A Government Accountability Office (GAO) review has found a lack of strategy regarding oversight of disaster relief funds. Congress approved more than $120 billion in additional funding for relief and recovery efforts following the 2017 disaster season. Agencies were required to submit their plans for ensuring this money was spent efficiently and effectively to Congress and others in accordance with guidance developed by the Office of Management and Budget (OMB).
GAO reviewed plans submitted by six agencies along with OMB’s guidance and found OMB lacked a strategy for ensuring that agencies provide sufficient, useful plans in a timely manner for oversight of disaster relief funds.
Of the six agencies GAO selected for review, only the Department of Education submitted its internal control plan for disaster relief funds by the statutory deadline. The Department of Defense did not submit an internal control plan. The Departments of Agriculture, Homeland Security, and Housing and Urban Development and the Small Business Administration submitted the required internal control plans ranging from about 2 months to more than 7 months following the March 31, 2018, statutory deadline.
The Office of Management and Budget (OMB) did not have an effective strategy to ensure that agencies timely submitted internal control plans. OMB issued OMB Memorandum M-18-14 (M-18-14), Implementation of Internal Controls and Grant Expenditures for the Disaster-Related Appropriations, which contained guidance for agencies to use in developing their plans, on March 30, 2018, one day before the statutory deadline for agencies to submit plans. Congress required OMB to issue standard guidance for agencies to use in designing internal control plans. The guidance was to include robust criteria for identifying and documenting incremental risks and mitigating controls related to disaster relief funding, and guidance for documenting the linkage between incremental risks related to disaster relief funding and efforts to address known internal control risks.
GAO said the selected agencies’ plans did not include sufficient information for the review to determine if the agencies met OMB directives in M-18-14 and federal internal control standards’ documentation requirements.
Because OMB did not have an effective outreach strategy, it could not ensure that agencies had proper guidance in developing and reporting their plans. OMB did not establish an external communication mechanism to ensure that internal control plans addressed key payment-integrity risks for disaster relief funds. OMB staff stated that OMB Circular No. A-123’s enterprise risk management (ERM) requirements were sufficient for agencies to produce effective internal control plans, because agencies should consider disaster situations as part of their overall consideration of risk. However, while it is important that agencies develop an effective ERM process, Congress required agencies to communicate internal control plans associated with the supplemental funding provided. Federal internal control standards state that management should externally communicate necessary quality information to achieve the entity’s objectives.
Without a clear OMB strategy for preparing for oversight of future disaster relief funding, there is an increased risk that agencies will not appropriately assess risks associated with disaster relief funding. As a result, Congress and others may not receive the necessary information about internal controls, which will affect Congress’s and others’ ability to provide effective oversight.
The destruction that disasters cause must be addressed immediately, and agencies must deliver disaster relief funding expeditiously. However, the risk of improper payments increases when agencies spend billions of dollars quickly. GAO therefore recommends that OMB develop a strategy for ensuring that agencies communicate timely and sufficient internal control plans for disaster relief funds. OMB did not agree that this recommendation is needed.
OMB disagrees with the recommendation and does not believe the sufficiency or timeliness of control plans present material issues that warrant OMB action. While OMB acknowledges that almost all agency control plans were submitted after the statutory deadline, OMB staff state that this delay in itself neither indicated the absence of controls nor the effectiveness of those controls. Further, OMB staff say that it is agency management and not OMB that has responsibility for ensuring compliance with applicable laws and regulations.
OMB also believes its guidance, in particular Circular A-123, which OMB said implements GAO’s Standards for Internal Control in the Federal Government and GAO’s A Framework for Managing Fraud Risks in Federal Programs, provides the guidance needed to prepare agencies’ control plans. OMB staff stated that control plans in an effective system of internal control should be operational, iterative, living documents that should be updated in response to emerging risks. According to OMB staff, internal control plans are not developed for external communications and are not the sources of assurances over disaster relief funds, which are published in agencies’ annual financial reports.
GAO says that while it is important that agencies implement Circular A-123, this does not negate the need for assuring effective internal controls over disaster relief funds. In addition, while it is important for agencies to update their internal control plans in response to emerging risks, Congress specifically required agencies to communicate internal control plans for the supplemental funds provided for activities related to the 2017 disasters. These plans, when provided timely and with sufficient information, could serve as a critical transparency tool to provide lawmakers some assurance that agencies will establish effective and efficient controls over the disaster funds.