Federal Response to Unauthorized Grant Disbursements
The Health and Human Services (HHS) Office of Inspector General (OIG) has identified vulnerabilities in the HHS Program Support Center's (PSC) grant payment system, leading to a significant amount of fraud. The OIG attributed the vulnerability to a control environment that did not facilitate fraud mitigation and insufficient oversight.
In a series of audits, the OIG discovered that the PSC lacked effective internal controls and adequate risk management. The audits revealed that bad actors gained access to the system using fake grant recipient email addresses, masqueraded as grant recipients, requested bank account changes, and diverted grant payments to their own accounts.
In response, the Assistant Inspector General for the Office of Audit Services at the Department of Health and Human Services, Tamara Lilly, made six recommendations to improve the PSC's controls over its grant payment system. These recommendations focus on tightening internal controls around payment processes, improving communication and oversight structures, enforcing compliance with grant conditions, and correcting identified improper payments.
The key recommendations include implementing corrective actions for improper payments, revising interagency agreements, strengthening internal control systems, ensuring compliance with salary rate limitations, and enhancing expenditure reporting and eligibility verification processes.
As of mid-2025, HHS has begun taking corrective actions to reduce identified fraud risk, although some recommendations remain open and unimplemented. For instance, refunding specific improper payments is pending. However, the Department has introduced updated policies, such as the HHS Grants Policy Statement effective October 2024, mandating controls on salary payments and indirect cost rates.
Tamara Lilly emphasised the importance of assessing risks, implementing controls to mitigate those risks, training staff, and regularly verifying that controls are operating effectively. She also highlighted the need for PSC to continue on the right path and for the Office of Inspector General to continue checking on PSC and receiving updates to ensure compliance.
For cyber-specific cybersecurity controls, the National Institutes of Standards and Technologies publications are referred to for guidance. In the audit environment, the GAO's Green Book is recommended for establishing a solid internal control structure, and OMB circulars and memos are relied upon for risk assessment and implementing cybersecurity controls.
It is crucial to note that the diverted funds were intended for HHS programs aimed at advancing the health and well-being of the people they serve. From March 2023 through January 2024, bad actors diverted nearly $8 million from the Health and Human Services grant payment system.
The PSC concurred with all six of the recommendations and has begun implementing corrective actions since the fraud was detected in January 2024. The OIG continues to track implementation progress publicly and issues ongoing audits, with corrective steps including enhanced communication protocols between agencies processing payments.
In conclusion, the OIG's recommendations aim to strengthen the PSC's grant payment system, minimise fraud risk, and ensure that funds are utilised effectively for their intended purpose. The PSC is encouraged to continue implementing these measures to protect the integrity of the grant payment system and the services it supports.
- The federal workforce, specifically at the Health and Human Services (HHS) Program Support Center (PSC), needs to reimagine its control environment to mitigate fraud risks and ensure effective health-and-wellness funding, as identified by the OIG's audits.
- To fortify the PSC's grant payment system, the workforce should focus on the implementation of internal controls, improving communication structures, enforcing compliance with grant conditions, and strengthening science-based health-and-medical-conditions eligibility verifications, as per the Office of Inspector General's recommendations.
