Recommendation: The Secretary of Agriculture should direct the Under Secretary for Food, Nutrition, and Consumer Services to design policies and procedures to reasonably assure that all award recipients required to submit single audit reports do so in accordance with OMB guidance.

Agency: Department of Agriculture
Status: Open
Priority recommendation

Comments: U.S. Department of Agriculture's (USDA) Food and Nutrition Service (FNS) neither agreed nor disagreed with our recommendation. As of February 3, 2020, FNS stated that it has made revisions to the agency audit manual to meet the intent of the recommendation. In a section of the manual devoted to Cognizant and Awarding Agency Responsibilities (2 CFR 200.513), FNS is adding a bullet that states that the Federal awarding agency must "ensure that audits are completed and reports are received in a timely manner and in accordance with the requirements of 2 CFR 200.512(a)." FNS plans on releasing the full agency audit manual to FNS users in final by the end of Fiscal Year 2020. We believe that FNS's corrective actions will help FNS to meet the intent of our recommendation with regards to designing policies. However, to fully meet the intent of the recommendation, in addition to revising policies, FNS also needs to implement procedures to ensure staff are following the revised policies. We will assess these efforts once completed.

Recommendation: The Secretary of Agriculture should direct the Under Secretary for Food, Nutrition, and Consumer Services to revise policies and procedures to reasonably assure that management decisions contain the required elements and are issued timely in accordance with OMB guidance.

Agency: Department of Agriculture
Status: Open
Priority recommendation

Comments: U.S. Department of Agriculture's (USDA) Food and Nutrition Service (FNS) neither agreed nor disagreed with our recommendation. As of February 3, 2020, FNS stated that it has made revisions to the agency audit manual to meet the intent of the recommendation. In a section of the manual devoted to Cognizant and Awarding Agency Responsibilities (2 CFR 200.513), FNS stated that it is expanding upon an existing bullet that states that the Federal awarding agency must "issue a management decision on audit findings within six months after receipt of the audit report....". FNS indicated this section of the manual will be expanded to include the four elements that a management decision must clearly state in writing as prescribed in 2 CFR 200.521(a). FNS plans on releasing the full agency audit manual to FNS users in final by the end of Fiscal Year 2020. We believe that FNS's corrective actions will help FNS to meet the intent of our recommendation with regards to designing policies. However, to fully meet the intent of the recommendation, in addition to revising policies, FNS also needs to implement procedures to ensure staff are following the revised policies. We will assess these efforts once completed.

Recommendation: The Secretary of Agriculture should direct the Under Secretary for Food, Nutrition, and Consumer Services to design and implement policies and procedures for identifying and managing high-risk and recurring single audit findings using a risk-based approach.

Agency: Department of Agriculture
Status: Open

Comments: U.S. Department of Agriculture's (USDA) Food and Nutrition Service (FNS) neither agreed nor disagreed with our recommendation. As of February 3, 2020, FNS stated that it has made revisions to the agency audit manual to meet the intent of the recommendation. In a section of the manual devoted to Cognizant and Awarding Agency Responsibilities (2 CFR 200.513), FNS is adding a bullet stating that the cognizant agency is responsible for "developing a risk-based approach to manage high-risk and recurring single audit findings to identify problems so that adequate resources can be dedicated to address the problem." FNS plans on releasing the full agency audit manual to FNS users in final by the end of Fiscal Year 2020. We believe that FNS's corrective actions will partially help FNS to meet the intent of our recommendation with regards to designing policies. When designing policies, we believe FNS also needs to clearly provide guidance on the risk management strategy over high-risk and recurring single audit findings, including the steps to follow for identifying problem areas and setting priorities for addressing them. To fully meet the intent of the recommendation, in addition to revising policies, FNS also needs to implement procedures to ensure staff are following the revised policies. We will assess these efforts once completed.

Recommendation: The Secretary of Agriculture should direct the Under Secretary for Rural Development to design policies and procedures to reasonably assure that all award recipients required to submit single audit reports do so in accordance with OMB guidance.

Agency: Department of Agriculture
Status: Open
Priority recommendation

Comments: U.S. Department of Agriculture's (USDA) Rural Development (RD) concurred with our recommendation. To address the GAO recommendation, in February 2020, RD stated that it has developed a disbursement report that will capture disbursements equal to or greater than $750,000 and is currently documenting that process and creating instructions for the program areas. RD indicated that it plans to complete these actions by June 30, 2020. We will assess these efforts once completed.

Recommendation: The Secretary of Agriculture should direct the Under Secretary for Rural Development to revise policies and procedures to reasonably assure that management decisions contain the required elements and are issued timely in accordance with OMB guidance.

Agency: Department of Agriculture
Status: Open
Priority recommendation

Comments: U.S. Department of Agriculture's (USDA) Rural Development (RD) concurred with our recommendation. To address the GAO recommendation, in February 2020, RD stated it has developed a Management Decision Manual template that the program areas will use and is currently creating instructions for the program areas. RD indicated that it plans to complete these actions by June 30, 2020. We will assess these efforts once completed.

Recommendation: The Secretary of Agriculture should direct the Under Secretary for Rural Development to design and implement policies and procedures for identifying and managing high-risk and recurring single audit findings using a risk-based approach.

Agency: Department of Agriculture
Status: Open

Comments: U.S. Department of Agriculture's (USDA) Rural Development (RD) concurred with our recommendation. To address the GAO recommendation, in February 2020, RD stated that it has developed a process to rate each single audit finding. According to RD, the ratings will be tracked in an Access Database, where it will generate reports indicating reoccurring and high-risk findings by borrower and by program. RD indicated that it plans to complete these actions by June 30, 2020. We will assess these efforts once completed.

Recommendation: The Secretary of Housing and Urban Development should direct the Principal Deputy Assistant Secretary for the Office of Community Planning and Development to design and implement policies and procedures for identifying and managing high-risk and recurring single audit findings using a risk-based approach.

Agency: Department of Housing and Urban Development
Status: Open

Comments: The Department of Housing and Urban Development's (HUD) Office of Community Planning and Development (CPD) stated that it did not agree with GAO's emphasis on high risk/recurring single audit findings. Nevertheless, in March 2019, HUD's CPD stated that it is working towards a redesigned model for analyzing risk as a basis for monitoring. In August 2020, HUD informed us that CPD is finalizing the beta test for the risk model. Although the risk model will be further defined and enhanced in fiscal year 2021 for fiscal year 2022, CPD plans to roll out the beta test of the risk model to develop the fiscal year 2021 risk rankings. Single audit will be one factor that is included in calculating the risk scores. CPD will validate and assess the results of the beta test and make adjustments as needed. We will continue to monitor agency's actions to address this recommendation.

Recommendation: The Secretary of Housing and Urban Development should direct the Principal Deputy Assistant Secretary for the Office of Public and Indian Housing to design and implement policies and procedures for identifying and managing high-risk and recurring single audit findings using a risk-based approach.

Agency: Department of Housing and Urban Development
Status: Open

Comments: The Department of Housing and Urban Development's (HUD) Office of Public and Indian Housing (PIH) agreed with this recommendation. On May 7, 2018, PIH stated that it had implemented a Risk Based Approach Tool designed to identify and manage high-risk and recurring single audit findings. The Risk Based Approach tool was intended to track and focus on audit findings reported as material weaknesses or significant deficiencies and was designed to determine the resources needed and available to assist in mitigating the audit findings. However, in March 2019, PIH informed us that in late 2018, PIH began to work toward repositioning goals, priorities and identification of key risk indicators. PIH stated that it is now focused on aligning risk indicators to the HUD and PIH priorities. PIH priorities for fiscal year 2019 include addressing Public Housing Authorities insolvency which may be identified through an Independent Public Accountant audit or through other means. PIH stated that it no longer uses the assessment tool that included over 100 risk indicators. PIH indicated that it has a revised risk mitigation framework proposal that will be presented to the Enterprise Risk Counsel in the near future. In fiscal year 2020, we have sent additional follow-up questions to the agency and are currently waiting for a response. We will continue to monitor agency's actions to address this recommendation.

Recommendation: As NIH-DFAS begins formalizing its internal guidance, the Director of NIH-DFAS should establish a mechanism for tracking key milestones in the indirect cost rate-setting process, such as when indirect cost rate proposals are due.

Agency: Department of Health and Human Services: Public Health Service: National Institutes of Health: Office of Management: Office of Acquisition and Logistics Management: Office of Acquisition Management and Policy: Division of Financial Advisory Services
Status: Open

Comments: HHS concurred with this recommendations. In response, HHS stated that National Institute of Health's Division of Financial Advisory Services (DFAS) will establish a mechanism for tracking key milestones in the indirect cost rate-setting process. NIH-DFAS has initiatives underway that include moving from paper to electronic submissions of indirect cost proposals and developing a replacement to its Commercial Rate Agreement Distribution Services website. DFAS is looking into the feasibility of incorporating key milestones into these two major initiatives. NIH-DFAS is currently working with a contractor to develop a web based system that will establish a tracking system to account for when indirect cost proposal are due from organizations. The original initiative to enable the electronic submission of indirect cost proposals was modified to incorporate this new requirement. NIH-DFAS anticipates the planned date for implementation of this system to be October 1, 2017. As of February 4, 2020, this recommendation is still open because DFAS does not have the "proposal due date" and "extension due date" data fields activated in eFLow. DFAS is looking into adding those enhancements and hope to have these updates implemented by June 30, 2020. On July 8th, 2020, NIH-DFAS notified us that they plan to update us with the status of this recommendation by October 2020. We will continue to monitor the status of this recommendation.

Recommendation: In order to improve NMB's planning and make the most effective use of its limited resources, the Chairman of the National Mediation Board should develop and fully implement key components of an information security program in accordance with the Federal Information Security Management Act of 2002.

Agency: National Mediation Board
Status: Open

Comments: In February 2020, we determined that NMB had taken some steps to further implement key information security practices, but had not fully implemented this recommendation. We reported in GAO-20-236 that NMB continued to only partially follow the eight key information security practices in accordance with the Federal Information Security Management Act (FISMA). NMB must take other steps, such as providing risk assessment documentation of its enterprise network for fiscal year 2019. NMB officials stated that the agency plans to address several of these practices by the end of fiscal year 2020. They further noted that they hired a Chief Information Officer and planned to hire additional staff and employ contractors to aid in these efforts.

Recommendation: In order to improve NMB's planning and make the most effective use of its limited resources, the Chairman of the National Mediation Board should establish a privacy program that includes conducting privacy impact assessments and issuing system of record notices for systems that contain personally identifiable information.

Agency: National Mediation Board
Status: Open

Comments: In February 2020, we reported in GAO-20-236 that NMB had taken some steps to implement information privacy practices, such as designating a privacy officer. However, NMB must take additional steps, such as specifying whether a system of records notice would be developed, as required by the Office of Management and Budget.

Recommendation: To proactively prepare for oversight of future disaster relief funding, the Director of OMB should develop standard guidance for federal agencies to use in designing internal control plans for disaster relief funding. Such guidance could leverage existing internal control review processes and should include, at a minimum, the following elements: (1) robust criteria for identifying and documenting incremental risks and mitigating controls related to the funding and (2) requirements for documenting the linkage between the incremental risks related to disaster funding and efforts to address known internal control risks.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open
Priority recommendation

Comments: To address the recommendation, OMB should issue guidance on internal control for disaster relief funding, including criteria for identifying additional risks and mitigating controls related to the funding and a requirement to link these incremental risks to ongoing efforts to address known internal control risks. On July 15, 2016, OMB issued the revised Circular No. A-123, Management's Responsibility for Enterprise Risk Management and Internal Control. The Circular requires agencies to implement enterprise risk management, which includes the development of a risk profile that analyzes the risks faced in achieving strategic objectives and identifies options for addressing them. In April 2017, OMB staff stated that they believe that the implementation of enterprise risk management through Circular No. A-123 satisfies the intent our recommendation. Because the responsibility for implementing enterprise risk management lies with agency management, Circular No. A-123 does not include specific guidance for identifying risks related to disaster funding. Further discussion and documentation to support OMB's position that the revised Circular addresses our recommendation will be necessary. The Bipartisan Budget Act of 2018, Sec. 21208(c) requires OMB to issue standard guidance for Federal agencies to use in designing internal control plans for disaster relief funding in order to proactively prepare for oversight of future disaster relief funds. The Act states this guidance shall leverage existing internal control review processes and shall include, at a minimum, (1) robust criteria for identifying and documenting incremental risks and mitigating controls related to the funding, and (2) guidance for documenting the linkage between the incremental risks related to disaster funding and efforts to address known internal control risks. GAO reviewed OMB's actions to implement the law. On June 28, 2019, GAO, 2017 Disaster Relief Oversight: Strategy Needed to Ensure Agencies' Internal Control Plans Provide Sufficient Information, GAO-19-479 (Washington, D.C.: Jun 28, 2019) reported the 2013 recommendation remains open and that we plan to continue monitoring OMB's progress in implementing this priority recommendation. Further, the report stated that OMB did not have an effective strategy to ensure that agencies timely submitted internal control plans; and OMB's Memorandum M-18-14, Implementation of Internal Controls and Grant Expenditures for the Disaster-Related Appropriations lacked specific instructions to agencies on what to include in their internal control plans. As such, a new recommendation was warranted. As of February 2020, OMB has not provided any new status updates for this recommendation.

Recommendation: To help ensure that HHS is adequately and comprehensively assessing HPP and PHEP awardees' performance and progress in meeting the medical and public health preparedness goals of the cooperative agreements, the Secretary of Health and Human Services should direct ASPR and CDC to develop objective and quantifiable performance targets and incremental milestones that correspond to the new HPP and PHEP performance measures, against which HHS can gauge progress toward the medical and public health preparedness goals of the cooperative agreements and direct technical assistance, as needed.

Agency: Department of Health and Human Services
Status: Open

Comments: Since we examined the HPP and PHEP cooperative agreements in 2012, ASPR had developed few targets for the HPP program measures or their corresponding indicators that were contained in the HPP performance measurement guidance documents issued for Budget Periods (BP) 2-5, ending June 30, 2017. Additionally, the new HPP performance measure implementation guidance for the 5-year project cycle from 2017-2022 introduces 28 performance measures, with few having targets; the guidance notes that corresponding goals or targets may be set at a later date after data from the first budget period of this new project cycle has been reviewed. Regarding PHEP, CDC had developed performance targets for about half of the performance measures as of the PHEP BP5 performance measurement guidance (BP5 ended June 30, 2017). These performance measures generally remain the same, with existing targets, for BP1 (July 1, 2017-June 30, 2018) of the new 5-year budget cycle. GAO recognizes that it may not be appropriate to develop performance targets for every performance measure depending on the desired process or outcome; however, both agencies still have work to do in this area. In November 2017, both ASPR and CDC officials noted that they could not commit to setting consistent targets with incremental milestones over a budget cycle and therefore could not implement the recommendation. As of August 2018, there was no change from the agencies' position that they do not have plans to fully implement the recommendation at this time.

Recommendation: To help ensure that HHS is adequately and comprehensively assessing HPP and PHEP awardees' performance and progress in meeting the medical and public health preparedness goals of the cooperative agreements, the Secretary of Health and Human Services should ensure that performance measures and targets remain consistent across the 5-year project cycle and that any future measures be comparable to determine whether awardees are making progress toward meeting short- and long-term medical and public health preparedness goals of the cooperative agreements.

Agency: Department of Health and Human Services
Status: Open

Comments: Since we first examined the HPP and PHEP cooperative agreements in 2012, ASPR and CDC had made efforts to maintain consistency in their performance measures, particularly in the last 3 years of the prior project cycle which ended June 30, 2017. However, because part of the recommendation includes consistency of performance measures into future project cycles, we also examined whether both cooperative agreements continued to use basically the same performance measures into the current 5-year cycle, which began July 1, 2017. ASPR's HPP has made a significant change in its performance measures, introducing a new set of 28 performance measures for this new 5-year cycle. CDC's PHEP performance measures generally remained consistent in the last two budget periods of the prior 5-year cycle, and remained generally the same for the first year of the new 5-year cycle (some measures were "retired," though key components from a measure may continue to be used by CDC in other types of reviews). Additionally, in November 2017, both CDC and ASPR officials noted that they may need to continue to adjust the performance measures during the new 5-year cycle. As of August 2018, as a result of the change to HPP's measures and the agency statements in November 2017, GAO anticipates keeping this recommendation open at least for the next few budget periods, in order to determine whether the agencies maintain consistency with the performance measures during the new project cycle.