This is the accessible text file for GAO report number GAO-07-294R entitled 'National Institutes of Health Extramural Research Grants: Oversight of Cost Reimbursements to Universities' which was released on March 7, 2007. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. January 31, 2007: The Honorable Tom Coburn, M.D. Ranking Minority Member: Subcommittee on Federal Financial Management, Government Information, and International Security: Committee on Homeland Security and Governmental Affairs: United States Senate: Subject: National Institutes of Health Extramural Research Grants: Oversight of Cost Reimbursements to Universities: Dear Senator Coburn: The Department of Health and Human Services' (HHS) National Institutes of Health (NIH) is the nation's leader in conducting and sponsoring biomedical research. More than 80 percent of NIH's budget, which totaled over $28 billion in fiscal year 2006, is used to support extramural research, which is primarily conducted at over 500 universities[Footnote 1] nationwide. NIH reimburses universities for direct costs that can be specifically attributed to research sponsored by NIH grants, including costs for labor and materials used solely to carry out the research. It also reimburses universities for indirect costs, which include various facility and administrative expenses incurred by the universities for the shared support of such research. To be reimbursed for direct and indirect costs, universities must properly identify and claim them in accordance with federal guidance. Office of Management and Budget (OMB) Circular No. A-21[Footnote 2] establishes the principles for determining the types of direct and indirect costs that are allowed to be claimed and the methods for allocating such costs to federally funded research. Because indirect costs cannot be specifically attributed to a particular research grant, they are charged via an indirect cost rate that is applied to the direct costs for each grant agreement. Each university develops a proposed indirect cost rate, based on information such as the amount of physical space used for conducting research. A university's final indirect cost rate is generally determined by negotiating its proposed rate with HHS's Division of Cost Allocation (DCA).[Footnote 3] DCA is responsible for ensuring that the final negotiated indirect cost rate complies with OMB Circular No. A-21. Additionally, for each university that received $25 million or more in federal funds for its most recently completed fiscal year, DCA reviews its disclosure statement, which details the university's cost accounting practices. The oversight responsibilities of NIH's institutes and centers (IC)[Footnote 4] include the financial management of grants as well as ensuring that grantees comply with the terms of the grants. Audit responsibility for NIH research grants is shared between nonfederal auditors[Footnote 5] and HHS's Office of Inspector General (OIG). Universities receiving NIH grants are subject to the provisions of the Single Audit Act,[Footnote 6] as amended, and as implemented in OMB Circular No. A-133. These provisions, as implemented by OMB Circular No. A-133, require each university that expends $500,000 or more in a year in federal awards to obtain a "single audit" from a nonfederal auditor. These organizationwide audits[Footnote 7] are required to include a financial statement audit and cover internal controls[Footnote 8] and compliance with laws and regulations pertaining to major programs[Footnote 9] that affect all federal funding, including grants. OIG responsibilities for NIH research grants include determining potential program vulnerabilities, identifying specific areas that warrant review, conducting its own audits of grantees, and providing recommendations for corrective action to the Secretary of HHS and to the Congress. Because any incorrect allocation or claiming of costs could put federal funds at risk, you asked us to review indirect costs associated with NIH extramural research grants and oversight of direct and indirect costs claimed by universities receiving these grants. In response, we (1) describe the trends in indirect costs for NIH extramural research grants awarded to universities for fiscal years 2003 through 2005, (2) describe HHS's current key controls to ensure that grantees comply with federal guidance in claiming costs, (3) determine the frequency and scope of single and OIG audits of grantees, and (4) determine what actions NIH has taken to address auditors' findings of improper claiming of direct and indirect costs. To describe trends in indirect costs for NIH extramural research grants awarded to universities for fiscal years 2003 through 2005, we obtained information from NIH on the total dollar amount of indirect and direct costs allocated to all NIH extramural grants to universities. In addition, we obtained and analyzed more detailed cost data from DCA for the 100 universities that received the most NIH funding for fiscal years 2003 through 2005 among universities for which DCA negotiates indirect cost rates.[Footnote 10] We also interviewed HHS officials having oversight responsibility for setting indirect cost rates and ensuring that universities properly claim indirect costs. Further, we obtained information on HHS's efforts to ensure the quality of its data and determined the cost data to be sufficiently reliable for the purpose of this analysis. To describe HHS's current key controls to ensure that grantees comply with federal guidance in claiming costs, we reviewed HHS's policy guidance. To corroborate that the controls described by DCA were in place, we then selected and reviewed five files from DCA's Washington, D.C., office, including files for each of three universities where the reviewers conducted a site visit. These files contain supporting documentation related to HHS's process for reviewing indirect cost rate proposals for universities. In addition, we reviewed six reports from an HHS contractor that examined cost accounting practice disclosure statements, choosing them from five universities that had problems identified by audits that affected at least one NIH grant. We also interviewed HHS management and compliance staff with knowledge specific to key controls used to oversee costs at three ICs. To corroborate that the controls described to us by HHS were in place, we obtained and reviewed six randomly selected files documenting its reviews. To determine the frequency and scope of single and OIG audits of universities that received NIH extramural grant funds, we identified the universities where single audits were required to be conducted during fiscal years 2003 and 2004[Footnote 11] and where OIG audits were conducted from fiscal year 2003 through fiscal year 2006. To determine the actions NIH has taken to address auditors' findings, we interviewed OIG and NIH staff about steps taken to resolve problems and reviewed supporting documentation from 15 selected audits from fiscal year 2003 through fiscal year 2006. To select these audits, we obtained information on the number of audits with findings of problems with internal controls or claimed costs for NIH extramural grants. We then obtained and analyzed a random sample of seven files documenting the resolution of such findings for single audits and all eight files documenting the resolution of such findings for OIG audits, where all steps to resolve findings had been completed. Except for the OIG audit resolution findings, the results from the limited samples we reviewed cannot be generalized to the universe from which they were drawn. We performed our work from September 2006 through January 2007 in accordance with generally accepted government auditing standards. Results in Brief: The proportion of NIH extramural research grant funds awarded to universities for reimbursement of indirect costs was stable at about 28.5 percent annually during fiscal years 2003 through 2005. The stability of the proportion of indirect costs reimbursed can be attributed to the stability of indirect cost rates during this period. During this period, indirect cost rates were stable because there was little change in the largest component of the indirect cost rate--the administrative component--and because indirect cost rates generally remain valid for 2 to 4 years once they are negotiated. Because the total amount of NIH funding for extramural research grants to universities increased from about $13.9 billion in fiscal year 2003 to about $15.2 billion in fiscal year 2005, the amount of indirect costs awarded to universities increased from about $3.9 billion to about $4.3 billion. HHS's key controls intended to ensure that grantees comply with federal guidance in claiming costs include the review of information submitted by universities when indirect cost rates are set and when grant applications and annual progress reports are submitted. Key controls for setting indirect cost rates are administered by HHS's DCA and involve reviewing indirect cost rate proposals. They can also include conducting on-site reviews and examining cost accounting practice disclosure statements. In carrying out these functions, DCA focuses much of its efforts on universities with the highest dollar value of federal funding received. HHS's key controls for overseeing reimbursements of costs claimed by universities are administered by NIH's ICs and consist primarily of reviews that occur when universities apply for new grants and when universities submit their annual progress reports. Almost three-quarters of the approximately 530 universities receiving NIH extramural research grants--or about 390 of them--were required to have single audits conducted by nonfederal auditors annually in fiscal years 2003 and 2004, and about 4 per year received OIG audits during fiscal years 2003 through 2006. The scope of these two types of audits differed. The single audit includes an audit of the university's financial statements at the organization level and its system of internal control and compliance with federal laws and regulations that affect all federal funding, including grants, rather than specifically focusing on whether costs associated with universities' NIH grants were properly claimed. The OIG audits generally focused on a particular grant and the university's compliance with rules and regulations that pertained to that grant, rather than providing a broad examination of the university's internal controls and compliance with federal laws and regulations over all federal funding, including extramural grants. NIH required universities to address auditors' findings relating to a procedure or internal control that led--or could have led--to incorrect claiming of direct or indirect costs and to reimburse any questioned costs that it determined were not sufficiently supported. To resolve findings related to a procedure or internal control, NIH required each university to develop a corrective action plan, outlining the steps it would take to address the problem. Our review of the audit resolution files indicated that universities submitted evidence to NIH, such as a revised policy or documentation of their implementation of new controls, to show that the problems were addressed. To resolve findings concerning questioned costs, NIH determined how much of the amount in question the university was required to return. In resolving findings from OIG audits completed in fiscal years 2003 through 2006, NIH required universities to reimburse the full amount of questioned costs that it found were not sufficiently justified. In two audits, NIH required universities to reimburse the full amount of costs questioned by OIG, and in five other audits it determined that universities sufficiently justified either all or some of the costs questioned by OIG and did not require the universities to reimburse those costs. We provided a draft of our report to HHS for review. HHS provided technical comments, which we incorporated where appropriate. Background: NIH conducts and sponsors biomedical research through its ICs, each of which is charged with a specific mission. ICs' missions generally focus on a given disease; a particular organ; or a stage in development, such as childhood or old age. ICs accomplish their mission chiefly through intramural and extramural research. Intramural research entails government scientists working in the ICs' own laboratories and clinics, whereas extramural research is conducted at outside research institutions, including universities, by scientists who have competed for extramural research grants by submitting an application to an IC. NIH provides extramural research grants that reimburse universities for the direct costs of research that are allowable under OMB Circular No. A-21 and an allowable portion of the indirect costs of administering the universities and maintaining their facilities for research use.[Footnote 12] Indirect Cost Rates and Reimbursements: In order for NIH to reimburse universities for indirect costs related to extramural grants, an indirect cost rate must be established for each university in accordance with OMB Circular No. A-21. The university is responsible for calculating its proposed indirect cost rate. OMB Circular No. A-21 requires the university to first allocate its annual total costs from the previous year's activity into three categories: (1) direct costs that are closely tied to specific grants or projects; (2) excluded costs--direct costs that are excluded for the purpose of calculating the indirect cost rate, such as costs for equipment and for subcontracts over a certain threshold[Footnote 13]; and (3) indirect costs, that is, shared expenses related to the facilities or administration of the university. A university's indirect costs are then organized into a number of components, within two categories--facilities and administrative. Facilities costs that can be allowable for indirect cost reimbursement include (1) allowances for depreciation and use of buildings and equipment; (2) interest on debt associated with building and equipment; (3) operation and maintenance expenses, such as for utilities and janitorial services; and (4) library expenses, such as for the use of the library and library materials purchased for research use. Administrative costs that can be allowable for indirect cost reimbursement include (1) general costs, such as those for central offices for the president and management information systems; (2) departmental administrative costs, such as costs for academic deans, secretaries, and office supplies; and (3) administrative costs for sponsored projects, such as for a separate office that administers contracts and grants. To calculate the indirect cost rate, a percentage of each indirect cost component is allocated to the university's research function on the basis of benefits received from that component by the research function. For example, a university can measure the square footage of floor space used for research and use this measure to allocate the amount of costs it claims for operating and using the space as a component in its indirect cost rate proposal. Each indirect cost component allocated to research is divided by the university's "modified total direct costs"--that is, its direct costs minus the excluded costs--to obtain an individual rate for each component. These individual rates are then summed to obtain the university's indirect cost rate for research. OMB Circular No. A-21 stipulates the maximum proportion of certain components of indirect costs that can be reimbursed to a university, the most important of which is administrative costs. Between 1966 and 1991, the amount of indirect costs reimbursed to universities climbed steadily, because there were no restrictions on the amount of indirect costs that could be claimed. To curb such growth, OMB revised Circular No. A-21 in 1991 to impose a cap on the amount of administrative costs that could be claimed for reimbursement, limiting them to 26 percent of a university's modified total direct costs. The universities submit their indirect cost rate proposals to the federal agency responsible for approving them.[Footnote 14] This agency is usually DCA, which negotiates indirect cost rates for about 90 percent of universities receiving NIH extramural research grants.[Footnote 15] Each university that received $25 million or more in federal funds during the previous fiscal year is also required to prepare a disclosure statement detailing the cost accounting practices used to develop its proposal. By completing the cost accounting practice disclosure statement, the university attests that its cost accounting practices comply with OMB Circular No. A-21. DCA is responsible for providing technical assistance and guidance to the grantee community in developing indirect cost rate proposals, reviewing cost accounting practice disclosure statements, and negotiating and approving university indirect cost rates. Additionally, DCA developed a review guide to assist its cost rate negotiators as they review universities' indirect cost rate proposals. Administration and Oversight of Grants: While grantees are responsible for managing the day-to-day grant activities in accordance with NIH requirements, responsibility for the administration and oversight of costs claimed by grantees for NIH extramural research is decentralized within NIH to the ICs. Each IC is responsible for ensuring compliance with applicable federal requirements for the grants it administers. Grant project periods average 4 years, but grantees must annually submit progress reports to obtain funding for subsequent years. The progress reports provide information regarding the scientific progress of the grant as well as financial information. ICs are responsible for reviewing applications for new grants and annual progress reports. In their reviews of applications for new grants, ICs assess the reasonableness of the proposed budget as it relates to the scientific research the grantee plans to undertake to ensure that the proposed cost of the grant is reasonable given the research intended. ICs are responsible for reviewing universities' annual progress reports to determine if scientific progress has been made, as well as the financial status of their grants to determine whether the university is expending funds as planned and whether its management of grant funding is consistent with the scientific progress that has been made. On the basis of the reviews of the annual progress reports, ICs are responsible for determining whether grantees should continue to receive funding in the following year. Audits Involving NIH Research Grants: Two types of audits that can examine compliance of universities with OMB guidance on claiming costs for NIH research grants are single and OIG audits. Universities that expend $500,000 or more in a year in federal awards are required by the Single Audit Act, as amended and as implemented by OMB Circular No. A-133, to obtain a single audit for that year.[Footnote 16] These organizationwide audits are not intended to focus specifically on an individual grant awarded by a particular agency. OIG conducts audits at its discretion, depending on the availability of its resources to conduct such audits. In some cases, OIG determines that a particular grant warrants review, and in other cases OIG examines broader issues related to grants, such as how particular costs are documented. OIG considers various factors in deciding whether to conduct an audit, including the amount of federal funding a university receives, as well as triggers that would indicate potential vulnerabilities, such as allegations of improper costs claimed that are made by university employees. NIH is responsible for resolving findings that result from both types of audits. As it does so, grantees have an opportunity to address audit findings on the propriety of questioned costs with NIH. Proportion of Indirect Costs to Total Amount Awarded for Extramural Research Was Stable during Fiscal Years 2003 through 2005: The proportion of NIH extramural research grant funds awarded to universities for reimbursement of indirect costs remained stable during fiscal years 2003 through 2005. The amount in indirect costs awarded annually equaled about 28.5 percent of the total amount awarded in extramural research grants to universities. (See fig. 1.) This was similar to the percentages for fiscal years 1992 through 2002, when indirect costs ranged from about 28.5 percent to about 30 percent of the total amount NIH awarded in extramural research grants to universities annually. While the proportion of indirect costs awarded was stable, the total amount of funding that NIH allocated to extramural research grants to universities increased from about $13.9 billion in fiscal year 2003 to about $15.2 billion in fiscal year 2005. As a result, the amounts NIH awarded to universities for direct and indirect costs associated with these grants also increased over the 3- year period. Indirect costs increased from about $3.9 billion in fiscal year 2003 to about $4.3 billion in fiscal year 2005, by an average of about 4.5 percent each year. Figure 1: Percentage and Dollar Amount of Total Costs Awarded for Reimbursement of Direct and Indirect Costs to Universities Receiving NIH Extramural Research Grants, Fiscal Years 2003 through 2005: [See PDF for image] Source: GAO analysis of NIH data. [End of figure] The stability of the proportion of indirect costs awarded during fiscal years 2003 through 2005 can be attributed to the stability of indirect cost rates during this period. For the 100 universities that received the most NIH funding for fiscal years 2003 through 2005 and for which DCA negotiates indirect cost rates, we found that average indirect cost rates were stable over the 3 years we examined. For each of these 3 years, indirect cost rates averaged about 51 percent of the modified total direct costs associated with NIH extramural research grants.[Footnote 17] The relative stability in average indirect cost rates for the universities in our sample can, in part, be attributed to the stability in the rate for administrative costs, the component that makes up the largest portion of the indirect cost rate. The annual average amount of the administrative component of the indirect cost rate, which is capped at 26 percent of modified total direct costs, ranged from 25.6 percent in fiscal year 2003 to 25.8 percent of total costs in fiscal year 2005. In addition, once indirect cost rates are negotiated, they remain in effect, and therefore stable, for about 2 to 4 years. HHS's Key Controls Include Reviewing Proposals, Applications, and Reports: HHS's key controls intended to ensure that grantees comply with federal guidance in claiming costs include the review of information submitted by universities when indirect cost rates are set and when grant applications and annual progress reports are submitted. Key controls for setting indirect cost rates are administered by HHS's DCA. The controls involve reviewing universities' indirect cost rate proposals. This can also include conducting on-site reviews and examining cost accounting practice disclosure statements to determine whether the statements comply with OMB Circular No. A-21 requirements. In carrying out these functions, DCA focuses much of its effort on high-dollar universities.[Footnote 18] HHS's key controls for overseeing reimbursements of costs claimed by universities are administered by NIH's ICs. They include reviewing grant applications and annual progress reports as well as the financial status of their grants. DCA reviews indirect cost rate proposals and documents its results as a key control to support negotiation of the rate for each of the universities for which it is responsible.[Footnote 19] DCA reviews information provided by the universities in the proposals on the indirect, as well as direct, costs of research that are used to develop the proposals. During fiscal year 2006, DCA officials informed us that staff completed indirect cost rate negotiations that year for 56 universities that were classified as high dollar, as well as for 324 universities with federal funding below the high-dollar threshold. On the basis of a risk assessment, DCA performs a more extensive review for certain universities and a more limited one for the rest. As part of its reviews, DCA conducts a preliminary analysis of universities' indirect cost rate proposals to determine the extent of its review as either full or limited. DCA's determination is based on a risk assessment performed by the cost rate negotiator, which entails a comparative analysis of the proposed rates to the previously negotiated rates, a review of the historical work paper file, and a discussion with the previous negotiator, and takes into account whether the university is classified as high dollar. When DCA performs a limited review, it generally applies the preliminary steps outlined in DCA's review guide for assessing indirect cost proposals. DCA officials explained that for limited reviews, cost rate negotiators evaluate certain aspects of the proposal to determine whether it appears reasonable and consistent with OMB Circular No. A- 21, such as performing a trend analysis, reconciling the proposal to financial statements, and testing the rates for variability. When DCA performs a full review, the cost rate negotiators generally cover most steps contained in DCA's review guide for assessing indirect cost proposals. These steps involve tasks such as a more detailed analysis of specific components of indirect cost rates, including allocation of depreciation, interest, maintenance costs, and space. However, whether the cost rate negotiator conducts all or a subset of the steps identified in the review guide depends on DCA's risk assessment of the proposal. DCA's negotiators are expected to use their professional judgment in determining the number and extent of review steps needed to ensure that the university's proposed rate is reasonable and consistent with OMB Circular No. A-21. If the cost rate negotiator is confident that a particular component of the rate proposal is reasonable and allowable, the negotiator can conduct a less in-depth review for a related step outlined in the review guide. For fiscal year 2006, DCA officials told us that their staff conducted full reviews for 28 of the 56 high-dollar universities, most of which included on-site reviews. DCA officials also told us that their cost rate negotiators and management use professional judgment to determine whether an on-site review is needed as part of a full review to better perform the indirect cost rate negotiation process. An on-site review typically assesses how a university allocates space to research and its other functions[Footnote 20] to determine how the costs associated with these activities should be assigned. During fiscal year 2006, DCA conducted on-site reviews for 25 of the 28 high-dollar universities for which it conducted full reviews. Our examination of 5 of these 28 high- dollar university DCA case files showed evidence of these reviews. If an on-site review reveals that a university improperly allocated space to its various functions, DCA makes adjustments to the university's proposed indirect cost rate. For example, during one on-site review, DCA found that a university had used an unacceptable methodology to allocate its space. As a result, DCA cost rate negotiators proposed adjustments to the university's indirect cost rate. This information, as well as other adjustments, became part of the negotiation process in arriving at the final indirect cost rate, which was lower than the rate proposed by the university. DCA staff informed us that, as part of the negotiation process, its cost rate negotiators examine cost accounting practice disclosure statements for the universities that are required to provide them, that is, those universities that received $25 million or more in federal funds during the previous fiscal year. During fiscal year 2006, DCA had a contractor review cost accounting practice disclosure statements for the 37 high-dollar universities that met the requirement to submit disclosure statements. These statements were reviewed to determine whether they adequately described the university's cost accounting practices and whether the described practices, in principle, complied with cost accounting standards contained in OMB Circular No. A- 21.[Footnote 21] DCA officials informed us that a university with deficiencies in its cost accounting practice disclosure statement is required to correct any cost accounting practices that do not comply with OMB Circular No. A-21, revise the statement to reflect the changes in such practices, and resubmit it to DCA. Our examination of six cost accounting practice disclosure statement reviews corroborated the process described by DCA. HHS's key controls for overseeing reimbursements of costs claimed by universities are administered by NIH's ICs and consist primarily of reviews that occur when universities apply for new grants and when universities submit their annual progress reports. The grants management staff we interviewed from three ICs informed us that they review grant applications to ensure that the project budget submitted is reasonable in terms of the research planned and that budgeted costs are allowable and allocable to the project. Specifically, IC staff analyze proposed cost elements and examine data to determine the necessity for, and the reasonableness and allowability of, the costs included in the application budget. In the reviews, IC staff also look for budgetary overlap, which occurs when budgetary items (for example, costs associated with equipment and salaries) that are requested in an application duplicate, or are equivalent to, items or services that are provided by another source. IC staff review progress reports to determine the level of funding to provide in the upcoming budget year. NIH officials explained that IC staff make these decisions based in part on whether a grantee is spending money at a rate that is about equal to, faster than, or slower than what was outlined in the terms of the original grant agreement. A discrepancy could indicate, for example, that scientific progress is lagging in relation to costs, which may result in the IC's delaying funding or reducing the grant amount. IC grants management staff told us that they also examine financial status reports, which provide the grantees' expenditures and unobligated balances, as they are submitted by universities. Using this information, IC staff compare the amounts spent by the grantee relative to approved award amounts that remain unobligated for the same budget period to determine if the university is expending funds as planned. They then make decisions regarding the level of funding they will provide in the upcoming budget year. If review of the progress report or financial status report indicates that additional analysis is warranted, ICs then compare scientific progress noted in the university's annual progress report to information from HHS's records of funds drawn down by the grantee. Our review of six randomly selected grant case files from two NIH ICs indicates that, as NIH officials had told us, IC staff reviewed the application budget and examined financial status and progress reports and other documents submitted by the universities. Almost Three-Quarters of the Universities Were Required to Be Audited Annually: Almost three-quarters of the approximately 530 universities that received NIH extramural grant funds were required to receive single audits from nonfederal auditors annually in fiscal years 2003 and 2004, and about 4 per year received OIG audits during fiscal years 2003 through 2006. Under the Single Audit Act, as amended, and as implemented in OMB Circular No. A-133, each university that expends $500,000 in federal awards annually must have a single audit conducted by nonfederal auditors. For fiscal years 2003 and 2004, about 390 universities were required to have single audits for each of these years.[Footnote 22] They made up about 73 percent of the universities receiving NIH funds for extramural research annually. In addition to single audits completed by nonfederal auditors, OIG completed an average of three audits per year during fiscal years 2003 through 2006 of NIH grants at universities. The scope of these two types of audits differed. The single audit includes an audit of the university's financial statements at the organization level and its system of internal control and compliance with federal laws and regulations that affect all federal funding, including grants, rather than specifically focusing on whether costs associated with universities' NIH grants were properly claimed. As part of their overall examinations of internal controls, nonfederal auditors examined transactions under various federal grants or contracts during their single audits, which resulted in questioning costs claimed by NIH grantees. OIG conducts its audits at its discretion subject to the availability of its audit resources.[Footnote 23] The OIG audits issued from fiscal years 2003 through 2006 that we reviewed generally focused on particular grants and the university's compliance with rules and regulations that pertained to them, rather than providing a broad examination of the university's internal controls and compliance with laws and regulations pertaining to federal funding.[Footnote 24] However, focusing on problems in claiming costs for a specific grant can uncover systemic internal control problems that could affect other federal grants. Although the scope of the single and OIG audits differed, findings resulting from these audits identified similar issues. For example, one single audit found that a university did not have effective internal controls to ensure that labor costs associated with an NIH grant, as well as with other federally funded programs, were properly documented and claimed. Similarly, an OIG audit found that a university overcharged $37,780 in direct and indirect costs associated with an NIH grant, which, in turn, revealed a systemic weakness in the university's procedures intended to ensure proper accounting for the time and activity of individuals working on its grants. Other issues that were identified as a result of both OIG and single audits included unallowable costs claimed, incorrect accounting for indirect costs, allocation of costs to the wrong grant, and insufficient monitoring of subrecipients. NIH Required Universities to Address Systemic Weaknesses and Reimburse the Questioned Costs That It Determined Were Not Sufficiently Supported: We found that NIH required universities to address all single and OIG audit findings and also required them to reimburse the costs questioned in the OIG audits to the extent that NIH determined the questioned costs were not sufficiently justified. Single and OIG audits in fiscal years 2003 through 2006 sometimes found nonmonetary problems related to a procedure or internal control or monetary problems with specific costs claimed for NIH extramural research grants. Overall, for fiscal years 2003 through 2006, 109 single audits and 9 OIG audits resulted in findings that required NIH resolution. For the 15 files that we reviewed documenting NIH's resolution of findings resulting from single or OIG audits, all contained nonmonetary findings resulting primarily from procedural weaknesses in need of resolution.[Footnote 25] NIH officials told us that findings resulting from single audits are typically nonmonetary in nature, such as inadequate documentation of costs claimed or insufficient monitoring of subrecipients of grants. OMB policy requires universities to develop corrective action plans to address single audit findings, and NIH has a similar requirement for OIG audits. In reviewing audit resolution files, we found that NIH obtained universities' documentation to address problems. These included corrective action plans and any revised policies and procedures cited in the corrective action plans for resolving particular nonmonetary findings, such as to ensure adequate documentation is maintained for claimed costs or to improve the process for monitoring subrecipients. For the 15 files we reviewed documenting NIH's resolution of findings resulting from single or OIG audits, 10 contained monetary findings of specific costs questioned that needed to be resolved. Three of these were single audits, and 7 were OIG audits. To resolve monetary findings, NIH determined how much of the amount in question the university was required to return. In doing so, NIH officials reviewed the monetary findings and discussed them with university officials. NIH officials explained to us that in determining whether the costs claimed should be accepted, NIH considered information from its staff responsible for overseeing a grant's scientific progress, including whether the research funded by the grant was complete and adequate, in addition to the documentation provided. Officials stated that NIH considered the facts of each case and determined whether the information provided to justify the costs claimed was sufficient. NIH officials told us that for single audits with monetary findings, NIH typically obtains the full amount of costs questioned from the universities. Two of the three single audits that contained such findings identified unallowable costs specific to NIH grants, and these costs were relatively small, totaling $4,296. In both cases, NIH recovered the full amount of these costs. The third audit questioned whether $153,529 in costs should be included in the calculation of a university's indirect cost rate. To resolve the issue, NIH required the university to reopen negotiation on its indirect cost rate. Subsequently, the university's indirect cost rate changed from 63 percent in fiscal year 2003 to 60 percent in fiscal year 2004. For monetary findings resulting from the OIG audits completed in fiscal years 2003 through 2006, we found that NIH did not always require universities to reimburse the full amount of costs questioned. Of the seven OIG audit files we reviewed with monetary findings, NIH recovered the full amount of costs questioned in two cases and recovered less than the full amount in five cases. In total, OIG questioned about 12 percent of the funds that it audited. Of the $1.5 million in funds questioned, NIH recovered $864,860. This represents about 56 percent of the OIG's questioned costs that NIH determined were insufficiently justified. (See table 1.) Table 1: NIH's Resolution of Monetary Issues Identified by OIG Audits: Audit number: A-04-04-01001; Fiscal year during which audit was completed: 2004; Costs audited by OIG: $4,070,528; Costs questioned by OIG: $565,820a; Costs insufficiently justified and recovered by NIH: $565,820. Audit number: A-01-06-01501; Fiscal year during which audit was completed: 2006; Costs audited by OIG: 761,219; Costs questioned by OIG: 249,525; Costs insufficiently justified and recovered by NIH: 249,525. Audit number: A-01-04-01505; Fiscal year during which audit was completed: 2005; Costs audited by OIG: 1,720,000; Costs questioned by OIG: 281,993; Costs insufficiently justified and recovered by NIH: 23,686. Audit number: A-01-02-01502; Fiscal year during which audit was completed: 2003; Costs audited by OIG: 1,900,000; Costs questioned by OIG: 102,378; Costs insufficiently justified and recovered by NIH: 19,323. Audit number: A-01-03-01503; Fiscal year during which audit was completed: 2004; Costs audited by OIG: 890,848; Costs questioned by OIG: 245,174; Costs insufficiently justified and recovered by NIH: 4,994. Audit number: A-01-04-01506; Fiscal year during which audit was completed: 2005; Costs audited by OIG: 2,730,000; Costs questioned by OIG: 37,780; Costs insufficiently justified and recovered by NIH: 1,512. Audit number: A-01-03-01502; Fiscal year during which audit was completed: 2004; Costs audited by OIG: 525,188; Costs questioned by OIG: 61,215; Costs insufficiently justified and recovered by NIH: 0. Audit number: Total; Fiscal year during which audit was completed: [Empty]; Costs audited by OIG: $12,597,783; Costs questioned by OIG: $1,543,885; Costs insufficiently justified and recovered by NIH: $864,860. Source: GAO analysis based on NIH's audit resolution documentation. [A] OIG also set aside $1,786,568 in costs claimed for NIH to determine if these costs were properly supported. NIH determined that they were. [End of table] NIH recovered less than the full questioned costs in the OIG audits because when NIH staff reviewed the audits, it determined that the costs in five cases were sufficiently justified by information provided by the grantee and input from NIH staff responsible for overseeing scientific progress associated with the grant. NIH staff sometimes accepted documents that OIG did not accept as sufficient evidence to support claimed costs. For example, for one university OIG could not determine who requested certain services and whether the costs were allocable to the grant. Although the university had presented invoices as support, the corresponding purchase requisitions, which contained the necessary information to address OIG's inquiry, had not been retained. Subsequently, NIH accepted the invoices as support and determined that approximately $119,000 of questioned costs were acceptable and need not be reimbursed. In other cases, the universities provided additional documentation to justify the costs that were claimed. For example, in one case, OIG found that costs associated with time and effort spent by summer and part-time labor were unsupported and other costs were incorrectly charged. The university provided alternate documentation for these costs, which OIG did not accept. However, after a review of the facts of the case and internal discussions with NIH staff responsible for overseeing scientific progress associated with the grant, NIH accepted the documentation in conjunction with additional explanatory information from the university and ultimately determined that the approximately $193,000 in costs claimed were acceptable. NIH officials told us that if a university does not agree with NIH's determination of the appropriate resolution of the audit, the agency issues an audit determination letter. The audit determination letter specifies the amounts to be returned, including accrued interest, and any corrective actions to be taken by the university. According to NIH officials, an audit determination letter is rarely needed because the universities and NIH almost always agree on the resolution of audit findings. In the event NIH issues such a letter, universities have the right to appeal an audit determination. Agency Comments and Our Evaluation: We provided a draft of our report to HHS for review. HHS provided technical comments, which we incorporated where appropriate. HHS indicated in its technical comments that, in addition to the key controls discussed in this report, it also has several other controls to oversee costs claimed by universities. Specifically, HHS mentioned ICs' use of the terms and conditions of the grant and prior approval requirements, the NIH Office of Financial Management's review and approval of financial status reports, and the HHS Division of Payment Management's reconciliation of federal cash transaction reports. While there is an element of professional judgment that enters into our determination of whether a control is key or not, we believe the controls we have identified are the most significant in the context of our engagement objectives. HHS also provided additional context on single audit coverage for universities receiving NIH research grants, stating that nearly all of NIH's research grant funding for fiscal years 2003 and 2004 was awarded to universities required to have a single audit for those years. As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days from this date. At that time, we will send copies of this report to the Secretary of HHS and appropriate congressional committees. We will also make copies available to others on request. In addition, the report will be available at no charge on GAO's Web site at http://www.gao.gov. If you or your staff have any questions, please contact Cynthia A. Bascetta at (202) 512-7101 or bascettac@gao.gov or Robert E. Martin at (202) 512-9508 or martinr@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in the enclosure. Sincerely yours, Signed by: Cynthia A. Bascetta: Director, Health Care: Signed by: Robert E. Martin: Director, Financial Management and Assurance: Enclosure: GAO Contacts and Staff Acknowledgments: GAO Contacts: Cynthia Bascetta, (202) 512-7101 or bascettac@gao.gov Robert E. Martin, (202) 512-9508 or martinr@gao.gov: Acknowledgments: In addition to the contacts named above, Sheila K. Avruch, Assistant Director; Kimberly Brooks, Assistant Director; Paul Caban; Nora Hoban; Keyla Lee; and Roseanne Price made key contributions to this report. (290570): FOOTNOTES [1] We are using the term university to refer to any domestic institution of higher education. [2] 2 C.F.R. pt. 220 (2006). [3] OMB assigns responsibility for negotiating indirect cost rates to HHS's DCA or the Department of Defense's Office of Naval Research, normally depending on which department provided more funds to the educational institution over the past 3 years. According to DCA, its staff negotiates rates for more than 90 percent of the universities that receive NIH grants. [4] NIH has 27 ICs, 24 of which have the authority to award grants. [5] We are using the term nonfederal auditors to include independent public accountants and state and local governmental audit organizations. [6] 31 U.S.C. ยงยง7501-7507. [7] If a university meets the funding threshold for having expended $500,000 or more in federal awards in the year, but only expends these funds under one federal program, it can choose to have an audit specific to that program, instead of an organizationwide single audit. [8] Internal controls are plans, methods, and procedures used by organizations to meet their missions, goals, and objectives; to serve as the first line of defense in safeguarding assets; and to prevent and detect errors and fraud. [9] Under OMB Circular No. A-133, grants from different sources for the same broad purpose, such as research and development, can be combined and considered a major program for audit purposes. [10] The total amount awarded to these universities accounted for over 80 percent of the total amount awarded to all universities receiving NIH extramural research grants during fiscal years 2003 through 2005. [11] We did so by matching names from a file of universities and their federal funding levels that we obtained from HHS with a file of universities that received NIH extramural research grants. Because of technical difficulties in matching these files, we are likely to have underestimated the number of universities that received NIH extramural research grants and were required to have single audits. In addition, we could not determine the frequency of single audits required from universities receiving NIH extramural grants for fiscal years 2005 and 2006 because HHS did not have complete information for these years at the time of our review. [12] Indirect costs are often referred to as facility and administrative, or F&A, costs. [13] Costs for subcontracts over $25,000 and equipment are excluded because they can involve very large expenditures but usually do not require the university's facilities and administrative support. [14] Predetermined indirect cost rates, which are set through negotiation, were first authorized by law in 1962. Pub. L. No. 87-638, 76 Stat. 437. [15] The Office of Naval Research in the Department of Defense is responsible for reviewing and approving indirect cost rate proposals for the other universities. [16] On June 27, 2003, OMB amended Circular No. A-133 to, among other things, raise the dollar threshold for single audits. Universities with fiscal years ending prior to January 1, 2004, and that expended $300,000 or more in federal awards were required to obtain single audits. For universities with fiscal years ending after December 31, 2003, the threshold amount to require single audits was set at $500,000 in expended federal awards. [17] Modified total direct costs are those that are closely tied to specific grants or projects minus the costs excluded for the purposes of calculating an indirect cost rate. [18] DCA classified universities for review purposes based on a dollar threshold for the amount of federal funding each received in the fiscal year prior to the year in which the university submitted its indirect cost rate proposal. High-dollar universities are those receiving over $21 million in federal funding during this period. [19] According to DCA officials, DCA is responsible for negotiating rates for most universities receiving NIH extramural research grants, and the rates generally remain in effect for 2 to 4 years. [20] Other university functions include, for example, teaching and training activities. [21] This examination did not include determining whether universities' implementation of cost accounting practices complied with the cost accounting standards in OMB Circular No. A-21. [22] In fiscal year 2003, 534 universities received NIH extramural research grants; 385 of these were required to have single audits. In fiscal year 2004, 532 universities received NIH extramural research grants; 392 of these were required to have single audits. [23] Because of the risk of improper payments under the Medicare and Medicaid programs, the majority of OIG funding is used for audit work related to these federal programs. [24] According to OIG officials, audits currently under way for fiscal year 2007 involve the examination of broader issues across several universities, such as whether universities are appropriately allocating administrative costs to their indirect cost rates. [25] We reviewed seven randomly selected single audits and eight OIG audits, which represented all of the OIG audits from fiscal years 2003 through 2006 involving NIH grants in which all steps to resolve the audit findings had been completed. GAO's Mission: The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO's Web site (www.gao.gov). Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to www.gao.gov and select "Subscribe to Updates." Order by Mail or Phone: The first copy of each printed report is free. Additional copies are $2 each. A check or money order should be made out to the Superintendent of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single address are discounted 25 percent. Orders should be sent to: U.S. Government Accountability Office 441 G Street NW, Room LM Washington, D.C. 20548: To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202) 512-6061: To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov Automated answering system: (800) 424-5454 or (202) 512-7470: Congressional Relations: Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 U.S. Government Accountability Office, 441 G Street NW, Room 7125 Washington, D.C. 20548: Public Affairs: Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, D.C. 20548: