2017 Disaster Relief Oversight : Strategy Needed to Ensure Agencies’ Internal Control Plans Provide Sufficient Information

What GAO Found

Of the six agencies GAO selected for review, only the Department of Education submitted its internal control plan for disaster relief funds by the statutory deadline. The Department of Defense did not submit an internal control plan. The Departments of Agriculture, Homeland Security, and Housing and Urban Development and the Small Business Administration submitted the required internal control plans ranging from about 2 months to more than 7 months following the March 31, 2018, statutory deadline.

The Office of Management and Budget (OMB) did not have an effective strategy to ensure that agencies timely submitted internal control plans. OMB issued OMB Memorandum M-18-14 (M-18-14), Implementation of Internal Controls and Grant Expenditures for the Disaster-Related Appropriations, which contained guidance for agencies to use in developing their plans, on March 30, 2018, or 1 day before the statutory deadline for agencies to submit plans. Congress required OMB to issue standard guidance for agencies to use in designing internal control plans. The guidance was to include robust criteria for identifying and documenting incremental risks and mitigating controls related to disaster relief funding, and guidance for documenting the linkage between incremental risks related to disaster relief funding and efforts to address known internal control risks.

Selected agencies' plans did not include sufficient information for GAO to determine if the agencies met OMB directives in M-18-14 and federal internal control standards' documentation requirements. For example, two of the five plans GAO reviewed included information that demonstrated that the plans complemented the agencies’ existing risk management practices, while three plans lacked sufficient information to make such a determination. Further, M-18-14 lacked specific instructions to agencies on what to include in their internal control plans.

OMB did not have an effective outreach strategy to help ensure that agencies had proper guidance in developing and reporting their plans. OMB did not establish an external communication mechanism to ensure that internal control plans addressed key payment-integrity risks for disaster relief funds. OMB staff stated that OMB Circular No. A-123's enterprise risk management (ERM) requirements were sufficient for agencies to produce effective internal control plans, because agencies should consider disaster situations as part of their overall consideration of risk. However, while it is important that agencies develop an effective ERM process, Congress required agencies to communicate internal control plans associated with the supplemental funding provided. Federal internal control standards state that management should externally communicate necessary quality information to achieve the entity’s objectives. Without a clear OMB strategy for preparing for oversight of future disaster relief funding, there is an increased risk that agencies will not appropriately assess risks associated with disaster relief funding. As a result, Congress and others may not receive the necessary information about internal controls, which will affect Congress’s and others’ ability to provide effective oversight.

Why GAO Did This Study

Agencies must deliver disaster relief funding expeditiously. However, the risk of improper payments increases when agencies spend billions of dollars quickly. In 2017, Hurricanes Harvey, Irma, and Maria and the California wildfires created an unprecedented demand for federal disaster response and recovery resources. Congress passed three supplemental appropriations totaling over $120 billion in additional funding in response to these disasters. As part of the appropriations, Congress included an oversight framework that required federal agencies to submit internal control plans for spending these funds by March 31, 2018, in accordance with criteria to be established by OMB.

This report addresses the extent to which selected federal agencies’ internal control plans provided sufficient and timely external communication to Congress and others. To address this objective, GAO selected for review six agencies that together received $115 billion of the approximately $120 billion in supplemental appropriations for activities in response to the 2017 disasters. GAO reviewed these agencies’ internal control plans and M-18-14, evaluated the internal control plans against M-18-14 and internal control standards, and interviewed agency officials and OMB staff.