2017 Disaster Relief Oversight: Strategy Needed to Ensure Agencies’ Internal Control Plans Provide Sufficient Information
Fast Facts
Congress approved more than $120 billion in additional funding for relief and recovery efforts following the 2017 disaster season.
Agencies were required to submit their plans for ensuring this money was spent efficiently and effectively to Congress and others in accordance with guidance developed by the Office of Management and Budget.
We reviewed plans submitted by 6 agencies along with OMB’s guidance. We found OMB lacked a strategy for ensuring that agencies provide sufficient, useful plans in a timely manner for oversight of disaster relief funds.
We recommended that OMB develop such a strategy.
Damage in Puerto Rico after Hurricane Maria in 2017
Photo of damage caused by Hurricane Maria in Puerto Rico
Highlights
What GAO Found
Of the six agencies GAO selected for review, only the Department of Education submitted its internal control plan for disaster relief funds by the statutory deadline. The Department of Defense did not submit an internal control plan. The Departments of Agriculture, Homeland Security, and Housing and Urban Development and the Small Business Administration submitted the required internal control plans ranging from about 2 months to more than 7 months following the March 31, 2018, statutory deadline.
The Office of Management and Budget (OMB) did not have an effective strategy to ensure that agencies timely submitted internal control plans. OMB issued OMB Memorandum M-18-14 (M-18-14), Implementation of Internal Controls and Grant Expenditures for the Disaster-Related Appropriations, which contained guidance for agencies to use in developing their plans, on March 30, 2018, or 1 day before the statutory deadline for agencies to submit plans. Congress required OMB to issue standard guidance for agencies to use in designing internal control plans. The guidance was to include robust criteria for identifying and documenting incremental risks and mitigating controls related to disaster relief funding, and guidance for documenting the linkage between incremental risks related to disaster relief funding and efforts to address known internal control risks.
Selected agencies' plans did not include sufficient information for GAO to determine if the agencies met OMB directives in M-18-14 and federal internal control standards' documentation requirements. For example, two of the five plans GAO reviewed included information that demonstrated that the plans complemented the agencies’ existing risk management practices, while three plans lacked sufficient information to make such a determination. Further, M-18-14 lacked specific instructions to agencies on what to include in their internal control plans.
OMB did not have an effective outreach strategy to help ensure that agencies had proper guidance in developing and reporting their plans. OMB did not establish an external communication mechanism to ensure that internal control plans addressed key payment-integrity risks for disaster relief funds. OMB staff stated that OMB Circular No. A-123's enterprise risk management (ERM) requirements were sufficient for agencies to produce effective internal control plans, because agencies should consider disaster situations as part of their overall consideration of risk. However, while it is important that agencies develop an effective ERM process, Congress required agencies to communicate internal control plans associated with the supplemental funding provided. Federal internal control standards state that management should externally communicate necessary quality information to achieve the entity’s objectives. Without a clear OMB strategy for preparing for oversight of future disaster relief funding, there is an increased risk that agencies will not appropriately assess risks associated with disaster relief funding. As a result, Congress and others may not receive the necessary information about internal controls, which will affect Congress’s and others’ ability to provide effective oversight.
Why GAO Did This Study
Agencies must deliver disaster relief funding expeditiously. However, the risk of improper payments increases when agencies spend billions of dollars quickly. In 2017, Hurricanes Harvey, Irma, and Maria and the California wildfires created an unprecedented demand for federal disaster response and recovery resources. Congress passed three supplemental appropriations totaling over $120 billion in additional funding in response to these disasters. As part of the appropriations, Congress included an oversight framework that required federal agencies to submit internal control plans for spending these funds by March 31, 2018, in accordance with criteria to be established by OMB.
This report addresses the extent to which selected federal agencies’ internal control plans provided sufficient and timely external communication to Congress and others. To address this objective, GAO selected for review six agencies that together received $115 billion of the approximately $120 billion in supplemental appropriations for activities in response to the 2017 disasters. GAO reviewed these agencies’ internal control plans and M-18-14, evaluated the internal control plans against M-18-14 and internal control standards, and interviewed agency officials and OMB staff.
Recommendations
GAO recommends that OMB develop a strategy for ensuring that agencies communicate timely and sufficient internal control plans for disaster relief funds. OMB did not agree that this recommendation is needed. GAO continues to believe the recommendation is appropriate and needed, as discussed in the report.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Office of Management and Budget |
Priority Rec.
The Director of OMB, after consulting with key stakeholders (e.g., the Chief Financial Officers Council), should develop a strategy for ensuring that agencies communicate sufficient and timely internal control plans for effective oversight of disaster relief funds. (Recommendation 1) |
Open
The Office of Management and Budget (OMB) disagreed with our recommendation. In its agency comments, OMB staff stated that OMB did not believe the sufficiency or timeliness of control plans present material issues that warranted OMB action. While OMB acknowledged that almost all agency control plans were submitted after the statutory deadline, OMB staff stated that this delay in itself neither indicated the absence of controls nor the effectiveness of those controls. Further, OMB staff stated that it is agency management and not OMB that has responsibility for ensuring compliance with applicable laws and regulations. While agencies were responsible for submitting their internal control plans, federal law placed the responsibility of establishing the criteria for the internal control plans with OMB. Therefore, we believe that our recommendation is warranted. As of March 2024, OMB did not indicate any change in its position. We will continue to monitor OMB's actions to address this recommendation.
|