Summary

  • GAO compared documented award-oversight and fraud-prevention procedures in five selected federal programs against nine requirements and leading practices. The FCC's Universal Service Program for Schools and Libraries, known as E-Rate, had documented procedures for all nine.
  • DOE's Regional Clean Hydrogen Hubs program fully met four of the nine design practices, partially met the risk-profile practice and did not meet four: program-specific risk assessment, written antifraud strategy, stakeholder coordination and risk-based monitoring.
  • GAO made five recommendations to DOE on those gaps. The official product page lists all five as open. The comparison measures policy design and documentation; proof that controls operate and awards are protected requires later records of assessment, decisions and monitoring.

One binder has a route through the risk

The GAO audit looked at a deceptively plain question: when a federal program hands out contracts, grants or loans, can its managers show the written procedures by which they identify fraud risks, respond to them and monitor the response? The audit selected five programs and nine requirements or leading practices. Together, the five agencies had about $227 billion in funding under the infrastructure, climate and semiconductor laws for relevant programs. That is funding context, not an amount the audit found lost.

The contrast in GAO's table is sharp. The FCC's school and library connectivity program had documented procedures for all nine practices. The Department of Energy's Regional Clean Hydrogen Hubs, or H2Hubs, fully met four, partly met the requirement to maintain agencywide and program-specific risk profiles, and missed four. The missing pieces were not decorative appendices. They describe the passage from knowing the program's specific exposures to choosing a response, sharing information with partners and checking whether the response works.

E-Rate is a useful comparator because it shows the paperwork is possible under the same federal control vocabulary. Its nine filled boxes do not settle how well every procedure works in the field. GAO assessed the design recorded in policies and procedures. But a blank program-specific assessment has its own consequence: managers cannot point to a common, dated description of which fraud routes they expected in a hydrogen-hub award and which checks they built for them.

The hydrogen program's missing sequence

A generic anti-fraud commitment can hang on any agency wall. A program-specific assessment has to name how this program spends, who submits claims, who verifies milestones and where false information could change a decision. GAO found H2Hubs had not established procedures for regular fraud-risk assessments tailored to it. Without that first step, a program risk profile cannot reliably tell managers whether their existing controls meet the distinctive risk.

The next missing piece was a documented antifraud strategy: the chosen responses to identified risks. GAO also found no documented process for collaborating with stakeholders on fraud risks and lessons learned, and no procedures to monitor fraud-risk management activities across the framework. Those four gaps form a chain. If the program has not written down a tailored assessment, its strategy is hard to test. If partners do not share warning signs, the strategy ages in private. If no one monitors the whole cycle, a control can remain on paper after the award and still be reported as present.

The full report identifies five DOE recommendations: tailored recurring assessments, a program risk profile, an antifraud strategy, stakeholder information sharing and monitoring. DOE agreed and described intended actions. The official GAO product page still marks all five open. A plan to write a plan is one step in a queue, not the operating record. The next public evidence is the documents themselves and a later GAO status change supported by how the program used them.

Four other programs complicate the neat scorecard

The comparison includes Commerce's CHIPS for America Fund, HHS's Health Center Program and EPA's Greenhouse Gas Reduction Fund alongside E-Rate and H2Hubs. Four of the five had at least one selected requirement or practice absent or only partly reflected in documented procedures. The EPA program was repealed by statute in July 2025; its audit row describes the design reviewed, not a current grant pipeline.

The Commerce row supplies a useful warning against stale scorecards. GAO originally found no documented consideration of recovery audits for potential overpayments in CHIPS. Commerce disputed the recommendation, then supplied a statement of actions; GAO confirmed a memorandum recording Commerce's decision not to use recovery audits at that time and marked the recommendation closed as implemented. The result was a documented decision and an annual reconsideration commitment, not the adoption of recovery audits. HHS also later closed a recommendation on its Health Center Program risk profile after documenting it.

Recommendation status can move without rewriting the original table.

The federal system has enough slogans about payment integrity. GAO's nine practices ask for a sequence that an outsider can inspect: risk, response, partner information and monitoring. E-Rate had written a route through all nine. H2Hubs still owed the documents that would show how its own route works.

Sources