Skip to main content
U.S. flag

An official website of the United States government

Government Website

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Safely connect using HTTPS

Secure .gov websites use HTTPS
A lock () or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Audits, Inspections, and Evaluations

Report Number Title Issue Date Fiscal Year
OIG-20-25 Williams-Adley determined that the Federal Emergency Management Agency (FEMA) did not always ensure that Department of Transportation and Public Works (DTOP) established and implemented policies, procedures, and practices to account for and expend PA grant funds according to Federal regulations and FEMA guidance.  Specifically, DTOP did not have (1) an effective grants management process; (2) sufficient internal controls in the procurement process; and (3) sufficient controls over its processes for claiming Force Account Labor costs.  This occurred because FEMA and Central Office of Recovery, Reconstruction and Resiliency (COR3) did not adequately oversee DTOP’s grant management activities.  We made three recommendations to improve COR3’s and DTOP’s management of FEMA Public Assistance funds, ensuring they are expended according to Federal regulations and FEMA guidance.  FEMA concurred with the recommendations.

>Capacity Audit of FEMA Grant Funds Awarded to the Puerto Rico Department of Transportation and Public Works 		2020
OIG-20-55 U.S. Customs and Border Protection (CBP) does not comprehensively plan and conduct its covert testing, use test results to address vulnerability, or widely share lessons learned.  CBP’s two covert testing groups do not use risk assessments or intelligence to plan and conduct covert tests at ports of entry and U.S. Border Patrol checkpoints, do not plan coordinated tests, and do not design system-wide tests.  This occurred because CBP has not provided adequate guidance on risk- and intelligence-based test planning, directed the groups to coordinate, given them the required authority, or established performance goals and measures for covert testing.  Following testing, CBP does not widely share covert test results, consistently make recommendations, or ensure corrective actions are taken.  Results are not widely shared because CBP has not defined roles and responsibilities for such sharing.  Covert testing groups do not make recommendations or ensure corrective actions are implemented due to insufficient authority and policies directing these actions.  Finally, CBP does not effectively manage covert testing groups to ensure data reliability, completeness, and compliance with security requirements due to leadership changes and limited staff.  Without comprehensive planning, incorporating lessons learned from test results, and program management accountability, CBP cannot ensure it addresses vulnerabilities, which may be exploited and threaten national security.  We recommended CBP develop policies and procedures for conducting covert testing and assign roles and responsibilities for oversight of covert testing groups.  We made seven recommendations that will strengthen its covert testing program.  CBP concurred with all seven recommendations.

>CBP Needs a Comprehensive Process for Conducting Covert Testing and Resolving Vulnerabilities - (REDACTED) 		2020
OIG-20-24 Williams-Adley determined that the Federal Emergency Management Agency (FEMA) did not ensure the Puerto Rico Central Office of Recovery, Reconstruction, and Resiliency (COR3) and the Puerto Rico Aqueduct and Sewer Authority (PRASA) establish and implement policies, procedures, and practices to account for and expend Public Assistance (PA) grant funds according to Federal regulations and FEMA guidance.  Specifically, PRASA did not follow established policies and procedures for: (1) recording the capacity size and rate of its force account equipment; and (2) ensuring each vendor had a certificate of eligibility before receiving a contract award.  We made two recommendations to improve PRASA’s management of FEMA PA funds, ensuring they are expended according to Federal regulations and FEMA guidance.

>Capacity Audit of FEMA Grant Funds Awarded to The Puerto Rico Aqueduct and Sewer Authority 		2020
OIG-20-57 The Puerto Rico Electric Power Authority (PREPA) complied with Federal procurement requirements for its noncompetitive procurement of the Whitefish contract.  However, the contract costs may not have complied with Federal cost principles that costs must be reasonable to be eligible for Federal awards.  PREPA’s oversight of the Cobra contract did not comply with PA program guidelines.  Finally, FEMA’s Public Assistance grant to PREPA for the Cobra contract did not fully comply with PA program guidelines.  We made two recommendations for FEMA to provide technical assistance to Puerto Rico to ensure compliance with Federal regulations and PA program guidelines.  We made two other recommendations for FEMA to develop guidance to verify its subrecipients’ oversight of time and material contracts and determine the reasonableness and eligibility of time and material contract costs.  FEMA concurred with three of the recommendations and did not concur with one recommendation.

>FEMA's Public Assistance Grant to PREPA and PREPA's Contracts with Whitefish and Cobra Did Not Fully Comply with Federal Laws and Program Guidelines 		2020
OIG-20-23 The Federal Emergency Management Agency’s (FEMA) Individuals and Households Program (IHP) has a robust process for collecting and verifying information provided by underinsured disaster applicants.  However, FEMA does not collect sufficient supporting documentation or verify applicants claiming to have no insurance are eligible for home repair assistance.  Rather, according to FEMA, it relies on applicant self-certifications because no comprehensive repository of homeowner’s insurance data exists, and any additional verification processes would delay home repair payments.  As a result, FEMA made and we are questioning, more than $3 billion in improper and potentially fraudulent payments to individuals since 2003.  Additionally, FEMA did not properly assess and report improper payment risks within IHP because it disregarded significant internal control deficiencies and prior audit findings when it evaluated program risks.  Therefore, IHP applicants who claimed no homeowner’s insurance received less oversight even though they posed the greatest risk for improper and fraudulent payments.  Without implementing changes to its home repair assistance processes, FEMA cannot ensure it is being a prudent steward of Federal resources and adequately assessing its risks of improper payments and fraud.  We made two recommendations to FEMA to improve its IHP home repair documentation, verification, and risk management processes.  FEMA non-concurred with the two report recommendations, resulting in both recommendations being unresolved and open.

>FEMA Has Made More than $3 Billion in Improper and Potentially Fraudulent Payments for Home Repair Assistance since 2003 		2020
OIG-20-56 DHS generally met deadlines for responding to simple Freedom of Information Act (FOIA) requests, it did not do so for most complex requests.  A significant increase in requests received, coupled with resource constraints, limited DHS’ ability to meet production timelines under FOIA, creating a litigation risk for the Department.  Additionally, DHS has not always fully documented its search efforts, making it difficult for the Department to defend the reasonableness of the searches undertaken.  With respect to responding to congressional requests, we determined DHS has established a timeliness goal of 15 business days or less; however, on average, it took DHS nearly twice as long to provide substantive responses to Congress, with some requests going unanswered for up to 450 business days.  Further, DHS redacted personal information in its responses to congressional committee chairs even when disclosure of the information was statutorily permissible.  This was a descriptive report and contained no recommendations.  In its response, DHS acknowledged FOIA backlogs remain a problem, despite increasing requests processed.  DHS stated its process responding to congressional requests varies greatly and that its redactions are appropriate.

>DHS' Process for Responding to FOIA and Congressional Requests 		2020
OIG-20-21 Management of FEMA Public Assistance Grant Funds Awarded to the Sewerage and Water Board of New Orleans Related to Hurricanes Katrina, Isaac, and Gustav 2020
OIG-20-54 U.S. Immigrations and Customs Enforcement (ICE) does not follow its written policy when conducting disciplinary reviews of Senior Executive Employees (SES) employees, which risks creating an appearance that SES employees receive more favorable treatment than non-SES employees.  We reviewed the disciplinary proceedings of the former SES official to evaluate whether ICE’s deviation from the written policy, or any other evidence, in that case indicated that the official received favorable treatment, as alleged.  We did not find evidence of actual favoritism or inappropriate influence in the official’s disciplinary or security clearance review processes.  We recommended that ICE finalize and issue its draft policy documenting the process for disciplining SES members.  We made one recommendation that will enhance transparency in ICE’s disciplinary program.  ICE concurred with our recommendation and took action to resolve and close it.

>Special Report - ICE Should Document Its Process for Adjudicating Disciplinary Matters Involving Senior Executive Service Employees 		2020
OIG-20-22 Capacity Audit of FEMA Grant Funds Awarded to the Puerto Rico Department of Housing 2020
OIG-20-50 We contracted this audit with Cotton & Company LLP, which found that FEMA did not ensure the Florida Department of Emergency Management (FDEM) monitored the Polk County School Board (PCSB) to ensure it established and implemented policies, procedures, and practices to account for and expend PA grant funding in accordance with Federal regulations and FEMA guidance.  For example, PCSB was unable to support $46,168 in food spoilage costs; requested and received funding through a Florida Public Assistance grant for ineligible contract costs incurred under Project 2658 for debris removal and related costs; and charged $897 in unallowable costs associated with ineligible fringe benefits for substitute employees.  We made 13 recommendations that, when implemented, should improve PCSB’s management of FEMA Public Assistance funds.  FEMA concurred with our 13 recommendations.

>Early Warning Audit of FEMA Public Assistance Grants to Polk County School Board, Florida 		2020
OIG-20-19 DHS’ funding and payments for PALMS violated Federal appropriations law.  Specifically, DHS violated the bona fide needs rule in using fiscal year (FY) 2011 component funds in FYs 2012 and 2013 for e-Training services and PALMS implementation respectively, when the funds were not legally available for those needs.  As a result of the bona fide needs rule and purpose statute violations, DHS may also have violated the Antideficiency Act in FYs 2013 – 2015 when the Department augmented appropriations for the Human Resources Information Technology program with component funds. We made nine recommendations to address violations of Federal appropriations law and to improve controls to prevent such potential violations in the future.

>PALMS Funding and Payments Did Not Comply with Federal Appropriations Law 		2020
OIG-20-51 We contracted this audit with Cotton & Company LLP, which found that FEMA did not ensure Monroe County, Florida (the County) established and implemented policies, procedures, and practices to ensure it accounted for and expended Public Assistance program grant funds awarded to disaster areas in accordance with Federal regulations and FEMA guidance.  Specifically, the County did not allocate anticipated and actual insurance proceeds totaling $5 million to reduce FEMA’s share of disaster costs; charged $265,928 for ineligible stand-by time and other ineligible expenses; and requested $84,681 in unsupported and ineligible costs for multiple tasks including clearing emergency access and costs related to flooding.  Additionally, the County overstated $34,378 in force account labor costs that were unreasonable and therefore ineligible for grant funding; overpaid a debris removal contractor, resulting in $2,403 in ineligible costs; and charged $1,080 to PW 1512 for security costs that were unsupported and are therefore ineligible for grant funding. We made 18 recommendations that that, when implemented, should improve Monroe County, Florida’s management of FEMA Public Assistance funds.  FEMA concurred with our 18 recommendations.

>Early Warning Audit of FEMA Public Assistance Grants in Monroe County, Florida 		2020
OIG-20-20 Following Hurricane Maria, FEMA did not maximize the use of advance contracts to address identified capability deficiencies and needs in Puerto Rico.  Specifically, we identified 49 of 241 new contracts issued in the aftermath of Hurricane Maria for the same goods or services covered by existing advance contracts.  We attributed FEMA’s limited use of advance contracts to its lack of a strategy and documented planning process for ensuring maximum use of advance contracts. Further, FEMA did not maintain contract files in accordance with Federal acquisition regulations and departmental or its own policy.  This occurred because FEMA’s Office of the Chief Procurement Officer did not have controls in place to ensure contract personnel follow Federal regulations and departmental or its own internal policy.  As a result, FEMA’s ability to hold contractors accountable for deliverables is hindered if contract files are not easily located. We made four recommendations to help FEMA improve its strategy for advance contracts, its process for identifying capability needs and gaps, and its contract file management practices. FEMA concurred with all four recommendations and described corrective actions it plans to take.

>FEMA’s Advance Contract Strategy for Disasters in Puerto Rico 		2020
OIG-20-53 According to the Securing Our Agriculture and Food Act (SAFA), the program should provide oversight, lead policy initiatives, and coordinate with DHS components and Federal agencies.  However, the Countering Weapons of Mass Destruction Office (CWMD) has not yet carried out a program to meet SAFA’s requirements.  This occurred because CWMD believes it does not have clearly defined authority from the Secretary to carry out the requirements of the SAFA.  In addition, since its establishment in December 2017, CWMD has not prioritized SAFA requirements but instead has focused its resources on other mission areas.  As a result, CWMD has limited awareness of DHS’ ongoing efforts and cannot ensure it is adequately prepared to respond to a terrorist attack against the Nation’s food, agriculture, or veterinary systems.  We made three recommendations to DHS’ CWMD to improve oversight, policy initiatives, and coordination of the Department’s efforts to protect the Nation’s food, agriculture, and veterinary systems. 

>DHS Is Not Coordinating the Department's Efforts to Defend the Nation's Food, Agriculture, and Veterinary Systems against Terrorism 		2020
OIG-20-18 The U.S. Secret Service incurred operational and temporary duty costs for rental cars, hotel rooms, meals and incidentals, overtime pay, commercial airfare, golf cart rentals, and other logistical support.  Certain details of the cost information related to the Secret Service’s protective operations presented in the report are designated as Law Enforcement Sensitive.  We did not include salaries and benefits for government personnel traveling with the President because the Secret Service would have incurred these costs regardless of whether the President traveled.  Also excluded are costs associated with assistance provided by the Department of Defense, such as the use of military aircraft to transport personnel and equipment, because the Secret Service is not required to reimburse these costs.  We did not identify any fraud indicators or unauthorized costs.  We made no recommendations. 

>United States Secret Service Expenses Incurred at Trump Turnberry Resort 		2020
OIG-20-48 We contracted this audit with Cotton & Company LLP, which found that FEMA did not ensure Lee County, Florida (the County) established and implemented policies, procedures, and practices to ensure it accounted for and expended PA program grant funds awarded to disaster areas in accordance with Federal regulations and FEMA guidance.  Specifically, the County requested FEMA funding for $994,425 in unsupported force account labor, equipment, and materials; was unable to provide supporting documentation for $16,210 in costs incurred to operate an emergency shelter; did not maintain adequate documentation to support $267,452 in costs incurred for road repair services; did not include all required provisions in its contracts to obtain disaster recovery services related to Hurricane Irma; and had not evaluated the risk of subrecipients’ noncompliance with Federal requirements, obtained subrecipient audit reports, or developed plans for monitoring subrecipients.  We made nine recommendations that, when implemented, should improve Lee County, Florida’s management of FEMA Public Assistance funds.  FEMA concurred with all nine recommendations.

>Early Warning Audit of FEMA Public Assistance Grants to Lee County, Florida 		2020
OIG-20-75 CBP Does Not Have a Comprehensive Strategy for Meeting Its LS-NII Needs 2020
OIG-20-16 DHS does not have a unified approach for procuring and using handheld chemical identification devices despite the widespread use of these devices across multiple components.  We recommended DHS establish a process to coordinate joint needs across components and maximize savings from strategic sourcing opportunities.  We made two recommendations that should help improve unity of effort in procuring and using handheld chemical identification devices.  DHS concurred with recommendation 1 but did not concur with recommendation 2.

>DHS Should Seek a Unified Approach when Purchasing and Using Handheld Chemical Identification Devices 		2020
OIG-20-52 U.S. Customs and Border Protection has not demonstrated the acquisition capabilities needed to effectively execute the Analyze/Select Phase of the Wall Acquisition Program.  Specifically, CBP did not conduct an Analysis of Alternatives to assess and select the most effective, appropriate, and affordable solutions to obtain operational control of the southern border as directed, but instead relied on prior, outdated border solutions to identify materiel alternatives for meeting its mission requirement.  CBP did not use a sound, well-documented methodology to identify and prioritize investments in areas along the border that would best benefit from physical barriers.  Additionally, the Department did not complete the required plan to execute the strategy to obtain and maintain control of the southern border, as required by its Comprehensive Southern Border Security Study and Strategy.  Without an Analysis of Alternatives, a documented and reliable prioritization process, or a plan, the likelihood that CBP will be able to obtain and maintain complete operational control of the southern border with mission-effective, appropriate, and affordable solutions is diminished.  We made three recommendations to improve CBP’s ongoing investments for obtaining operational control of the southern border.  DHS concurred with recommendation 2 but did not concur with recommendations 1 and 3. 

>CBP Has Not Demonstrated Acquisition Capabilities Needed to Secure the Southern Border 		2020
OIG-20-80 DHS has not effectively managed and coordinated Department resources for its Joint Task Forces (JTFs).  Specifically, DHS has not maintained oversight authority through changes in leadership, implemented and updated policies and procedures, identified optimal JTF staffing levels and resources, and established a process to capture total allocated costs associated with JTFs.  In addition, DHS has not fully complied with public law requirements to report to Congress on JTFs’ cost and impact, establish outcome-based performance metrics, and establish and maintain a joint duty training program.  We recommended the DHS Secretary designate a department-level office to manage and oversee JTFs and address public law requirements.  We made seven recommendations to improve DHS’ management and oversight of its JTFs and ensure compliance with legislative requirements.  DHS provided a management response, but declined to comment, since the Acting Secretary is currently reviewing the status and future of the JTFs

>DHS Cannot Determine the Total Cost, Effectiveness, and Value of Its Joint Task Forces 		2020
OIG-20-17 Colorado’s Department of Public Safety, Division of Homeland Security and Emergency Management (Colorado) did not effectively oversee its subrecipient, Frasier Meadows, to ensure it was aware of and followed Federal procurement regulations and Federal Emergency Management Agency (FEMA) guidelines.  In addition, FEMA should have ensured Colorado delivered assistance to Frasier Meadows consistent with the FEMA-State Agreement and the State Administrative Plan.  We recommended the Regional Administrator, FEMA Region VIII, disallow $5.57 million for contracts and direct Colorado to work with Frasier Meadows officials to ensure they implement their updated Federal procurement policies and procedures in the event of a future disaster.  FEMA officials agreed with both recommendations.  Prior to final issuance of this report, FEMA took action to resolve and close both recommendations.  No further action is required.

>FEMA Should Recover $5.57 Million in Grant Funds Awarded to Frasier Meadows Manor, Inc., Boulder, Colorado 		2020
OIG-20-49 We determined that the city of Houston has adequate policies, procedures, and business practices that comply with Federal procurement regulations and FEMA guidelines to expend FEMA grant funds.  We found Houston may have inappropriately included the $73.8 million cost of Houston First Corporation’s (Houston First) disaster damages in its damage estimate, even though it was not an eligible applicant for them.  We did not examine procurement policies and procedures related to Houston First because the entity was outside the scope of our audit.  During the audit, FEMA acknowledged it would reiterate in writing to the City of Houston the importance of proper oversight for all procurements executed by Houston First.  This report contains no recommendations. 

>Houston, Texas Has Adequate Policies, Procedures, and Business Practices to Manage Its FEMA Grant 		2020
OIG-20-79 U.S. Customs and Border Protection (CBP) cannot ensure its Entry Reconciliation Program reporting is accurate or complies with requirements.  Specifically, CBP did not always validate importers’ self-reported final values of imports when it assessed duties and fees because it did not require importers to substantiate self-reported merchandise values with source documentation.  In addition, CBP did not always follow its policies when conducting reviews of reconciliation entries because its Standard Operating Procedures had been implemented differently across all ports of entry.  Finally, CBP missed opportunities to collect additional revenue when it did not assess monetary liquidated damages for importers that filed reconciliation entries late or not at all.  This occurred because CBP’s controls were insufficient to ensure the ports properly assess liquidated damages for importers who file reconciliations late or not at all.  CBP’s actions compromised the integrity of the Entry Reconciliation Program and, as such, may have put approximately $751 million of revenue, in the form of reconciliation refunds, at risk.  We made four recommendations to improve the overall effectiveness of the program.  CBP concurred with three of our four recommendations. 

>CBP's Entry Reconciliation Program Puts Revenue at Risk 		2020
OIG-20-15 The Federal Emergency Management Agency (FEMA) did not balance its Manufactured Housing Unit (MHU) program costs with disaster-related housing needs.  In response to Hurricane Harvey in Texas, FEMA overestimated the number of MHUs it needed by nearly 2,600, which amounted to purchase, transportation, and storage costs of at least $152 million.  The agency also overestimated the number of tank and pump systems (TPS) it needed to operate the fire sprinklers, by nearly 2,400, which amounted to purchase and transportation costs of approximately $29 million.  Following Hurricane Harvey, FEMA focused on providing prompt assistance and did not emphasize financial accountability and recordkeeping.  Had FEMA better managed and overseen the MHU program, it could have put an estimated $182 million to better use to assist survivors from Hurricane Harvey or other disasters.  We made four recommendations that will help FEMA better manage its MHU program.  FEMA concurred with the recommendations. 

>FEMA Purchased More Manufactured Housing Units Than It Needed in Texas After Hurricane Harvey 		2020
OIG-20-46 We contracted this audit with Cotton & Company LLP, which found FEMA did not ensure Collier County, Florida (the County) established and implemented policies, procedures, and practices to account for and expend Public Assistance (PA) program grant funds awarded in disaster areas in accordance with Federal regulations and FEMA guidance.  Specifically, the County could not provide documentation to support $4,602 in force account costs claimed.  Additionally, the subrecipient monitoring process needs improvement.  The State has not evaluated the risk of subrecipients’ noncompliance with Federal requirements, obtained subrecipient audit reports, or developed plans for monitoring subrecipients.  We made four recommendations that, when implemented, should improve Collier County, Florida’s management of FEMA PA funds.  FEMA concurred with our four recommendations. 

>Early Warning Audit of FEMA Public Assistance Grants to Collier County, Florida 		2020
OIG-20-77 Evaluation of DHS' Information Security Program for Fiscal Year 2019 2020
OIG-20-11 Weld County, Colorado did not always follow Federal procurement standards in awarding contracts for disaster work.  As a result of our review, we identified and discussed with FEMA various areas where it should review and adjust for cost reasonableness the funding amounts that a project and program management contractor charged related to Weld County.  FEMA agreed to review the costs for reasonableness, unless if FEMA disallowed all of the costs for procurement violations.  We subsequently reviewed FEMA’s cost analysis documentation for Weld County project closeouts related to this disaster.  We found that FEMA appropriately reduced final project amounts due to improper procurements and cost reasonableness concerns, including unreasonable contractor hourly rates.  Consequently, made no recommendations. 

>Review of Weld County, Colorado FEMA Grant Award Disaster No. 4145-DR-CO, Applicant No. 123-99123-00 		2020
OIG-20-45 We found violations of U.S. Immigration and Customs Enforcement (ICE) detention standards undermining the protection of detainees’ rights and the provision of a safe and healthy environment.  Although the conditions varied among the facilities and not every problem was present at each, our observations, interviews with detainees and staff, and review of documents revealed several common issues.  At three facilities, we found segregation practices infringing on detainee rights.  Detainees at all four facilities had difficulties resolving issues through the grievance and communication systems, including allegations of verbal abuse by staff.  Two facilities had issues with classifying detainees according to their risk levels, which could affect safety.  Lastly, we identified living conditions at three facilities that violate ICE standards.  We recommended the Acting Director of ICE ensure the Enforcement and Removal Operations field offices overseeing the detention facilities covered in the report address identified issues and ensure facility compliance with relevant detention standards.  We made one recommendation that will help ICE ensure compliance with detention standards. ICE concurred with the recommendation.

>Capping Report: Observations of Unannounced Inspections of ICE Facilities in 2019 		2020
OIG-20-74 The Cybersecurity and Infrastructure Security Agency (CISA) increased the number of Automated Indicator Sharing (AIS) participants as well as the volume of cyber threat indicators it has shared since the program’s inception in 2016.  However, CISA made limited progress in improving the overall quality of information it shares with AIS participants to effectively reduce cyber threats and protect against attacks.  The lack of progress can be attributed to the limited number of AIS participants sharing cyber indicators with CISA, delays in receiving cyber threat intelligence standards, and insufficient staff.  To be more effective, CISA should hire the staff it needs to provide outreach, guidance, and training.  We made four recommendations to CISA to enhance the program’s overall effectiveness and cyber threat information sharing.  CISA concurred with all four recommendations.  

>DHS Made Limited Progress to Improve Information Sharing under the Cybersecurity Act in Calendar Years 2017 and 2018 		2020
OIG-20-14-VR We determined that the Colorado Department of Public Safety, Division of Homeland Security and Emergency Management’s technical assistance and monitoring of the City of Evans’ (City) procurement and project-related activities are effective and that FEMA’s corrective actions met the intent of our recommendation 2.  We also determined that the City awarded contracts according to Federal regulations and FEMA guidelines.  If Colorado’s technical assistance and monitoring continue, FEMA should have reasonable assurance the City will spend the remaining $7.17 million in grant funds for eligible disaster work according to Federal regulations.

>Verification Review of the City of Evans, Colorado - OIG Audit Report (OIG-16-78-D) 		2020
OIG-20-43 DHS’ capability to counter illicit Unmanned Aircraft Systems (UAS) activity remains limited.  The Office of Strategy, Policy, and Plans did not execute a uniform department-wide approach, which prevented components authorized to conduct counter-UAS operations from expanding their capabilities.  This occurred because the Office of Policy did not obtain funding as directed by the Secretary to expand DHS’ counter-UAS capability.  We made four recommendations to improve the Department’s management and implementation of counter-UAS activities.  The Office of Strategy, Policy, and Plans concurred with all four of our recommendations.      

>DHS Has Limited Capabilities to Counter Illicit Unmanned Aircraft Systems 		2020
OIG-20-78 U.S. Customs and Border Protection (CBP) quickly deployed funding for consumables and medical services to address the needs of migrants in its custody along the southwest border, but did not adequately plan to ensure it used fiscal year 2019 funds effectively.  Specifically, U.S. Border Patrol’s process did not adequately ensure taxpayer funds were used to purchase items required to meet migrants’ basic needs as Congress intended.  Additionally, CBP relied on a single contracting officer’s representative, rather than onsite personnel, to oversee its medical contract because it did not include onsite monitoring when expanding the contract across multiple sectors.  We made four recommendations to CBP to improve its consumables reimbursement process and medical contract oversight.  CBP concurred with all four recommendations.  

>CBP Did Not Adequately Oversee FY 2019 Appropriated Humanitarian Funding 		2020
OIG-20-13 Through its Criminal Alien Program (CAP), U.S. Immigration and Customs Enforcement (ICE) can successfully identify aliens charged with or convicted of crimes.  However, because ICE relies on cooperation from other law enforcement agencies, it sometimes faces challenges apprehending aliens in uncooperative jurisdictions.  ICE’s inability to detain aliens identified through CAP contributes to increased risk those aliens will commit more crimes.  Furthermore, having to arrest “at-large” aliens may put officer, detainee, and public safety at risk and strains ICE’s staffing resources.  We made four recommendations to ICE focused on improving CAP.  ICE concurred with all four recommendations and initiated corrective actions to address the findings. 

>U.S. Immigration and Customs Enforcement’s Criminal Alien Program Faces Challenges 		2020
OIG-20-41 The Federal Emergency Management Agency (FEMA) Missouri, and Joplin Schools did not properly manage and oversee this disaster award.  Specifically, FEMA and Missouri did not provide proper grant management and oversight of Joplin’s subgrant activities.  Joplin Schools disregarded Missouri’s authority as the grantee and did not always comply with Federal requirements and FEMA policies as required.  This occurred because Joplin Schools heavily relied on the advice of its grant management contractor.  As a result of the grant management and oversight issues, Joplin Schools did not follow Federal procurement standards when it awarded $187.3 million in non-exigent disaster-related contracts, including $609,676 in ineligible contractor direct administrative costs.  We provided five recommendations to help improve FEMA and Missouri’s grant oversight and management process.  We also included four recommendations for FEMA to disallow or not fund $187.3 million in ineligible contract costs.  FEMA determined approximately $56 million, the net obligated amount, was eligible for reimbursement.  FEMA concurred with all nine recommendations and completed actions to close recommendations 1 to 4 and 8.  Recommendations 5 to 7 are resolved and open with a target completion date of June 1, 2020. Recommendation 9 is considered unresolved and open

>Inadequate Management and Oversight Jeopardized $187.3 Million in FEMA Grant Funds Expended by Joplin Schools, Missouri 		2020
OIG-20-76 The Federal Emergency Management Agency (FEMA) mismanaged the distribution of commodities in response to Hurricanes Irma and Maria in Puerto Rico.  FEMA lost visibility of about 38 percent of its commodity shipments to Puerto Rico, worth an estimated $257 million.  Commodities successfully delivered to Puerto Rico took an average of 69 days to reach their final destinations.  Inadequate FEMA contractor oversight contributed to the lost visibility and delayed commodity shipments.  FEMA did not use its Global Positioning System transponders to track commodity shipments, allowed the contractor to break inventory seals, and did not ensure documented proof of commodity deliveries.  Given lost visibility and delayed shipments, FEMA cannot ensure it provided commodities to Puerto Rico disaster victims as needed to sustain life and alleviate suffering as part of its response and recovery mission.  In addition, FEMA’s mismanagement of transportation contracts included multiple contracting violations and policy contraventions that ultimately led to contract overruns of about $179 million and at least $50 million of questioned costs.  We made five recommendations that, if implemented, should improve FEMA’s management and oversight of its disaster response activities. FEMA concurred with four of the five recommendations.  Recommendations 1 through 4 are considered open and resolved.  Recommendation 5 is considered resolved and closed

>FEMA Mismanaged the Commodity Distribution Process in Response to Hurricanes Irma and Maria 		2020
OIG-20-12 Aransas County’s procurement policies and procedures are not adequate to meet minimum Federal procurement regulations or address key procurement elements despite guidance and contacts with the Texas Department of Public Safety, Texas Division of Emergency Management (Texas).  We recommended the Regional Administrator, FEMA Region VI, require Texas to continue providing additional technical assistance and monitoring to the County, and provide to DHS OIG documentation supporting FEMA’s actions to that end.  FEMA officials agreed with both recommendations.  Prior to final issuance of this report, FEMA took action to resolve and close both recommendations.  No further action is required. 

>Aransas County, Texas, Needs Continued Assistance and Monitoring to Ensure Proper Management of Its FEMA Grant 		2020
OIG-20-42 We surveyed U.S. Immigration and Customs Enforcement (ICE) detention facilities from April 8-20, 2020 regarding their experiences and challenges managing COVID-19 among detainees in their custody and among their staff.  The facilities that responded to our survey described various actions they have taken to prevent and mitigate the pandemic’s spread among detainees.  These actions include increased cleaning and disinfecting of common areas, and isolating new detainees, when possible, as a precautionary measure.  However, facilities reported concerns with their inability to practice social distancing among detainees, and to isolate or quarantine individuals who may be infected with COVID-19.  Regarding staffing, facilities reported decreases in current staff availability due to COVID-19, but have contingency plans in place to ensure continued operations.  The facilities also expressed concerns with the availability of staff, as well as protective equipment for staff, if there were an outbreak of COVID-19 in the facility.  Overall, almost all facilities stated they were prepared to address COVID-19, but expressed concerns if the pandemic continued to spread.  At the time of our survey, 23 facilities reported having detainees who had tested positive for COVID-19; this number had risen to 48 facilities as of May 11, 2020.

>Early Experiences with COVID-19 at ICE Detention Facilities 		2020
OIG-20-73 DHS has not fulfilled most of the 13 responsibilities of the Geospatial Data Act.  To comply with one responsibility, DHS has a Geospatial Information Officer and a dedicated Geospatial Management Office whose duties include overseeing the Act’s implementation and to coordinate with other agencies.  However, DHS has only partially met, or not met, the remaining 12 responsibilities in the Act.  DHS’ lack of progress in complying with the responsibilities outlined in the Act can be attributed to multiple external and internal factors.  External factors include the need for additional guidance from the Federal Geographic Data Committee and the Office of Management and Budget to properly interpret and implement certain responsibilities.  Internal factors include competing priorities that diverted resources away from fulfilling the Act’s 13 responsibilities.  We made three recommendations that focus on increasing the resources necessary to comply with DHS’ 13 responsibilities under the Act.  The Department concurred with all three recommendations.

>DHS Faces Challenges in Meeting the Responsibilities of the Geospatial Data Act of 2018 		2020
OIG-20-10 As required under the Grants Oversight and New Efficiency (GONE) Act of 2016, Public Law 114-117, we conducted a risk assessment of FEMA’s grant closeout process to determine whether a full audit is warranted in the future.  We identified risks in three overarching areas:  Unreliable Systems of Record, Lack of Integration in Grant Closeout Policies and Guidance, and Delays in Grant Closeout and Deobligation of Funds.  As a result, we may conduct a full audit of FEMA’s grant closeout process at a future date.  DHS and FEMA concurred with our risk assessment results.  We made no recommendations to FEMA.

>Risk Assessment of FEMA's Grant Closeout Process 		2020
OIG-20-39 KPMG found FEMA did not always ensure that the Virgin Islands Emergency Management Agency (VITEMA), and Virgin Islands Water and Power Authority (VIWAPA) established and implemented policies, procedures, and practices to account for and expend PA disaster grant funds in accordance with Federal regulations and FEMA guidance.  Specifically: 1) VITEMA did not have policies and procedures to ensure the timely submission of management costs for reimbursement; 2) VIWAPA did not fully ensure contract costs were reasonable and allowable; and 3) Neither VITEMA nor VIWAPA had fully implemented FEMA’s Grants Manager and Grants Portal system.  This occurred because FEMA did not consistently provide adequate oversight.  Because of these deficiencies, there is increased risk the PA program may be mismanaged and funds may be used for unallowable activities.  We made three recommendations that, when implemented, should improve FEMA’s, VITEMA’s, and VIWAPA’s management of FEMA PA funds.  FEMA concurred with all three recommendations. 

>Capacity Audit of FEMA Grant Funds Awarded to the USVI Water and Power Authority 		2020
OIG-20-72 Oversight Review of the Office of the Chief Security Officer, Internal Security Division 2020
OIG-20-08 We verified that Refugio County, Texas awarded contracts that complied with Federal procurement regulations and FEMA guidelines.  We determined that the County initially did not have written procurement policies to comply with all Federal procurement regulations.  Instead, for purchases and contracting, County officials said they followed Texas Local Government Code, Chapter 262.  In response to our audit, the County adopted written procurement procedures to comply with Federal requirements.  The report contains no recommendations.  FEMA did not submit a formal response to our draft report, but informally replied that it did not identify any issues requiring further action by FEMA.

>Refugio County, Texas, Has Implemented Adequate Procurement Policies, Procedures, and Business Practices to Manage Its FEMA Grant 		2020
OIG-20-40 Two years since enactment, DHS and its components have mostly complied with SAVE Act requirements.  The SAVE Act requires the Office of the Chief Readiness Support Officer (OCRSO), as delegated by DHS, to collect and review components’ vehicle use data, including their analyses of the data and plans for achieving the right types and sizes of vehicles to meet mission needs.  Most components developed their plans as required.  However, only two of the 12 components we reviewed fully met requirements to analyze and document vehicle use and cost data to help them achieve the right type and size of fleet vehicles to meet their missions.  This occurred because DHS did not require components to include data analyses in their OCRSO-reviewed submissions, as mandated by the SAVE Act.  Had ORSCO thoroughly evaluated component submissions, it would have identified that components did not fully comply with SAVE Act requirements.  DHS concurred with all four recommendations that, when implemented, should improve the Department’s oversight over its vehicle fleets. 

>DHS Has Made Progress in Meeting SAVE Act Requirements But Challenges Remain for Fleet Management 		2020
OIG-20-71 U.S. Customs and Border Protection (CBP) did not adequately safeguard sensitive data on an unencrypted device used during its facial recognition technology pilot (known as the Vehicle Face System).  A subcontractor working on this effort, Perceptics, LLC, transferred copies of CBP’s biometric data, such as traveler images, to its own company network.  The subcontractor obtained access to this data without CBP’s authorization or knowledge, and compromised approximately 184,000 traveler images from CBP’s facial recognition pilot.  Later in 2019, the Department of Homeland Security experienced a major privacy incident, as the subcontractor’s network was subjected to a malicious cyber attack.  While CBP and DHS took immediate action to mitigate the data breach, we attribute this incident to the subcontractor violating numerous DHS security and privacy protocols for safeguarding sensitive data.  Consequently, this incident may damage the public’s trust in the Government’s ability to safeguard biometric data, and may result in travelers’ reluctance to permit DHS to capture and use their biometrics at U.S. ports of entry.  We made three recommendations to aid CBP in addressing the vulnerabilities that caused the 2019 data breach, and to better mitigate future incidents through greater oversight of third-party partners.  CBP concurred with all three recommendations.

>Review of CBP's Major Cybersecurity Incident During a 2019 Biometric Pilot 		2020
OIG-20-09 DHS developed a strategy to apply 29 lessons learned from prior system updates to the current Financial Systems Modernization (FSM) TRIO program. Since DHS’ actions provides a positive outlook on the future progress of the FSM TRIO project we made no recommendations for improvement.  The report’s limited objective and scope does not provide a complete assessment DHS’ efforts to incorporate lessons learned into their recently reinvigorated FSM efforts. 

>DHS Confirmed It Has Applied Lessons Learned in the Latest Financial System Modernization Effort 		2020
Department of Homeland Security Section - Top Challenges Facing Federal Agencies: COVID-19 Emergency Relief and Response Efforts 2020
OIG-20-63 As of October 2016, the Recovery School District in Louisiana (RSD) had received a $1.5 billion Public Assistance grant from Louisiana, a Federal Emergency Management Agency (FEMA) grantee, for damages resulting from Hurricane Katrina.  We examined $1.3 billion for a consolidated project as part of the total amount awarded.  In some instances, RSD accounted for and expended portions of the $1.3 billion in Public Assistance grant funds we reviewed according to Federal regulations.  However, FEMA improperly awarded $216.2 million to repair or replace more than 292 Orleans Parish school facilities in RSD.  We made eight recommendations to FEMA to de-obligate $216.2 million of ineligible costs; follow Federal regulations and FEMA guidelines; and re-evaluate documented proof of assessments for the 35 identified projects and reclassify them, as appropriate, to repair-eligible, and de-obligate the cost difference.  FEMA concurred with recommendations 2 through 7 but did not concur with recommendations 1 and 8.  We consider recommendations 2 through 7 resolved and open; recommendations 1 and 8 are unresolved and open.

>FEMA Should Recover $216.2 Million Awarded to the Recovery School District in Louisiana for Hurricane Katrina 		2020
OIG-20-07 Between 2011 and 2018, U.S. Customs and Border Protection (CBP) processed an average of $896 million in drawback claims annually; however, a lack of internal controls could affect the validity and accuracy of the drawback claims amount.  This occurred, in part, because CBP did not address internal control deficiencies over drawback claims.  The Department of Homeland Security Fiscal Year 2018 Independent Auditor’s Report on Financial Statements and Internal Control over Financial Reporting identified reoccurring CBP internal control deficiencies over drawback claims.  CBP has outlined plans to correct these deficiencies by implementing an updated data processing system and revising legislative procedures.  Without correcting these repeated control deficiencies, CBP cannot determine drawback claims’ validity and accuracy.  These corrective actions are ongoing; therefore, we could not verify during our audit whether CBP remedied the identified internal control deficiencies. Our report contains no recommendations.  

>Lack of Internal Controls Could Affect the Validity of CBP’s Drawback Claims 		2020
OIG-20-38 During 2019, there was a surge in Southwest Border crossings between ports of entry, resulting in 851,508 Border Patrol apprehensions and contributing to what senior U.S. Customs and Border Protection (CBP) officials described as an “unprecedented border security and humanitarian crisis.”  Our unannounced inspections revealed that, under these challenging circumstances, CBP struggled to meet detention standards.  Specifically, several Border Patrol stations we visited exceeded their maximum capacity.  Although Border Patrol established temporary holding facilities to alleviate overcrowding, it struggled to limit detention to the 72 hours generally permitted, as options for transferring detainees out of CBP custody to long-term facilities were limited.  Also, even after deploying medical professionals to more efficiently provide access to medical care, overcrowding made it difficult for the Border Patrol to manage contagious illnesses.  Finally, in some locations, Border Patrol did not meet certain standards for detainee care, such as offering children access to telephone calls and safeguarding detainee property.  In contrast to Border Patrol, which could not control apprehensions, CBP’s ports of entry could limit detainee access, and generally met applicable detention standards.  Supplementing a May 2019 Management Alert recommendation, we made two additional recommendations regarding access of unaccompanied alien children to telephones and proper handling of detainee property.  CBP concurred with the recommendations.

>Capping Report: CBP Struggled to Provide Adequate Detention Conditions During 2019 Migrant Surge 		2020
OIG-20-68 The Federal Emergency Management Agency (FEMA) is not adequately managing severe repetitive loss (SRL) properties covered by the National Flood Insurance Program (NFIP).  FEMA has not established an effective program to reduce or eliminate damage to SRL properties and disruption to life caused by the repeated flooding.  Primarily, FEMA does not have reliable, accurate information about SRL properties.  Secondly, FEMA’s Flood Mitigation Assistance (FMA) program, which aims to mitigate flood damage for NFIP policyholders, provides neither equitable nor timely relief for SRL applicants.  We made three recommendations to FEMA to ensure the accuracy of the SRL list, as well as equitable and timely distribution of mitigation funding, and promoting the use of National Flood Insurance Program (NFIP) Increased Cost of Compliance coverage.  FEMA concurred with all three of the recommendations

>FEMA Is Not Effectively Administering a Program to Reduce or Eliminate Damage to Severe Repetitive Loss Properties 		2020

*NDAA, Pub. L. 117-263, section 5274 Response Received. View responses

Return to top of page