Internal Audit Newswire - September 27, 2026

Grand jury indicts 4 in sweeping $7.3 million mortgage fraud scheme targeting FHA and VA programs

Source: United States Department of Justice (U.S. Attorney's Office, Northern District of Texas)

Summary: On Sept. 16, 2026, a federal grand jury in the Northern District of Texas indicted four individuals—Shawna Randall (aka Shawna Porter), Cleophus Turner, Julie Shoumbert, and Maurice Gardner—over an alleged multi‑year mortgage fraud. Prosecutors say the group falsified income, employment, bank records, and other documents from June 2020 to November 2022 to qualify unqualified borrowers for more than 20 FHA, VA, and conventional loans originated through Eustis Mortgage Corporation d/b/a Verity Mortgage, totaling about $7.34 million. HUD has already paid partial FHA‑insurance claims exceeding $493,499. Multiple OIGs participated. Defendants face prison, fines, and forfeiture.

Internal Audit Implications: This indictment is a control design and oversight failure case study for loan origination. Internal audit should immediately reassess fraud risk in income, employment, and asset verification; third‑party involvement; and FHA/VA program compliance. Priority actions: 1) Control testing: sample pre‑funding and post‑close files for documented, independent verification of income/employment and bank records; challenge the sufficiency of evidentiary trails and authentication steps. 2) Review override and exception controls: test approval thresholds, segregation of duties, and whether documentation mismatches or unverifiable data triggered holds. 3) Third‑party oversight: evaluate due diligence, onboarding, training, and monitoring for loan officers, processors, and any external parties involved in document collection; verify conflict‑of‑interest and disciplinary escalation mechanisms. 4) Quality control (QC): test the timeliness, coverage, and independence of QC on FHA/VA loans; confirm remediation tracking for defects tied to borrower qualification. 5) Program compliance: verify FHA/VA eligibility attestations, insurer reporting, and claim handling controls; confirm issues are fed into the risk register and drive targeted training. 6) Information governance: assess access controls over document repositories to deter alteration/substitution. The audit committee will ask: How is borrower data independently verified before funding? What percentage of files receive pre‑funding QC? Which vendors or employees can be suspended immediately upon red flags, and how is that governed? What losses could arise from insurance denials or repurchase demands, and how is that risk monitored? Do we have targeted analytics to detect pattern anomalies across originators or channels?

FleetCor Agrees to Pay $100 Million to Resolve Administrative Action After Federal Court Finds that It Violated the FTC Act by Charging Unauthorized Fees

Source: Federal Trade Commission (press release)

Summary: The FTC announced that FleetCor Technologies Inc. (now Corpay Inc.) and its CEO agreed to pay $100 million to resolve an administrative action after a federal court found violations of the FTC Act tied to unauthorized fuel‑card fees charged to predominantly small businesses. A 2023 district court summary judgment found the company liable on all counts, and a 2026 appeals‑court decision largely affirmed. Injunctive terms prohibit billing without express informed consent, hiding material charge information behind hyperlinks, and deceptive claims about fuel cards. The consent agreement will undergo a 30‑day public comment period following Federal Register publication.

Internal Audit Implications: Treat this as a blueprint for testing fee governance. Prioritize: 1) Express informed consent: trace key fees from marketing to contract to first bill; verify evidence of explicit customer assent is captured and retained. 2) Disclosure controls: review customer‑facing materials and digital flows; test that material charges are not obscured behind hyperlinks or layered clicks; validate that fee disclosures are prominent, plain, and proximate to the commitment. 3) Billing system configuration: test that no fee can be billed absent consent flags; review change‑management approvals, maker‑checker controls, and audit logs for fee tables and pricing rules. 4) Claims and marketing governance: sample campaigns and sales scripts for prohibited or deceptive fuel‑card claims; confirm legal/compliance review and version control. 5) Monitoring and remediation: analyze complaints, churn, credits, and fee reversals for unauthorized‑fee signals; evaluate root‑cause and corrective‑action tracking. 6) Third‑party channels: assess oversight over resellers or agents making pricing representations. The audit committee will ask: Where and how is “express informed consent” evidenced in systems? Which fees lack incontrovertible consent proof? How many fee‑related complaints and refunds occurred, and what changed in controls? Can we demonstrate that material fees are disclosed without reliance on hyperlinks? Is risk governance ensuring rapid escalation and board visibility for fee changes and exceptions? Embed these tests in the risk register and ongoing operational risk assessment.

Addiction Treatment Clinic Owner Sentenced to 14 Years in Prison for $69 Million Medicaid Fraud Scheme

Source: U.S. Department of Justice, U.S. Attorney's Office for the District of Arizona (press release)

Summary: The U.S. Attorney’s Office for the District of Arizona reported a 14‑year prison sentence for Rita Ntusa Anagho after she fraudulently billed Arizona’s Medicaid agency for more than $69 million in addiction‑treatment services from approximately May 2022 through March 2023. Many patients were Native Americans covered by a higher‑reimbursing plan. The court ordered nearly $55 million in restitution and forfeiture of about $9.5 million from seven bank accounts plus almost $7 million in real estate. Anagho pleaded guilty in May 2025. FBI and HHS‑OIG investigated with assistance from the AHCCCS OIG (Case No. 24‑CR‑01044‑PHX‑MTL).

Internal Audit Implications: This sentencing highlights acute operational risk in claims integrity, eligibility controls, and provider oversight. Internal audit should focus on: 1) Patient eligibility and identity: test intake and pre‑bill verification for plan eligibility, including controls preventing routing to higher‑reimbursing plans without substantiation. 2) Clinical documentation integrity: sample charts to confirm services billed are supported, signed, and contemporaneous; test that claims cannot transmit without required documentation. 3) Billing edits and pre‑submission review: evaluate automated and manual checks targeting volume spikes, repeated codes, and atypical service patterns; confirm escalation paths and holds. 4) Provider onboarding and monitoring: assess due diligence, credentialing, and periodic re‑verification; review ownership disclosures and related‑party conflicts. 5) Funds flow and asset safeguards: test reconciliation between services, claims, payments, and bank deposits; review anomaly alerts and rapid account‑freeze/escalation procedures. 6) Third‑party oversight: evaluate controls over referral sources and contracted clinics; require attestations and audit rights. 7) Data governance and IT risk: confirm EHR and billing‑system access controls, audit trails, and tamper‑evident recordkeeping. The audit committee will ask: What stops submission of undocumented claims? How do we verify patient eligibility and identity at intake and pre‑bill? Which analytics flag concentration in higher‑reimbursing plans? How quickly can we suspend suspect providers or referral sources? Embed these tests into the risk assessment and risk register, and track control remediation to closure.

Disclaimer: This content is provided for general informational purposes only and does not constitute legal, accounting, tax, investment, or other professional advice. Portions were generated using AI tools from public web sources and may contain errors or omissions — verify important details against the primary sources linked above before relying on them. Any example prompts, scripts, templates, or other artifacts are provided “as is” without warranty of any kind, express or implied; test them on non-production data and apply your own professional judgement before use. Cherry Hill Advisory disclaims all liability for any loss or damage arising from the use of, or reliance on, this content or any artifact it contains.