who was responsible for the final approval and issuance of checks, was not captured in the existing process.  Updating their written policy with how that process actually occurred, including changes made to increase oversight of funding disbursement, will help an auditor understand how the program worked and the controls in place from the County to ensure it met the funding requirements.
• Assessing and documenting if existing policies and processes were not followed. Often in the immediate aftermath of a disaster, or navigating the uncertainties of COVID-19, municipalities have had to make decisions and act quickly in order to protect public health and safety. In some cases, existing processes may have been amended to respond to immediate threats. Completing an after-action report, or mid-action report, could help to determine potential gaps or issues that an auditor may flag. Documenting what happened, including decision-making and processes, could be helpful in explaining these instances if questioned, as well as provide a framework to correct an issue.
  • For example, a municipality may have bypassed normal purchasing processes to requisition PPE for frontline workers responding to COVID-19 because the timeline to complete a full, competitive procurement may have put frontline workers in danger. Documenting  the context and justification for that decision in an internal memo, demonstrating that it was necessary, reasonable, and prudent, may help an auditor understand the process. It will also help if an audit or oversight inquiry happens months or years after the fact, where the individuals “in the room” may no longer be with the municipality, or able to support the audit or oversight response.
• Keeping financial information and supporting documentation clear and organized. Maintaining financial information and supporting documentation is the baseline requirement of all federally funded programs. Keeping documentation organized, up to date, and centrally accessible will help your team quickly and effectively respond to an auditor or oversight authority. This will be especially helpful if audits come months or years later, when the original team managing the funding may not be available to search for documentation or support audit response. As part of your internal policies and procedures, it is helpful to clarify where documentation should be stored.
• Consider ways to correct identified issues. Mistakes occur in disaster response and recovery, often without the direct intent of fraud, waste, or abuse. Entities that identify critical issues regarding use or management of funds, but do not take efforts to correct them, may face additional issues when audit or oversight arrives. Periodic internal assessment, updating policies and processes as needed to better meet the terms and conditions of your municipality’s allotted federal funds, and documenting efforts to resolve identified issues will likely help to demonstrate effective stewardship to an auditor or oversight authority.

Below are some resources that municipalities may find useful in understanding and preparing for federal audits of disaster recovery funding, including reviewing recent audits:

• DHS OIG Audit Tips for Managing Disaster-Related Project Costs, OIG-17-120-D
• HUD Handbook for CDBG Subrecipients – Chapter 7.0 Audits
• Treasury OIG Audits of CARES Act Funding

Additional steps that municipalities can consider taking include:

• Having a database in place to document and track fraud complaints received.
• Making it easier for workers, contractors and the public to report COVID-19 related fraud in your municipality by considering establishing a COVID-19 fraud hotline that allows individual to report matters anonymously.
• If your municipality does not have resources in place to investigate fraud complaints, consider coordinating with your local, state and/or Federal prosecutors. Most prosecutors will have units in place to investigate allegations of fraud.
• Municipalities can leverage Federal resources already in place to assist with handling COVID-19 related fraud complaints. Below are some Federal entities that have hotlines in place to receive fraud complaints:
  • The Pandemic Response Accountability Committee (“PRAC”) - https://www.pandemicoversight.gov/contact/about-hotline
  • The DOJ of Justice National Center for Disaster Fraud Hotline - https://www.justice.gov/disaster-fraud 
  • FEMA – https://www.fema.gov/about/offices/security/disaster-fraud
  • U.S. Department of Homeland Security Office of the Inspector General - https://www.oig.dhs.gov/hotline 
  • U.S. Department of Health and Health and Human Services Office of the Inspector General- https://oig.hhs.gov/fraud/report-fraud/index.asp 
  • U.S. Small Business Administration Office of the Inspector General - https://www.sba.gov/partners/contracting-officials/contract-administration/report-fraud-waste-abuse#section-header-0 
  • U.S. Department of Treasury Office of the Inspector General - https://oig.treasury.gov/ 
• If you do conduct an investigation and find violations of Federal law involving fraud, bribery, or gratuity violations you must notify the Federal agency that awarded the money to your municipality. 
• When a municipality conducts an investigation regarding fraud it is generally a good practice to coordinate your efforts with your internal audit department if one exists.

Last Revised: April 14, 2021