Bureaucracy Times

All the news fit to be declassified.

Category: Federal Agencies & Oversight

  • The Two Year Emergency Order That Needed Seven Years and an Act of Congress to End

    In February 2018, the DEA declared an emergency. Fentanyl related substances, a class of chemicals built by tweaking fentanyl’s molecular structure just enough to dodge existing schedules, were flooding the illicit drug supply, and DEA used its statutory power to temporarily place the entire class into Schedule I. Temporary scheduling orders under the Controlled Substances Act are built to last two years, occasionally three if a permanent scheduling case is pending. This one lasted more than seven, according to a new GAO report on federal drug scheduling, because the process built to handle individual substances had no idea what to do with a class that might contain twenty four million of them.

    The math is not a typo. FDA officials told GAO that depending on which chemical variations you count as valid modifications, the fentanyl related substance class could encompass close to twenty four million distinct chemicals. The Controlled Substances Act requires an individualized scientific and medical evaluation for each substance before it can be permanently scheduled through the normal administrative process. Evaluating twenty four million compounds one at a time, within any statutory deadline that has ever existed, was never going to happen.

    An Emergency Order Standing In for a Law

    DEA formally asked HHS to begin evaluating fentanyl related substances in April 2019, more than a year after the temporary order took effect. HHS did not start sending evaluations back until July 2020. By then the original two year clock was already running out, and Congress had to step in repeatedly just to keep the temporary order from lapsing entirely, extending it in pieces until a hard deadline of September 30, 2025. For most of a decade, in other words, the legal basis for federal fentanyl prosecutions rested not on a permanent, individually justified schedule placement, but on a standing emergency declaration that kept getting renewed because nobody had a better option.

    GAO’s report treats this almost gently, as a case study in “how legislative scheduling can address certain challenges with administrative scheduling.” That framing undersells what actually happened. The administrative process is the one Congress designed to require scientific rigor, an eight factor analysis of abuse potential, medical use, and public health risk, substance by substance. When that process could not scale, the answer was not to fix the process. It was to let an emergency order function as de facto permanent law for seven years, then have Congress skip the individualized evaluation requirement entirely.

    Congress Legislates Around Its Own Statute

    In July 2025, Congress passed the HALT Fentanyl Act, permanently placing all fentanyl related substances into Schedule I as a class, with mandatory minimum sentences including ten years for trafficking one hundred grams or more of any fentanyl analog. Legislative scheduling does not require a scientific and medical evaluation of any kind. Congress can schedule a substance by simple statute regardless of whether it independently meets the Controlled Substances Act‘s own criteria, and in this case it scheduled millions of substances that had never been individually evaluated, because the agency process that was supposed to evaluate them had spent seven years failing to keep pace with the chemistry.

    GAO’s own prior work flagged what this means in practice. Research organizations interviewed for a 2021 GAO report on the same subject warned that class wide scheduling without individualized review risks convicting people over substances that later analysis might show have little or no actual abuse potential. Criminal justice stakeholders went further, warning that sweeping penalties onto an undefined and expanding chemical class could produce lengthy federal sentences for trace amounts and deepen existing racial disparities in sentencing, concerns that did not stop the legislation and do not appear to have been resolved by it. The HALT Act’s fix for a broken administrative process was not to make that process work. It was to make the process legally irrelevant for this entire category of drugs.

    Congress did carve out one narrow accommodation while it was at it. The Act eased registration requirements for research institutions studying fentanyl analogs, allowing multi site studies under a single license instead of the old substance by substance paperwork. That provision quietly concedes the same point the rest of the law ignores, that these chemicals are different enough from one another to require individual study when the purpose is understanding them, but not different enough to require individual review when the purpose is prosecuting someone for possessing them. The bar for scientific caution turned out to depend entirely on which side of the courtroom was asking.

    What Happens Now That the Science Stopped Mattering

    Since the HALT Act passed, FDA told GAO it has not received a single new request to evaluate a fentanyl related substance for the purpose of scheduling, because there is nothing left to schedule; Congress already did it, permanently, for the whole class, present and future. FDA officials said they may still occasionally review a specific substance, mostly to authorize research into it rather than to inform any scheduling decision, since the scheduling decision has already been made regardless of what the research finds. As of this spring, FDA had evaluated forty six fentanyl related substances at DEA’s request under this narrower, research only track.

    That is the actual shape of where this ended up. A federal drug law that was supposed to run on individualized scientific findings now runs, for an entire and still expanding class of substances, on a blanket legislative designation passed because the science could not keep pace with the chemistry and nobody wanted to say so out loud for seven years. The emergency order worked exactly as designed, as a stopgap. The failure was in treating the stopgap as an acceptable substitute for the law it was supposed to hold a place for, for longer than most federal sentences run.

    Nobody in this story made an obviously wrong call at any single step. DEA was right to act fast in 2018 against a genuine public health emergency. HHS was not unreasonable to take time evaluating chemistry nobody fully understood yet. Congress was arguably right that waiting for twenty four million individual evaluations was never a serious option. The failure is structural rather than personal, which is exactly why GAO’s report treats it as a footnote to a larger story about missing paperwork rather than the headline it probably deserves on its own. A statute built around individualized scientific findings quietly stopped requiring any, for the drug category currently killing more Americans than any other, and it took seven years and an act of Congress for anyone to say so plainly.

    Sources: U.S. Government Accountability Office, Drug Scheduling: DEA and HHS Face Challenges in the Administrative Process (GAO-26-108623, September 2026); GAO-21-494, Fentanyl Analogues: Agencies Addressing Scheduling Challenges But Face Broader Issues (2021); HALT Fentanyl Act, Public Law 119-26 (signed July 16, 2025).

    Fediverse Reactions

  • The Department of Veterans Affairs Discovers a New Definition of “Still Under Review”

    Somewhere in the sprawling apparatus of the Veterans Health Administration, a manager looked at a growing backlog of unreviewed medical requests and arrived at an elegant solution. Rather than review them, VHA staff would simply tell providers the request was still being reviewed, close it, and move on. A new inspector general audit confirms the practice was still running as recently as April 2026, which is the kind of detail that should end careers and will instead end up in a corrective action plan with a target completion date sometime next year.

    The VA Office of Inspector General‘s audit of “requests for services,” the mechanism by which community providers ask VHA to approve additional care beyond what a veteran was originally authorized to receive, examined 2.6 million such requests filed between October 2024 and January 2026. The Community Care Field Guidebook requires a decision and notification within three business days. Nationally, that standard was met 17 percent of the time. At one facility the OIG visited, the compliance rate was 5 percent.

    Numbers like that are what happens when an institution optimizes for the appearance of a metric instead of the substance behind it, and nowhere in this report is that clearer than in what OIG politely calls “inappropriate processing.”

    A Denial Dressed Up as Patience

    At one of the four medical facilities the OIG team visited on site, community care staff told investigators that managers had instructed them to close out requests for services on the fourth day after they entered the system, whether or not a delegated clinician had actually reviewed the case. The kicker is what staff were told to send the provider: a letter stating the request was still under review, even as the system recorded it as denied.

    According to a community care nurse interviewed for the audit, the Consult Toolbox used to once offer a “needs more time” option for exactly this situation. That option disappeared. Two staff members told OIG that once it vanished, only “approval” and “denial” remained, so staff began selecting denial and appending a note reading “still under provider review” before sending it out on schedule, day four, like clockwork.

    This is not a backlog. A backlog is what happens when demand outpaces capacity and a queue grows. What OIG documented is a workaround built specifically to generate compliant looking output while the underlying clinical decision never happened. The community care chief at that facility confirmed to investigators that the practice was still in effect as of April 2026, months after the audit period covered by the report had already closed, which suggests this was not a temporary emergency measure but a standing operating procedure.

    The Fourth Day Ritual

    Understanding why this matters requires understanding what a “request for services” actually is. It is not the initial referral to a community provider; it is what happens when that provider, mid treatment, determines the veteran needs more care than was originally authorized, additional visits, an extended course of therapy, a follow up procedure. Until VHA approves it, per the agency’s own guidebook, no additional care is supposed to be provided or paid for.

    So a denial letter that falsely claims the request is “still under review” does not just misinform a provider about paperwork status. It leaves the provider in the position of having to guess whether to continue treating the veteran without authorization, at the provider’s own financial risk, or to halt care and wait for a decision that, per this scheme, was never coming through proper channels in the first place. OIG’s report notes elsewhere that when denials go undocumented or improperly communicated, providers may keep delivering care that ultimately goes unauthorized and unpaid, leaving either the veteran or the provider holding the bill.

    None of this is incidental to the broader findings. Across the full 2.6 million request sample, only about 1.4 million, 54 percent, had any documented notification at all. The other 46 percent simply vanished into the record with no evidence anyone was ever told anything. The fabricated “still under review” letters are simply the one facility where investigators caught the mechanism in the act rather than inferring it from an empty data field.

    Nobody Is Watching the Watchmen, Because the Watchmen Quit

    How does a practice like this survive long enough for a federal auditor to walk in and document it in real time. The answer, per OIG, is that VHA’s oversight of this process is close to nonexistent. The agency’s own national performance report, the one tool that might have flagged a facility with a 95 percent noncompliance rate, was quietly discontinued in February 2025 after officials decided the underlying data could not be trusted. As of this audit, seventeen months later, no replacement had been implemented; VHA’s projected launch date is September 2026, which by pure coincidence is also the publication date stamped on this report.

    In the interim, community care staff at another facility resorted to tracking their caseloads the old fashioned way, with thirty separate nurses keeping thirty separate spreadsheets, no shared system, and no way to know whether a request assigned to one nurse’s tracker had already been resolved somewhere else. This is what institutional oversight looks like when the institution has given up on building oversight and left it to individual employees armed with Excel.

    The Under Secretary’s Concurrence, and Other Bureaucratic Absolutions

    VHA’s response to all six of OIG’s recommendations was concurrence, which in federal audit parlance means agreement in principle and very little else in practice. The acting under secretary for health promised to reinforce training on notification procedures, evaluate system capabilities, and eventually build a functioning national report. Every action item carries the same target completion date, July 2027, nearly a full year from now, for a scheme that OIG confirmed was actively deceiving veterans and providers as of this spring.

    There is no recommendation addressing accountability for the manager who ordered the practice, no mention of referral for discipline, no acknowledgment that what happened at that facility was not a process failure but a decision, made by someone, to fabricate the appearance of compliance rather than deliver it. The report notes that three cases uncovered during this audit were serious enough to be referred to OIG’s Office of Healthcare Inspections for review of potential clinical harm. One of those was referred to the local medical facility itself for further review, which is a bit like asking the fox to audit the henhouse’s security footage.

    VHA will spend the next several months evaluating, assessing, and reinforcing its way toward compliance with a three-day standard it already had, has had for years, and simply chose not to follow. The veterans waiting on denial letters that arrived dressed as patience were, in the meantime, the only ones actually kept honestly informed. Informed, that is, of the wrong thing, on schedule, every single time.

    Sources: VA Office of Inspector General, Audit of VHA’s Processing of Requests for Services for Community Care (Report No. 25-03946-211, September 2026).

    Fediverse Reactions

  • The $1.4 Billion HUD Couldn’t Be Bothered to Count

    For nine consecutive years, the Department of Housing and Urban Development has known, by its own admission, that its largest rental subsidy program is “susceptible to significant improper payments.” For nine consecutive years, it has declined to say by how much. Not because the number is unknowable. Because in 2017 HUD fired the contractor whose job it was to know, and simply never got around to hiring a replacement.

    That is the opening fact of HUD OIG Report 2026-FO-0006, and it is worth sitting with before the number arrives, because the number is the least interesting part. Any auditor can find a bad statistic. What OIG actually documented is an agency that spent nearly a decade in willful, well-funded ignorance of its own $38.4 billion program, then disputed the homework once someone else finally did it.

    An Agency That Outsourced Its Own Curiosity

    The Public and Indian Housing Tenant-Based Rental Assistance program, known more casually as Section 8 or the Housing Choice Voucher program, is the federal government’s largest direct rental subsidy. It moved $38.4 billion in fiscal 2025, 43 percent of HUD’s entire budget, through roughly 2,200 local Public Housing Agencies that calculate each household’s subsidy using a formula built from income, deductions, rent reasonableness, and utility allowances. It is, by design, decentralized, manual, and dense with judgment calls, which is precisely why the Payment Integrity Information Act requires HUD to estimate how often the formula gets applied wrong.

    HUD used to pay a contractor to run that estimate every year. It discontinued the contract in 2017 and has not produced a figure since, citing “decentralized payment processes, dated and disparate systems” and a familiar chorus of complexity. OIG did not accept complexity as an excuse; it built the estimate HUD wouldn’t. Auditors pulled a stratified sample of 300 payments from the 2.3 million monthly housing assistance payments on the books in March 2025 and checked each one against the underlying documentation.

    Seventy-four were wrong. That is 25 percent, one in four, extrapolated to a projected $1.43 billion a year in improper payments, a number OIG discounted downward for statistical caution before publishing it, meaning the real figure is probably higher, not lower.

    Where the Money Actually Leaks

    The errors sort into a fairly mundane taxonomy, which is itself the point; nothing here required fraud, only inattention. Income miscalculations accounted for the largest share (PHAs entering figures that didn’t match pay stubs, relying on stale documentation, or simply skipping verification against HUD’s own income-matching system). Utility allowance errors came next, PHAs applying the wrong schedule or the wrong unit size to a calculation most of them still do by hand. Then there is a category OIG calls “program compliance,” meaning the PHA skipped a required step entirely, no annual reexamination, no rent reasonableness analysis, no verified immigration status, and got the whole payment marked improper as a result, not because the dollar amount was necessarily wrong but because nobody could prove it wasn’t.

    That distinction matters more than it sounds. OIG also logged 13 “technically improper” payments, cases where the PHA broke a rule but the dollar amount happened to land correctly anyway, pure luck rather than diligence. The audit treats those as a warning sign rather than a reprieve; the same shortcuts that produced a correct number this month are exactly the shortcuts that will produce a wrong one next month.

    Then there is HOTMA, the Housing Opportunity Through Modernization Act, signed in 2016 with instructions to raise the medical and disability expense deduction threshold and the elderly and disabled household allowance. Ten years later, HUD’s own system still runs the old, lower thresholds, because the software meant to replace HUD’s aging PIC system, itself a replacement project HUD started in 2021, still has no launch date. A statute a decade old, unenforced, because the agency’s internal IT timeline has quietly outlived the urgency that produced the law in the first place.

    The Monitoring That Wasn’t

    If the errors were merely common, that would be one story. What makes it worse is how little anyone at HUD was watching for them. The agency ran 19 targeted “Calculation of HAP, Adjusted Income, and Rent” reviews in fiscal 2023 and has run zero since. In fiscal 2025, HUD completed 14 total Compliance Monitoring Reviews, covering nine separate program areas, for a portfolio of 2,200 housing agencies and 2.3 million households. That is not oversight so much as its rumor.

    PHAs, for their part, were not shy about explaining why, once OIG actually asked. Understaffed offices process tens of thousands of annual reexaminations with no time to verify small, fluctuating income sources like child support or unemployment benefits. HUD’s own income-verification tool, the Enterprise Income Verification system, updates quarterly and simply doesn’t capture pensions, TANF, or state benefit income at all, meaning the tool HUD requires PHAs to use cannot see a meaningful share of the income it’s supposed to catch. Guidebooks on calculating rent and running reexaminations haven’t been updated since 2019 and 2020 respectively, years before several of the rule changes they’re supposed to explain.

    The Part Where HUD Argues With the Math

    Faced with all this, the Office of Public and Indian Housing did what agencies under audit reliably do, agreed with the spirit and quibbled with the specifics. PIH accepted the recommendation to work on simplifying HAP calculations and to develop better monitoring. It rejected the recommendation to embed a mandatory documentation checklist into its own system, for the reasonable-sounding but conveniently timed reason that its legacy IT platform can’t support it. And it declined to concur with the $1.43 billion figure itself, saying it was still waiting on additional information from OIG.

    OIG’s rebuttal, printed in the report without much editorializing needed, lays out a timeline; final results shared with PIH in March 2026, three follow-up meetings in April to walk through methodology sample by sample, and no further request for information from PIH until July, three months after the walkthroughs concluded. The agency that spent nine years unable to produce its own improper payment estimate spent another four months sitting on someone else’s before deciding it needed more homework.

    PIH’s written response includes one more line worth quoting in spirit if not verbatim, namely that the risk of error is “largely outside of PIH’s direct control,” a structural feature of a complex, decentralized statute rather than a management failure. That may even be half true. It is also the sentence every agency reaches for once the number gets big enough to need one, and it is a strange thing to say about a program HUD chose, for nine years running, not to measure at all.

    Source: HUD Office of Inspector General, Report 2026-FO-0006, “HUD’s Public and Indian Housing Tenant-Based Rental Assistance Program Had Significant Improper Payments,” September 17, 2026.

  • The Agency That Fired the People Who Knew Where the Files Were

    When GAO auditors asked the General Services Administration for basic records on which federal buildings it had sold, and when, and how long each sale took, the agency handed over a dataset in which nearly 45 percent of the values were missing across the two fields that mattered most. Not obscure fields. The Acceptance Date and the Completed Disposal Date, the start and finish lines of the entire disposal timeline GAO was asked by statute to evaluate. GSA runs the federal government’s primary real estate disposal program. It could not, on the first attempt, produce a clean accounting of its own recent transactions.

    Half the Staff, All of the Institutional Memory

    The explanation, once GAO pressed for it, tracks a specific and traceable event. In March 2025, GSA’s Public Buildings Service began a major reorganization that cut staffing levels by roughly 50 percent. GSA officials told auditors that even after producing a revised dataset, still missing about 6 percent of values in the same two fields, they could not fill in the remaining gaps because the staff who had worked on those specific disposal projects were no longer employed by the agency.

    Sit with the shape of that admission. This isn’t a case of records being lost to a server failure or a filing error. The people were the record. Once they left, the knowledge of what happened on individual property sales left with them, because nobody had apparently built a system robust enough to survive the departure of the humans who ran it. A disposal program depends on knowing when a building was accepted for sale and when the sale closed. GSA cut the workforce that tracked those two dates by half and then discovered, when someone finally asked, that it could no longer fully answer the question.

    Not a New Complaint, Just a Newly Confirmed One

    This is where the story stops being a one-off staffing hiccup and starts looking like a pattern GAO has been circling for years. In April 2026, a separate GAO review concluded that GSA was not using quality disposal data and recommended the agency establish a formal plan to ensure the reliability of its sales and disposal records going forward. GSA agreed with that recommendation. As of August 2026, it remained open, meaning the agency has acknowledged the problem in writing and has not yet fixed it.

    The Public Buildings Reform Board, for its part, told GAO it has its own version of the same complaint. Data in the Federal Real Property Profile, the government’s central database for tracking what it owns, was described by Board officials as unreliable and potentially inaccurate on something as basic as a building’s deferred maintenance needs. The Board also noted that OMB’s last formal call for agency disposal candidate data before January 2025 went out in October 2020, a gap of nearly five years during which the underlying inventory the entire disposal apparatus runs on simply wasn’t being refreshed.

    A Program Built on Records It Can’t Verify

    None of this data infrastructure is incidental to FASTA’s mission. The entire premise of the program, that the government can systematically identify unneeded buildings and dispose of them faster than the traditional process allows, depends on knowing what the government owns, what condition it’s in, and how long past disposals actually took. GAO’s own statistical analysis of disposal timelines, the one that found FASTA properties sold roughly five months faster than non-FASTA ones, had to be built on a dataset with known, acknowledged gaps, gaps the agency running the program could not close because it no longer employed the people who could have closed them.

    The irony writes itself without much help. A law designed to speed up how quickly the government sheds property it doesn’t need is administered by an agency that, mid-implementation, shed roughly half its own staff and then couldn’t fully reconstruct the paper trail on the properties it had already sold. GSA says it’s working on it. The recommendation to fix the underlying data quality problem has been open since 2022, reaffirmed in 2026, and remains open still. Somewhere in that gap between acknowledgment and correction is where a federal real estate program has been quietly running for the better part of a decade, on records nobody can fully vouch for.

  • VA Can’t Count Its Own Toxic Exposures Staff. It Also Can’t Track What They Do.

    The Department of Veterans Affairs has spent $51.7 billion since 2022 out of a fund built to make good on the PACT Act’s promise to veterans exposed to burn pits, Agent Orange, and every other slow poison the military handed out alongside a rifle. Congress just added another $52.7 billion for FY2026. And according to a new VA Office of Inspector General audit, the Veterans Benefits Administration cannot say with confidence how many people it actually pays out of that fund, let alone what any of them do all day.

    The Missing Forty-Three

    Every six months, VBA is supposed to run a recertification process, essentially a roll call, to justify the continued need for central office staff hired using the Toxic Exposures Fund. It is the kind of housekeeping exercise that exists precisely so nobody has to ask, months later, “wait, who are we paying and why.” In FY2025, VBA’s own recertification authorized 43 fewer employees than HR Smart, the department’s official personnel system, actually showed drawing pay from the fund at the same time.

    Forty three people is not a rounding error. When OIG asked about the gap, VBA officials said their goal was to reduce the number of fund supported support staff, a phrase that answers a question nobody asked and dodges the one that matters. It took a VBA employee confirming, after OIG presented its findings, that the agency had simply been paying for more central office staff than it had ever authorized. VBA’s response has been to announce it will stop charging central office staff to the fund altogether, which solves the embarrassment without explaining how it happened or for how long.

    That last part matters. Recertification has run since October 2023. Four different chief financial officers have cycled through VBA’s top finance job since the estimation methodology was published in December 2023, a level of turnover that the audit itself flags as a reason nobody was ever assigned to keep the paperwork straight. Leadership musical chairs is a familiar VA excuse; it is less familiar to see OIG connect that turnover directly to money moving without anyone responsible for watching it move.

    A Fund Nobody Can See Into

    Here is the part that should worry veterans more than the staffing math. VBA’s inability to reconcile who it pays traces back to something more basic. VA’s computer systems cannot tell PACT Act related work apart from ordinary work in the first place. Not approximately. Not unless someone manually estimates it. VBA officials told OIG flatly that none of VA’s systems are configured to track Toxic Exposures Fund data and services separately, and that VA has no activity based cost accounting capable of tying a given employee’s actual tasks to a given funding stream.

    That is not a footnote to the staffing failure; it is the mechanism that made the staffing failure possible. If a system cannot tell you whether an employee’s workload is PACT Act related, it certainly cannot tell you whether that employee should still be on the payroll under that fund six months from now. The recertification process was supposed to be the human patch for a technical gap. The patch failed in exactly the way you would expect a manual workaround to fail, quietly, for at least one full cycle, until an outside auditor forced the count.

    VHA has the identical hole, dressed slightly better. None of its systems can track individual episodes of toxic exposure care either, so VHA built its own workaround, called expenditure transfers, to shift the money between accounts after the fact. That workaround produced its own paper trail of errors, about $371,000 misapplied to the wrong accounts, including one facility that charged research costs to a medical services account explicitly reserved for patient care. VHA caught and fixed it, and corrected a second error a facility flagged on its own once auditors were already in the building. VBA did not catch its own gap; OIG did, and only after VBA’s own recertification numbers failed to match what HR Smart had been showing all along.

    Reconciliation Is Not a Software Feature

    OIG’s four recommendations amount to VA promising to build the tracking apparatus it should have had before it started spending $51.7 billion. VBA is now finalizing an actual cost estimation methodology, four years and four CFOs after the fund launched, and has committed to properly coding employees in HR Smart by October. VHA is promising quarterly sampling of its expenditure transfers, which is a reasonable fix for a problem that only exists because the underlying systems cannot do the job automatically.

    None of this required forensic accounting. It required VA to build accounting systems that can distinguish one funding stream from another, a capability most mid sized nonprofits manage without a $52.7 billion appropriation. Instead, VA ran a specialized, congressionally mandated benefit for four years on spreadsheets, proxies, and an honor system recertification that nobody was checking.

    The department has now concurred with every recommendation and set target completion dates stretching into 2027. Veterans exposed to toxic substances during their service are entitled to more than a promise that the tracking will eventually exist. They are entitled to a department that could already answer the question OIG had to ask for them: who, exactly, is this fund paying, and for what.

  • The Timesheet That Refused to Change, Four Audits Running

    There is a particular flavor of institutional rot that does not announce itself with a stolen Ferrari or an embezzled yacht. It announces itself with paperwork so lazy it becomes its own confession. In a new Justice Department Inspector General audit of $105 million in federal victim assistance grants flowing through the Michigan Department of Health and Human Services, auditors found a subrecipient director whose activity reports were identical, pay period after pay period, for years. Not similar. Identical. The kind of identical that suggests a human being decided, once, what percentage of their time belonged to which grant, then stopped thinking about it entirely, apparently confident nobody downstream would ever check the math against reality.

    Somebody did check. Michigan DHHS itself flagged the pattern, first in a monitoring review dating back to fiscal year 2021. And flagged it again. And again, through fiscal year 2025, by which point the department’s own report on the matter had degraded into a bureaucratic shrug; a note that “future repayment may be requested” should the identical timesheets continue to appear identical. Four years is a long time to keep discovering the same fire and responding by writing a memo about how, next time, there might be consequences.

    A Culture of Encouragement

    This is not an isolated lapse dressed up as a pattern; it is the pattern. The Office of Justice Programs grants at issue, three Victims of Crime Act formula awards covering fiscal years 2022 through 2024, fund a genuinely vital state apparatus. Michigan’s Division of Victim Services channels the money to more than 200 community organizations providing crisis intervention, forensic exam reimbursement, shelter, and legal advocacy to survivors of domestic violence, sexual assault, and child abuse. Nobody is disputing that the underlying work matters. What the audit disputes is whether anyone in Lansing was prepared to make subrecipients actually fix what monitoring reviews kept turning up.

    Auditors pulled a sample of 14 subrecipients’ monitoring histories across the five year review cycle and found that 9 of them had repeat or substantially similar findings. In one case, financial audits conducted in fiscal years 2022 and 2024 turned up eleven repeat findings at the same organization, including unsupported expenses and improperly calculated indirect costs; the same deficiencies persisted across the two year gap despite the subrecipient having been formally required to update its processes. The audit’s own language captures the department’s operating philosophy with more precision than any editorial gloss could manage; Michigan DHHS “identified concerns but did not explicitly require subrecipients to take corrective action, rather encouraged subrecipients to resolve the issues before their next monitoring review.” Encouraged. As though four year old fraud indicators were a matter of gentle persuasion rather than federal compliance.

    Michigan DHHS officials offered auditors a reasonable sounding excuse; some review periods overlapped, leaving subrecipients insufficient time to correct issues before the next check arrived. It is a plausible administrative headache. It does not explain why, when a director’s timesheets never once varied across years of reviews, “encouragement” remained the department’s entire enforcement toolkit. Nor does it explain the parallel finding that of 22 subrecipient contract reviews auditors examined, 19 turned up errors in the performance data those subrecipients reported to the federal Performance Measurement Tool system; wrong categories, service logs that did not match the numbers claimed. Michigan DHHS caught these errors and, per the audit, did not require subrecipients to correct them or revise how they tracked the data going forward. The department has since told auditors it now asks for amended reports when it spots discrepancies, an improvement whose arrival four audit cycles late says something on its own.

    The Cash That Sat Around Too Long

    While the timesheet saga is the report’s most vivid moment, it shares billing with a second failure that deserves its own brief entry in the ledger of institutional forgetfulness. Federal rules require grant recipients to keep drawdown requests to the minimum needed for reimbursements due within ten days; essentially, do not sit on federal cash. Michigan DHHS transferred roughly $3.2 million in expenditures between two overlapping VOCA grants and, in the shuffle, ended up drawing down funds it had effectively already drawn once, leaving $900,000 in excess federal cash sitting in state coffers for over a month, discovered only because the auditors went looking.

    The department returned the money, eventually, and explained that it had not known about the ten day repayment requirement, this despite a nearly identical episode having already surfaced in a prior review by the OJP’s own Chief Financial Officer’s office. A department managing over a hundred million dollars in federal victim services money discovering, for a second time, that it does not know how quickly federal cash must move is not an anecdote so much as a diagnostic.

    Money That Michigan Says Belongs to Michigan

    The audit also questioned $238,982 in administrative expenditures, the bulk of it $169,659 in pension and retirement contributions charged to the VOCA grant for employees whose eligibility for those specific benefits could not be verified. Michigan disagreed, at length, citing state law that spreads certain unfunded pension liabilities across the entire state payroll regardless of individual eligibility, and declined to concede the point even in its formal response to the draft report. The Office of Justice Programs sided with its own auditors; federal cost allocation rules require charges to match the actual pattern of benefits received by the employees whose salaries hit the grant, not a statewide average. It is, in miniature, a preview of the same institutional posture visible everywhere else in this report; acknowledge the smaller, cheaper findings gracefully, agree to return the money nobody will fight for, and hold the line only where holding it costs the most.

    What Comes Next

    Justice Department auditors issued eight recommendations. The Office of Justice Programs agreed to all of them without qualification. Michigan DHHS agreed with four, contested the pension cost finding across three separate recommendations, and simply declined to state a position on a fifth, even while agreeing to write the check. Every recommendation in this report is now formally “resolved” in the federal accountability sense of the word, meaning paperwork exists committing someone to eventually do something; Michigan has given itself until September 2027, more than a year from now, to finalize procedures ensuring subrecipients actually correct their deficiencies in a timely way.

    That deadline sits uncomfortably close to another number in this report; the four years auditors spent watching one subrecipient’s timesheets stay exactly the same while nothing happened. Bureaucracy has a rhythm all its own, and in Lansing it appears to run on a five year monitoring cycle that resets itself before consequences ever quite arrive.

    Sources: DOJ Office of the Inspector General, Audit of the Office of Justice Programs Victim Assistance Grants Awarded to the Michigan Department of Health and Human Services, Report 26-099 (September 2026)

    Fediverse Reactions

  • A Watchdog’s Budget Meets One Objection, and the Senate Leaves for Five Weeks

    On the last legislative day before a recess that runs through Election Day, Sen. Catherine Cortez Masto (D-NV) asked the Senate to pass S. 5681, a bill that would let the Federal Housing Finance Agency’s inspector general determine how much funding the office needs. Sen. Bernie Moreno (R-OH) objected. The bill had been introduced that same day. It went nowhere.

    Cortez Masto told the floor that FHFA Director Bill Pulte has pushed out ethics and civil rights staff and that the President fired the office’s acting inspector general last month. Those are her claims; the Record does not adjudicate them. Moreno said he supports independent oversight but that the bill sets no ceiling and no reasonableness test, and that assessments on Fannie Mae, Freddie Mac and the Home Loan Banks end up in mortgage costs. He said the office already has more than 100 employees and a budget above $50 million. A change in funding, he said, should come with a cap, a reporting requirement and a recorded vote.

    The rest of the day

    Confirmed: Keith Sonderling as Secretary of Labor, 47 to 41, after cloture passed 53 to 47. Twelve senators, six from each party, did not vote on confirmation. The Senate also confirmed ten ambassadors and one Air Force general.

    Passed: Twenty-two bills, none of them by recorded vote. The Digest lists only four roll calls for the day. The pile includes the Taxpayer Assistance and Service Act (H.R. 5349) on IRS services, the Health Care Cybersecurity and Resiliency Act (S. 3315), which orders HHS and CISA to coordinate, and the Skills-Based Federal Contracting Act (H.R. 5235), which bars minimum education requirements for contractor personnel in certain solicitations.

    Committees: A Homeland Security subcommittee heard from AI researchers on rogue AI agents and a bill to create a Department of Energy evaluation program (S. 2938). The HELP Committee advanced Nicole Saphier’s nomination for Surgeon General, along with two other HHS nominees. Energy and Natural Resources reported out 22 items. Intelligence met behind closed doors.

    Next: The Senate adjourned at 11:25 p.m. and will hold pro forma sessions only, with no business, through November 5. It returns November 9, when a cloture vote on the Survivor Justice Tax Prevention Act (H.R. 2347) is set for 5:30 p.m. The House was not in session and meets Thursday in a pro forma session.

    An inspector general may set the price of watching a housing agency, one senator argued, as soon as Washington holds a vote on it. The Senate is back November 9. The inspector general, presumably, will wait.

  • The Word That Decides Every Drug Sentence in America Was Never Actually Defined

    Every criminal penalty attached to a controlled substance in the United States, whether it is a marijuana possession charge or a fentanyl trafficking case, traces back to a single phrase in the Controlled Substances Act of 1970. “Potential for abuse.” It is the first of eight factors the Food and Drug Administration is required to weigh when deciding whether a drug belongs in Schedule I with heroin or Schedule V with cough syrup. According to a new GAO report released this week, FDA has never written down what the phrase means.

    Not “hasn’t gotten around to it lately.” Never. Fifty six years into the statute, the agency responsible for the single most consequential judgment in American drug law, the one that decides whether you face a misdemeanor or a mandatory minimum, is operating on what its own officials describe to GAO as “professional judgment.” There is no criteria document. There is no process memo. There is a phrase in a 1970 statute and a room full of scientists doing their best.

    The Machine That Has No Manual

    To be fair to FDA, the underlying machine is genuinely intricate, and GAO’s report lays it out in more detail than anyone outside the agencies has probably ever gotten. When DEA wants to schedule, reschedule, or deschedule a substance, it is required to request a scientific and medical evaluation from HHS, which farms the actual work out to FDA’s Controlled Substance Staff. FDA runs what the statute calls an eight factor analysis, weighs the evidence, and sends a recommendation back. Under a 2024 Department of Justice Office of Legal Counsel opinion, that recommendation is legally binding on DEA right up until DEA opens formal rulemaking, at which point DEA still owes it “significant deference.” In practice this produces a strange kind of choreography. GAO reviewed 208 substances DEA acted on between 2020 and 2025, found that DEA was required to request and consider an HHS evaluation for 95 of them, and confirmed DEA did so every single time, aligning with HHS’s recommendation on all 84 substances where a final decision had been published by the study’s cutoff.

    So the system, mechanically, works. Two agencies coordinate, mostly agree, and rarely fight. What GAO actually found alarming was not the disagreement rate. It was that neither agency has bothered to write down how any of this is supposed to happen. DEA has no policy assigning roles or responsibilities within its Diversion Control Division for any of the four scheduling pathways it runs. When GAO asked why, DEA’s answer amounted to a shrug dressed up as confidence, that the statute is already clear and the staff are qualified scientists with advanced degrees who do not need a manual. FDA’s defense was gentler but structurally identical, that each evaluation is so individualized a written policy might not fit, so staff learn the eight factor analysis through what the agency calls “person to person training.” Meaning if the two or three people who currently know how it is done retire in the same fiscal year, so does the institutional memory.

    A Definition Nobody Bothered to Write

    FDA officials told GAO directly that the absence of a written definition of “potential for abuse,” including what counts as a “high” potential for abuse, creates real problems when a substance does not cleanly resemble anything already scheduled. They cited xylazine, the veterinary sedative now showing up as a street drug additive, as a case where the lack of a legal or policy definition left staff improvising. This is not a hypothetical gap. It is the actual criterion federal law uses to sort substances into schedules that carry radically different criminal exposure, and the agency charged with applying it admits, on the record, that it is filling the void with judgment calls rather than standards.

    GAO’s other finding compounds this. FDA also maintains a memorandum of understanding with the National Institute on Drug Abuse describing how the two consult on scheduling science. That MOU is over forty years old and refers to FDA offices that no longer exist. Nobody had gotten around to updating it either, until GAO asked. Both agencies confirmed to GAO that the document is out of date and needs revising, which is its own small monument to how long a stale piece of paper can sit in a federal filing system before anyone with the authority to fix it notices.

    None of this is abstract. The report notes that DEA’s own request for an HHS evaluation of xylazine sat with FDA for three years before a recommendation came back, and DEA still had not finished its own review as of this spring. In the meantime the substance keeps showing up mixed into street fentanyl, and DEA has told GAO it now wants Congress to just legislate a schedule for xylazine directly, because the existing statute cannot cleanly cover the ranch hands and slaughterhouse workers who have a legitimate reason to be near the stuff. When the agency responsible for classifying a substance decides the classifying process itself does not fit the substance, the honest response is not to route around it quietly. It is to ask why the process is built the way it is in the first place, which is precisely the question GAO’s report keeps circling without ever quite being allowed to ask it directly, because GAO’s job is to audit process, not to interrogate the statute Congress wrote.

    Two Recommendations and a Very Small Concession

    GAO’s fix is almost aggressively modest. It asked DEA to write down its roles, responsibilities, and procedures for the four ways it schedules substances. It asked FDA to write down how staff should conduct the eight factor analysis and, specifically, how to define potential for abuse, including relative to other substances. It asked FDA and NIH to update their four decade old MOU and add a clause requiring someone to look at it again periodically. That is the entire ask. Not new authority, not a change to the statute, not even a change to who decides what. Just a request that the agencies write down what they are already doing, so the next generation of staff does not have to reinvent the standard from scratch every time someone retires.

    Justice and HHS both agreed to all three recommendations, which is the part of this story that should trouble anyone paying attention rather than reassure them. HHS’s written response promises FDA will draft a new policy describing how to conduct the evaluations that determine, among other things, whether someone’s fentanyl analog carries a Schedule I sentence or no sentence at all. That policy does not exist yet. It has never existed. The system that puts people in federal prison for decades has been running, by the agencies’ own account, on trained judgment and institutional memory rather than a rule anyone could read, challenge, or hold an official accountable to. GAO did not find that DEA and FDA were reaching wrong answers. It found something quieter and, in its way, more damning: nobody can say, on paper, why the right answers were right, or whether the next official asked the same question will reach the same one.

    Source: U.S. Government Accountability Office, Drug Scheduling: DEA and FDA Should Strengthen Policies and Procedures for Scheduling Controlled Substances (GAO-26-108623, September 2026).

    Fediverse Reactions

  • The Million Dollar Door FEMA Never Bothered to Guard

    The Threshold Was the Point

    In 1988 Congress decided that FEMA’s disaster recovery apparatus was too slow, so it built a shortcut. Section 422 of the Stafford Act let the agency skip the paperwork for any “small project,” accepting an applicant’s own cost estimate instead of demanding receipts, inspections, or anything resembling scrutiny. The threshold started at $35,000. It has been raised six times since, most recently in 2022, when FEMA lifted the small project ceiling to a full $1 million, a number that would have seemed unthinkable to whoever wrote the original rule.

    The logic was always the same; move fast, trust the applicant, save the field inspections for the projects big enough to matter. What nobody seems to have asked is what happens when a project is engineered to sit precisely at the line that separates “trust me” from “prove it.”

    The DHS Office of Inspector General just answered that question in OIG-26-25, and the answer is not flattering. Auditors sampled 20 small projects across every FEMA region and found problems in 12 of them, questioning $3.1 million of the $8.9 million obligated (a rate that would get a private contractor blacklisted). Two projects in the sample deserve special attention, not because they were caught doing anything as crude as inventing storm damage, but because they expose the threshold itself as the vulnerability.

    Exhibit One, the Bridge Built to Spec

    Project number 240045, “Repair Bridge on Roy Brown Lane,” sits in FEMA Region 4. Its total project cost, as recorded in the OIG’s own appendix, is exactly $1,000,000. Not $998,000. Not $1,004,000. One million dollars, on the nose, the precise figure that separates a small project (light documentation, applicant estimates accepted at face value) from a large project (the kind that gets an actual FEMA cost review before the check is cut).

    Maybe that number is coincidence. Bridges are expensive and round figures happen. But an applicant that lands its total cost exactly on a regulatory cliff edge is the textbook profile auditors call “structuring,” the same behavior banks flag when someone deposits $9,900 in cash nine days running to stay under the $10,000 reporting requirement. It does not prove intent. It does prove that the threshold, not the damage, may be doing the engineering.

    Exhibit Two, the School That Cost Almost Twice the Cap

    Project 173233, the Southwest Louisiana Charter College Prep site, tells a stranger story. Its total project cost was $1,873,814, comfortably inside “large project” territory. Yet it received small project treatment, and its federal cost share came out to $733,109, a reimbursement rate of roughly 39 percent. Every other project in the OIG’s twenty-project sample lands on the Stafford Act’s standard 75 or 90 percent cost share; this one does not, and nothing in the public record explains why.

    Put the two exhibits together and you get a threshold operating in both directions at once. One applicant appears to have shaped its numbers downward to stay inside the light-touch lane. Another sailed nearly double the small project cap and still got waved through the same lane, at a reimbursement rate nobody else in the sample received. A door built to keep large, complicated projects out let a $1.87 million project walk straight past the guard.

    The same undocumented trust shows up elsewhere in the sample, just in smaller dollar amounts. In Alabama, an applicant got $40,000 approved to install a pitched metal roof, then installed a cheaper flat, silicone-coated roof instead, after FEMA had already paid separately to remove the original roof under a different project. In New Hampshire, a town claimed storm damage to two miles of road and nine culverts; satellite imagery and an on-site inspection found damage to about a third of a mile and three culverts, a gap FEMA’s own simplified procedures were never built to catch, because simplified procedures do not ask for satellite imagery, they ask for a signature. None of that required a project engineered to a dollar figure. It only required an agency that had already decided, by policy, not to look.

    It is worth noting where that guard was standing. Five of the twenty sampled projects, a quarter of the entire sample, came out of FEMA Region 6 (Louisiana and Texas), more than any other region, and Region 6 also produced three of the sample’s four utility projects, plus the levee case the OIG highlighted separately, in which a town’s claimed disaster damage predated the actual disaster by six months. A regional oversight gap is a management problem. A regional oversight gap sitting directly under the sample’s two biggest financial anomalies is a pattern.

    What Twenty Projects Are Supposed to Tell Washington

    The OIG’s sample was not a full census; it was 20 projects out of what is presumably thousands processed under simplified procedures since 2022. Auditors found trouble in 60 percent of what they looked at and said plainly that the full scope of wasted funds almost certainly is higher. That is not a rounding error in an otherwise sound program; that is an agency admitting its own sample size was too small to know how bad the problem actually is.

    FEMA’s defenders will say the small project threshold exists because disaster survivors cannot wait for a bureaucrat to drive out and inspect a culvert while their town is still underwater, and they are not wrong. Speed matters after a hurricane. But speed and zero verification are not the same policy choice, and Congress did not authorize FEMA to accept an applicant’s word up to $1 million so that a charter school renovation could be waved through at a discount reimbursement rate nobody can explain, or so that a bridge repair could land, suspiciously, on the exact dollar that keeps it out of real review.

    The OIG’s recommendations, as usual, will ask FEMA to tighten documentation requirements and improve its tracking systems. Tightened documentation is a fine start. It does not answer the harder question buried in this appendix, which is whether the $1 million line itself, the one Congress kept raising in the name of efficiency, has become less a speed limit than a target to aim for.

    There is also the matter of what happens after the money is found to be wrong. FEMA has three years after a project’s completion to claw back improper payments administratively, absent evidence of fraud. That clock does not stop for a system migration, yet the same OIG report notes that FEMA closed 20 of 30 already-flagged de-obligation cases during a data migration without recovering the funds, only correcting most of them after auditors came looking, with three still unresolved as of last June. A three-year recovery window managed by an agency that loses track of its own flagged cases during a software update is not an oversight regime; it is a countdown timer nobody is watching.

    None of this requires a villain. It requires only an incentive structure where the safest place for a project to live is just inside a line nobody checks, and the OIG’s twenty-project sample suggests applicants, whether by design or by drift, have found that address. Congress built the door to move money fast to towns that needed it. It did not ask what happens when the door itself becomes the destination.

    Bureaucracies rarely get caught lying. They get caught doing exactly what the rules permit, at exactly the moment the rules stop looking.