Additionally, the audit concluded the state likely flagged numerous legitimate claimants as fraudulent.
The audit was obtained by The Star following a meeting of Kansas’ Unemployment Modernization Council Wednesday in which lawmakers and officials from the Kansas Department of Labor discussed the report but did not publicly release it, citing a need to redact the document first.
Kansas is midway through modernizing its 1970s era unemployment system which buckled under an unprecedented flood of legitimate and fraudulent claims made in the early days of COVID-19.
The agency saw major leadership turnover and major backlogs as Kansans flooded the agency’s call center trying to get payments.
Last year the Legislature approved funding to overhaul the system.
Sandy Johnson, chief of staff at the Department of Labor, said the audit was proof that the modernization project is necessary.
“The report proves what we have long said: the most important issue facing our Department is modernizing the outdated IT systems that caused these vulnerabilities during the pandemic. While the audit shows that Kansas was not unique in experiencing unemployment fraud nationally, it also affirms that our current modernization campaign will be essential to protecting workers during the next crisis,” Johnson said in a statement.
The independent audit confirms that millions were paid in fraudulent claims and that legitimate unemployed Kansans were at times incorrectly flagged as fraudulent actors.
The audit, conducted by consulting firm FORVIS, estimated roughly $450 million in fraudulent payments. The independent audit gave a higher number than the Kansas Department of Labor’s internal estimate of $290 million and lower than the estimate of $600 million from the Legislature’s audit division.
Kansas’ fraudulent payments constitute a small portion of the $163 billion the U.S. Department of Labor estimates was paid out nationwide to fraudsters.
The vast majority of the payments, FORVIS estimated, were made to claims filed in Kansas’ online system and came before Kansas rolled out a multifactor authentication system in January of last year.
“It appears that while the KDOL was effective at flagging potentially fraudulent claimants, it flagged a number of likely legitimate claimants as well,” the report said.
That determination came because the auditors found that KDOL identified roughly $345 million in potential fraudulent payments that FORVIS did not identify and that those claimants identified had different characteristics than the likely fraudsters FORVIS identified.
A separate audit, performed by consultant BKD Cyber and also obtained by The Star, found that the Kansas Department of Labor had only partially implemented the majority of the National Institute of Standards and Technology’s best practices for cyber security. The state’s strongest area was in detection of cyber security issues. It had not fully implemented any best practice in the response or recovery categories.
The IT audit, which lawmakers were allowed to see in a closed session in May, left some concerned Kansas’ systems were too insecure.
“(The audit report) shows all kinds of very simple vulnerabilities … that weren’t addressed and I think that we were compromised a lot more than we thought,” state Rep. Sean Tarwater, a Stilwell Republican, said in Wednesday’s meeting.
©2022 The Kansas City Star. Distributed by Tribune Content Agency, LLC.
