The Bank Has Identified a Dedicated Entity to Lead Fraud Risk Management, but Management and Staff Disagree on Aspects of an Antifraud Culture

The Bank has identified a dedicated entity to lead fraud risk management  activities, as called for in the first component of GAO’s Fraud Risk  Framework. However, we also found that management and staff have differing views  on key aspects of the Bank’s antifraud culture. Overall, Bank managers told us, the Bank’s current  approach has been appropriate for dealing with fraud. However, about one-third of survey respondents (35 percent)  said the Bank should be “much more active” or “somewhat more active” in  preventing, detecting, and addressing fraud. However, to the extent views on  significant antifraud issues, such as how active the Bank should be in  preventing, detecting, and addressing fraud, or adequacy of time devoted  to underwriting, differ across the organization, the Bank cannot ensure  that it is best setting an antifraud tone that permeates the organizational  culture, as provided in the Fraud Risk Framework. Further, under the framework, recent changes  in the Bank’s operating environment indicate a heightened need to do so. Bank managers told us they will revise their  fraud risk management practices to fully adopt the Fraud Risk  Framework. The Bank Has Taken Some Steps to Assess Known Fraud Risks but Does Not Conduct Regular, Comprehensive Fraud Risk Assessments

A leading practice of the Fraud Risk Framework calls for agencies to  conduct fraud risk assessments at regular intervals, as well as when there  are changes to the program or operating environment, because  assessing fraud risks is an iterative process. This includes an assessment of the likelihood  and impact of fraud risks inherent to the program; that is, meaning both  fraud risks known through fraud that has been experienced, as well as  other fraud risk that can be identified, based on the nature of the program. Generally, the Bank’s practice has been to assess particular  fraud risks and lessons learned following specific instances of fraud  encountered, according to Bank managers. However, without planning and conducting regular fraud  risk assessments, as identified in GAO’s Fraud Risk Framework, the  Bank is vulnerable to not identifying material risks that can hurt  performance or its ability to fulfill its mission. This indicates  the register is incomplete, from the standpoint of identifying where fraud  can occur and the types of internal and external fraud risks the program  faces, as provided in GAO’s Fraud Risk Framework. For instance, as noted,  the Bank has not conducted a comprehensive assessment of inherent  fraud risks, tailored to its operations. As for implementation of the planned new approach, Bank managers  stated they plan to complete a fraud risk assessment by December 2018  and to determine the Bank’s fraud risk profile by February 2019. We also found the Bank has  opportunities to improve antifraud controls through greater fraud  awareness and use of data analytics. Thus, we  include the following framework-specific recommendations in order to  comprehensively enumerate relevant issues we identified, as well as to  present clear benchmarks of accountability for assessing Bank progress. This complete listing is important in light of the Bank’s recent embrace of  the framework; changes in the Bank’s executive leadership and  vacancies on the Bank Board; and expected congressional consideration  of the Bank’s reauthorization in 2019. In its written comments, the Bank said it will take several steps to  implement our recommendations to improve its fraud risk management  activities. As noted in our report, Bank managers, in interviews, and staff, in  our employee survey, generally expressed positive views of the Bank’s  antifraud culture, but they hold different views on key aspects of that  culture. Appendix I: Objectives, Scope, and Methodology

This report examines management by the Export-Import Bank of the  United States (the Bank) of fraud risks in its export credit activities, by  evaluating the extent to which the Bank has adopted the four components  described in GAO’s A Framework for Managing Fraud Risks in Federal  Programs (Fraud Risk Framework). Specifically, we evaluate the extent  to which the Bank has established an organizational culture and structure conducive to planned regular fraud risk assessments and assessed risks to  determine a fraud risk profile; designed and implemented a strategy with specific control activities to  mitigate assessed fraud risks; and evaluated outcomes using a risk-based approach and adapted  activities to improve fraud risk management. Appendix II: Results of GAO Survey of Bank Employees: “Anti-Fraud Controls at the Export-Import Bank of the United States”

Appendix II: Results of GAO Survey of Bank  Employees: “Anti-Fraud Controls at the  Export-Import Bank of the United States”
As described in appendix I, GAO conducted a survey of employees of the  Export-Import Bank of the United States (the Bank), to obtain their views  on the Bank’s organizational culture and attitudes toward fraud and fraud  risk management. 4.
Why GAO Did This Study

According to the Bank, it serves as a financier of last resort for U.S. firms seeking to sell to foreign buyers but that cannot obtain private financing for their deals. Its programs support tens of thousands of American jobs and enable billions of dollars in U.S. export sales annually, the Bank says. The Bank is also backed by the full faith and credit of the United States government, meaning that taxpayers could be responsible for Bank losses.
The Export-Import Bank Reform Reauthorization Act of 2015 included a provision for GAO to review the Bank's antifraud controls within 4 years, and every 4 years thereafter. This report examines the extent to which the Bank has adopted the four components of GAO's Fraud Risk Framework—commit to combating fraud; regularly assess fraud risks; design a corresponding antifraud strategy with relevant controls; and evaluate outcomes and adapt. GAO reviewed Bank documentation; interviewed a range of Bank managers; and surveyed Bank employees about the extent to which the Bank has established an organizational culture and structure conducive to fraud risk management.

What GAO Found

In managing its vulnerability to fraud, the Export-Import Bank of the United States (the Bank) has adopted some aspects of GAO's A Framework for Managing Fraud Risks in Federal Programs (Fraud Risk Framework). This framework describes leading practices in four components: organizational culture, assessment of inherent program risks, design of tailored antifraud controls, and evaluation of outcomes. As provided in the framework, for example, the Bank has identified a dedicated entity within the Bank to lead fraud risk management. GAO also found that Bank managers and staff generally hold positive views of the Bank's antifraud culture. However, GAO also found that management and staff hold differing views on key aspects of that culture. These differing views include how active the Bank should be in addressing fraud. For example, Bank managers told GAO the Bank's current approach has been appropriate for dealing with fraud. However, about one-third of Bank staff responding to a GAO employee survey said the Bank should be “much more active” or “somewhat more active” in preventing, detecting, and addressing fraud. These and other divergent views indicate an opportunity to better ensure the Bank sets an antifraud tone that permeates the organizational culture, as provided in the Fraud Risk Framework.
GAO found the Bank has taken some steps to assess fraud risk. For example, the Bank's practice has generally been to assess particular fraud risks and lessons learned following specific instances of fraud encountered, according to Bank managers. However, the Bank has not conducted a comprehensive fraud risk assessment, as provided in the framework. The Bank has also been compiling a “register” of risks identified across the organization, including fraud. This register, however, does not include some known methods of fraud, such as submission of fraudulent documentation, thus indicating it is incomplete. Without planning and conducting regular fraud risk assessments as called for in the framework, the Bank is vulnerable to failing to identify fraud risks that can damage its reputation or harm its ability to support U.S. jobs through greater exports. As provided in the framework, managers should determine where fraud can occur and the types of internal and external fraud the program faces, including an assessment of the likelihood and impact of fraud risks inherent to the program.
At the conclusion of GAO's review, Bank managers said they will fully adopt the GAO framework. They said they plan to complete a fraud risk assessment by December 2018, and to determine the Bank's fraud risk profile—that is, document key findings and conclusions from the assessment—by February 2019. Work to adopt other framework components will begin afterward, the managers said. However, they did not provide details of how their efforts will be in accord with leading practices of the framework. As a result, GAO makes framework-specific recommendations in order to enumerate relevant issues and to present clear benchmarks for assessing Bank progress. This complete listing of recommendations is important in light of the Bank's recent embrace of the framework; recent changes in Bank leadership; and expected congressional consideration of the Bank's reauthorization in 2019.

What GAO Recommends

GAO makes seven recommendations, centering on conducting a fraud risk assessment, tailored to the Bank's operations, to serve as the basis for the design and evaluation of appropriate antifraud controls. The Bank agreed with GAO's recommendations, saying it will take steps to improve its fraud risk management activities.