2017 Disaster Relief Oversight:
Strategy Needed to Ensure Agencies’ Internal Control Plans Provide Sufficient Information
GAO-19-479: Published: Jun 28, 2019. Publicly Released: Jun 28, 2019.
- Full Report:
- Highlights Page:
- Print Version:
- Accessible Version:
Congress approved more than $120 billion in additional funding for relief and recovery efforts following the 2017 disaster season.
Agencies were required to submit their plans for ensuring this money was spent efficiently and effectively to Congress and others in accordance with guidance developed by the Office of Management and Budget.
We reviewed plans submitted by 6 agencies along with OMB’s guidance. We found OMB lacked a strategy for ensuring that agencies provide sufficient, useful plans in a timely manner for oversight of disaster relief funds.
We recommended that OMB develop such a strategy.
Damage in Puerto Rico after Hurricane Maria in 2017
Photo of damage caused by Hurricane Maria in Puerto Rico
This report features a new HTML format that GAO is piloting in 2018.
To provide feedback on this format, e-mail firstname.lastname@example.org
- Full Report:
- Highlights Page:
- Print Version:
- Accessible Version:
What GAO Found
Of the six agencies GAO selected for review, only the Department of Education submitted its internal control plan for disaster relief funds by the statutory deadline. The Department of Defense did not submit an internal control plan. The Departments of Agriculture, Homeland Security, and Housing and Urban Development and the Small Business Administration submitted the required internal control plans ranging from about 2 months to more than 7 months following the March 31, 2018, statutory deadline.
The Office of Management and Budget (OMB) did not have an effective strategy to ensure that agencies timely submitted internal control plans. OMB issued OMB Memorandum M-18-14 (M-18-14), Implementation of Internal Controls and Grant Expenditures for the Disaster-Related Appropriations, which contained guidance for agencies to use in developing their plans, on March 30, 2018, or 1 day before the statutory deadline for agencies to submit plans. Congress required OMB to issue standard guidance for agencies to use in designing internal control plans. The guidance was to include robust criteria for identifying and documenting incremental risks and mitigating controls related to disaster relief funding, and guidance for documenting the linkage between incremental risks related to disaster relief funding and efforts to address known internal control risks.
Selected agencies' plans did not include sufficient information for GAO to determine if the agencies met OMB directives in M-18-14 and federal internal control standards' documentation requirements. For example, two of the five plans GAO reviewed included information that demonstrated that the plans complemented the agencies’ existing risk management practices, while three plans lacked sufficient information to make such a determination. Further, M-18-14 lacked specific instructions to agencies on what to include in their internal control plans.
OMB did not have an effective outreach strategy to help ensure that agencies had proper guidance in developing and reporting their plans. OMB did not establish an external communication mechanism to ensure that internal control plans addressed key payment-integrity risks for disaster relief funds. OMB staff stated that OMB Circular No. A-123's enterprise risk management (ERM) requirements were sufficient for agencies to produce effective internal control plans, because agencies should consider disaster situations as part of their overall consideration of risk. However, while it is important that agencies develop an effective ERM process, Congress required agencies to communicate internal control plans associated with the supplemental funding provided. Federal internal control standards state that management should externally communicate necessary quality information to achieve the entity’s objectives. Without a clear OMB strategy for preparing for oversight of future disaster relief funding, there is an increased risk that agencies will not appropriately assess risks associated with disaster relief funding. As a result, Congress and others may not receive the necessary information about internal controls, which will affect Congress’s and others’ ability to provide effective oversight.
Why GAO Did This Study
Agencies must deliver disaster relief funding expeditiously. However, the risk of improper payments increases when agencies spend billions of dollars quickly. In 2017, Hurricanes Harvey, Irma, and Maria and the California wildfires created an unprecedented demand for federal disaster response and recovery resources. Congress passed three supplemental appropriations totaling over $120 billion in additional funding in response to these disasters. As part of the appropriations, Congress included an oversight framework that required federal agencies to submit internal control plans for spending these funds by March 31, 2018, in accordance with criteria to be established by OMB.
This report addresses the extent to which selected federal agencies’ internal control plans provided sufficient and timely external communication to Congress and others. To address this objective, GAO selected for review six agencies that together received $115 billion of the approximately $120 billion in supplemental appropriations for activities in response to the 2017 disasters. GAO reviewed these agencies’ internal control plans and M-18-14, evaluated the internal control plans against M-18-14 and internal control standards, and interviewed agency officials and OMB staff.
What GAO Recommends
GAO recommends that OMB develop a strategy for ensuring that agencies communicate timely and sufficient internal control plans for disaster relief funds. OMB did not agree that this recommendation is needed. GAO continues to believe the recommendation is appropriate and needed, as discussed in the report.
For more information, contact Beryl H. Davis at (202)251-2262 or DavisBH@gao.gov.
Recommendation for Executive Action
Comments: OMB disagreed with our recommendation. OMB staff stated that OMB did not believe the sufficiency or timeliness of control plans present material issues that warranted OMB action. While OMB acknowledged that almost all agency control plans were submitted after the statutory deadline, OMB staff stated that this delay in itself neither indicated the absence of controls nor the effectiveness of those controls. Further, OMB staff stated that it is agency management and not OMB that has responsibility for ensuring compliance with applicable laws and regulations. While agencies were responsible for submitting their internal control plans, federal law placed the responsibility of establishing the criteria for the internal control plans with OMB. We found that OMB provided neither timely nor sufficient guidance to agencies for developing their internal control plans. Specifically, OMB issued M-18-14 1 day before agencies were required to submit their internal control plans. Further, M-18-14 provided a general description of the process for developing the plans through Circular A-123 ERM requirements, but it did not provide clear guidance on the purpose of internal control plans or the type of information that was expected to be included in the written plans. Because OMB did not establish an effective strategy for timely communicating requirements for agency reporting in internal control plans, federal agencies lacked the information needed to meet the statutory deadline. In addition, absent clear reporting guidance, such as criteria specifying plan content or illustrative examples of completed plans, certain federal agencies had difficulties in developing their plans. OMB staff also stated that OMB believed its guidance, in particular Circular A-123, which OMB said implements GAO's Standards for Internal Control in the Federal Government and GAO's A Framework for Managing Fraud Risks in Federal Programs, provides the guidance needed to prepare agencies' control plans. OMB staff stated that control plans in an effective system of internal control should be operational, iterative, living documents that should be updated in response to emerging risks. According to OMB staff, internal control plans are not developed for external communications and are not the sources of assurances over disaster relief funds, which are published in agencies' annual financial reports. While it is important that agencies implement Circular A-123, which directs agencies to develop effective ERM processes, we believe that ERM does not negate the need for assuring effective internal controls over disaster relief funds. As we noted in our report, with OMB's focus on ERM, it is possible for agencies to determine that disaster funding does not rise to the level of a significant risk; therefore, agencies' internal control plans would not specifically address risks associated with disaster funding. In addition, while it is important for agencies to update their internal control plans in response to emerging risks, Congress specifically required agencies to communicate internal control plans for the supplemental funds provided for activities related to the 2017 disasters. These plans, when provided timely and with sufficient information, could serve as a critical transparency tool to provide lawmakers some assurance that agencies will establish effective and efficient controls over the disaster funds. Therefore, we believe that our recommendation is warranted.
Recommendation: The Director of OMB, after consulting with key stakeholders (e.g., the Chief Financial Officers Council), should develop a strategy for ensuring that agencies communicate sufficient and timely internal control plans for effective oversight of disaster relief funds. (Recommendation 1)
Agency Affected: Executive Office of the President: Office of Management and Budget