Department of Health and Human Services Office of Inspector General NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants Ann Maxwell Deputy Inspector General for Evaluation and Inspections December 2023, OEI-04-21-00160 Department of Health and Human Services Office of Inspector General Report in Brief December 2023, OEI-04-21-00160 Why OIG Did This Review NIH Did Not Consistently Meet Federal Single audits promote the efficient and effective use of Federal, extramural Single Audit Requirements for Extramural grant funding. Single audits are costly for the Federal government and time- Grants consuming for grant recipients (e.g., What OIG Found universities, States and localities, for- Key Takeaway NIH did not consistently ensure that profit Small Business Innovation NIH did not routinely meet recipients took appropriate and timely Research (SBIR) award recipients). Federal single audit corrective action on single audit Therefore, it is important that they be requirements that help ensure findings, as required by Federal effectively used to protect Federal that extramural recipients have regulation. Specifically, for over half of funds. Compliance with single audit sound financial practices and the single audits in our review, NIH did requirements is especially important internal controls. NIH's lack of not issue management decision letters for the Department of Health and oversight and routine use of (MDLs) that met the required 6-month Human Services (HHS), as HHS is the single audits, as required, could deadline to document that it had largest grant-making agency in the put grants that fund important assessed whether recipients were Federal government. Within HHS, the research at risk for taking corrective actions to address National Institutes of Health (NIH) mismanagement. single audit findings. On average, late awards a significant number of these MDLs were about 10 months beyond grants. Other Federal offices also rely the 6-month deadline. Further, NIH did not use a risk-based approach to on NIH to comply with single audit prioritize single audit findings, as encouraged by HHS policy, despite multiple requirements. Previous HHS Office of audits having factors identified by HHS policy as high-risk. Also, because NIH Inspector General (OIG) work found did not issue some MDLs within 2 years, NIH may no longer have the legal that NIH did not follow up on single authority to ensure that recipients address the corresponding audit findings, audit findings within the required 6 according to Federal regulation. months. This review revisits whether NIH is following up in a timely manner Additionally, NIH's use of single audit findings in making decisions about new and evaluates NIH's compliance with and ongoing awards during our review period was limited. NIH does have other single audit requirements. This is policies to convey that awarding officials must review audit findings when OIG's first assessment of NIH's making award decisions. However, NIH used a list of high-risk recipients that oversight and use of single audits since has not been updated since 2018 to inform these decisions. NIH's process for some responsibilities transferred from issuing alerts about vulnerabilities identified in single audit findings did not OIG to HHS's Assistant Secretary for result in any alerts for recipients in our review period, despite multiple audits Financial Resources (ASFR) in 2018. in our review having unresolved high-risk findings. How OIG Did This Review Finally, ASFR provides some data to NIH, but NIH does not track the We collected and reviewed HHS and effectiveness of single audit processes and single audits' use. However, NIH NIH policies on single audits. We also does not have processes to use ASFR's metrics or other data to track the analyzed data and relevant effectiveness of its single audit processes and single audits' use. Using such documentation (e.g., single audit data could help NIH oversee and ensure the integrity of awards it funds. reports) for all management decision letters (MDLs) between September 1, What OIG Recommends and How the Agency Responded 2020, and August 31, 2021. MDLs We recommend that NIH (1) ensure that the 6-month requirement for issuing document NIH's review of single audits MDLs for all single audits is met; (2) use risk to prioritize the issuance of MDLs; and corresponding corrective action (3) ensure that relevant single audit data are available and used by NIH staff plans. We also interviewed staff within to inform decisions about new and ongoing awards; and (4) track the NIH and ASFR due to ASFR's role in effectiveness of single audit processes and single audits' use. NIH concurred coordinating HHS's, and as such NIH's, with all four of our recommendations. single audit processes. TABLE OF CONTENTS BACKGROUND................................................................................................................................................ 1 FINDINGS ......................................................................................................................................................... 8 NIH did not consistently ensure that recipients took appropriate and timely corrective action on single audit findings, as required ........................................................................................................................................ 8 NIH's use of single audits in making decisions about new and ongoing awards during our review period was limited .................................................................................................................................................................. 11 ASFR provides some data to NIH, but NIH does not track the effectiveness of single audit processes and single audits' use ............................................................................................................................................................ 13 CONCLUSION AND RECOMMENDATIONS ........................................................................................... 14 Ensure that the 6-month requirement for issuing MDLs for all single audits is met .................................... 14 Use risk to prioritize the issuance of MDLs ................................................................................................................... 14 Ensure that relevant single audit data are available and used by NIH staff to inform decisions about new and ongoing awards .................................................................................................................................................... 15 Track the effectiveness of single audit processes and single audits' use .......................................................... 15 AGENCY COMMENTS AND OIG RESPONSE ......................................................................................... 17 APPENDIX ...................................................................................................................................................... 18 Appendix: Agency Comments ............................................................................................................................................ 18 ACKNOWLEDGMENTS AND CONTACT ................................................................................................ 24 ABOUT THE OFFICE OF INSPECTOR GENERAL.................................................................................... 25 ENDNOTES ................................................................................................................................................... 26 BACKGROUND OBJECTIVES To determine how and the extent to which the National Institutes of Health (NIH) met Federal single audit requirements by: 1. Ensuring that extramural grant recipients take appropriate and timely corrective action to resolve single audit findings; 2. Using single audit findings when making decisions about new and ongoing awards; and 3. Tracking the effectiveness of its single-audit processes and single audits' use in improving recipient accountability. Single audits promote sound financial management and internal controls, and they decrease the risk of non-Federal recipients (e.g., universities, States and localities, Small Business Innovation Research (SBIR) award recipients) mismanaging taxpayer dollars. Recipients expending $750,000 or more in Federal funds per year are required to have an independent audit (hereafter referred to as a single audit) for the year. 1 The independent auditor reviews the recipient's financial management system, including the effectiveness of internal controls. 2 When an auditor identifies a vulnerability, he or she will develop a finding, including a recommendation for an appropriate corrective action. Not all single audits have findings. Federal agencies must review and assess any corrective actions recipients take or plan to take to address any findings. 3 Generally, NIH has three main responsibilities regarding single audits. 1. NIH must ensure that recipients take appropriate and timely corrective action on single audit findings. 4 To do this, NIH receives and reviews single audit reports, as well as any corrective action plans submitted to address findings. 5 NIH is required to issue a management decision letters (MDL) to the recipient within 6 months. 6 MDLs document NIH's review and assessment of the recipient' single audit findings and proposed corrective actions. In the MDLs, NIH should convey whether the proposed corrective actions are sufficient. In cases in which the proposed corrective actions are insufficient, NIH can work with the recipient to revise the proposed corrective actions before and/or after issuing the MDL. 7 However, NIH must still issue the MDL within 6 months. HHS policy encourages- but does not require-NIH to use a risk-based approach throughout this process to focus and tailor these activities. 8 NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Background | 1 2. NIH must review recipients' current and previous single audit findings (1) prior to awarding a new or ongoing award; 9 (2) at least annually as a regular part of monitoring; and (3) at the award closeout. 10 3. NIH must track, over time, the effectiveness of its single-audit processes and single audits' use in improving recipient accountability. 11 NIH's responsibilities regarding single audits Previous HHS OIG work found that, in 2016, NIH delayed issuing MDLs beyond the required 6 months. 12 These delays put NIH at "risk of noncompliance with Federal requirements and mismanagement of Federal funds." As a result, in July 2020, NIH updated its policies to issue MDLs within the required 6 months. OIG is also issuing a related audit on NIH's oversight of foreign grant recipients' compliance with Federal audit requirements. 13 Issuing Management Decision Letters and Ensuring That Recipients Implement Corrective Actions Within NIH, the Division of Financial Advisory Services (DFAS) is responsible for receiving and reviewing single audit findings and ensuring that recipients take appropriate and timely corrective action. 14, 15, 16 As such, DFAS is responsible for issuing MDLs within 6 months. 17 According to Federal regulations, if 2 years pass from the date the recipient submits a single audit and DFAS has neither followed up with the recipient nor issued an MDL, the recipient has a valid reason to claim that the findings do not warrant further action. 18 As such, DFAS may no longer have the legal authority to ensure that the recipients address these audit findings. NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Background | 2 DFAS is also responsible for assessing risk associated with single audits. 19 See Exhibit 1 for the risk factors that HHS policies indicate DFAS should consider when conducting risk reviews of single audit findings and reports to tailor the resolution process. Further, risk can also refer to the type of funding that the recipient receives: The Small Business Innovation Research (SBIR) program is considered high-risk funding to for-profit startups and small businesses. 20 Exhibit 1: HHS-identified risk factors DFAS should consider when conducting risk reviews to tailor audit resolution activities Risk Factor Description Example Going A statement the auditor includes in the single Financial difficulties experienced by the Concern audit report which indicates aggregate larger organization have significant conditions or events that raise substantial doubt adverse impacts on the recipient, given about a recipient's ability to continue its the recipient's reliance on the larger operations. organization and the lack of available funding alternatives at reasonable interest rates. Modified An opinion in which the auditor concludes (1) The recipient failed to ensure that Opinion that on the basis of the audit evidence obtained, subrecipients complied with requirements, the financial information includes material including requirements for single audits misstatements or (2) that the auditor cannot and for processes to ensure that expenses obtain sufficient, appropriate evidence that the were allowable. The recipient also failed financial information is free from to obtain multiple bids from potential misstatements. 21 contractors. Material A deficiency, or a combination of deficiencies, in An audit found a lack of segregation of Weakness internal controls over financial reporting that duties, which represented a systemic indicate a reasonable possibility that financial problem. The recipient prepared, misstatements will not be prevented, detected, or reviewed, and approved items which did corrected in a timely way. not align with the segregation of duties. Questioned Costs that are questioned by the auditor because The recipient did not have effective Costs they (1) violate or possibly violate a statute, internal controls in place to ensure that regulation, or term or condition of the award; (2) salaries paid to employees did not exceed are not supported by adequate documentation at the salary cap limitations published by the time of the audit; or (3) appear unreasonable NIH. The auditor's sample identified and do not reflect the actions a prudent person questioned costs of approximately would take in the circumstances. $55,000. Repeat A finding from the preceding year's single audit The recipient did not maintain records Findings that repeats in the current single audit because sufficient to document procurement corrective action was not implemented or was decisions. Records must explain the not effective. The finding may also be new but method of procurement, type of contract, substantially similar to one in the previous single selection of contractor, and basis for the audit. price, but they did not. Source: OIG analysis of 2020 Assistant Secretary for Financial Resources (ASFR) and American Institute of Certified Public Accountants (AICPA) information and single audits from fiscal years ending in 2020. Prior to October 1, 2018, HHS OIG's National External Audit Review Center received the Department's single audits and assigned them to HHS Operating Divisions. 22 NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Background | 3 Part of OIG's role was to identify recipients with negative or potentially negative audit findings on the basis of its review of recipients' single audits. OIG then transmitted the results of these reviews to the appropriate Operating Division via NEAR alerts. Within NIH, staff compiled the recipients included in these alerts into a list, referred to as the "NEAR alert list." When the responsibilities to receive and assign HHS's single audits shifted from OIG to the Assistant Secretary for Financial Resources (ASFR) in 2018, OIG stopped transmitting NEAR alerts, and NIH stopped updating the NEAR alert list. Using Single Audit Findings When Making Award Decisions In addition to using single audit findings to retroactively protect the integrity of funds that recipients have expended, NIH may also use the findings for proactive decision making and monitoring for new and ongoing grants for those same recipients. NIH is required to review recipients' current and previous single audit reports at least annually and before awarding new or ongoing awards. 23 Recipients' current and previous single audit findings may inform NIH, for example, of the recipients' inability to safeguard Federal funds. By reviewing recipients' single audit reports prior to funding a new grant, NIH may be able to identify and mitigate potential risks these recipients may pose to pending Federal awards. 24 NIH may modify the terms and conditions of recipients' awards to help safeguard against vulnerabilities identified in single audits. NIH's Office of Extramural Research provides guidance to Institutes and Centers' (ICs') Grants Management Officers to help them determine recipients' financial capability. 25 The guidance directs ICs to look for specific concerns raised by auditors (e.g., financial concerns) when considering new awards. Additionally, NIH's Office of Policy for Extramural Research Administration (OPERA), within the Office of Extramural Research, sends out alerts to ICs for various oversight reasons to help inform award decisions and oversight. These alerts can be based on vulnerabilities identified in single audit findings. NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Background | 4 Tracking the Effectiveness of Single Audit Processes and Single Audits' Use Federal regulations require NIH to develop a baseline, metrics, and targets to track, over time, the effectiveness of its processes to follow up on single audit findings and on the use of single audits in improving recipient accountability and their use in making award decisions. 26 According to HHS, one way NIH could do this is by identifying trends in single audit findings across recipients and/or grant programs and addressing those trends. 27 Doing so could not only identify problems with recipients' operations, but also could identify deficiencies in NIH's own operations and policies. For example, if NIH identifies a trend in single audit findings related to a certain grant program, it could indicate that NIH is not clearly communicating the requirements to or appropriately overseeing recipients of that grant. As a result, NIH could develop guidance to help the recipients of that program comply. To improve the effectiveness of single audits, HHS and other awarding agencies are responsible for providing the Office of Management and Budget (OMB) with updates to the Federal guidelines for single audits (these updates are hereinafter referred to as the Compliance Supplement). 28 Specifically, NIH has subject matter expertise regarding the Research and Development (R&D) cluster of program requirements in the Compliance Supplement. NIH's feedback to OMB helps focus future single audits on issues most likely to threaten the integrity of R&D awards. OMB updates the Compliance Supplement each year on the basis of feedback from Federal agencies, including HHS. 29, 30 Methodology We analyzed multiple data sources to describe NIH's oversight and use of single audits during our review period (i.e., September 1, 2020, to August 31, 2021). To determine the extent to which NIH ensures that recipients take appropriate and timely corrective action to resolve single audit findings, we reviewed HHS, NIH, and recipient documents (e.g., policies, single audit report packages), and we conducted interviews with DFAS staff. We reviewed documentation and policies to help guide our data analysis, and we performed interviews to contextualize the results of our analysis. We also reviewed the data associated with single audits during our review period. We analyzed data for non-profit, domestic versus for-profit or foreign recipients separately because the requirements differ for them: • Federal governmentwide regulations for single audits apply only to non- Federal, domestic recipients, such as State and local governments; institutions of higher education; or non-profit organizations (hereafter referred to as non- profit recipients). The threshold for conducting these audits applies to each NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Background | 5 non-profit, domestic recipient's Federal expenditures for the year, combined across all Federal agencies. 31 • HHS has developed additional requirements for for-profit or foreign recipients. HHS requires for-profit or foreign recipients to conduct single audits if the recipients expend $750,000 or more in HHS funds in a year.32 NIH data are compiled separately for non-profit, domestic versus for-profit or foreign single audits because NIH receives single audit packages differently for each. • Non-profit, domestic recipients submit single audit reports into the Federal Audit Clearinghouse and fill out a standardized data collection form. The data collection form prompts recipients to enter certain data variables, which can be tracked across audits and analyzed by funding agencies. Audit data from the Federal Audit Clearinghouse are then automatically routed and uploaded into HHS's Audit Tracking and Analysis System, which NIH uses to track the resolution of findings for which it is responsible. • In contrast, for-profit or foreign recipients send their single audit reports directly to ASFR. 33 ASFR manually reviews the audits and assigns relevant findings to NIH via email. NIH then manually compiles the data associated with for-profit or foreign audits in a spreadsheet for tracking purposes. Of the recipients in our population, only one-a Canadian university-was foreign. All other recipients in our population were either non-profit (and domestic) or for- profit. Hereafter, we refer to these two groups as either non-profit or for-profit. We indicate in our findings when the single foreign entity is included in our results. We also conducted quality assurance on a sample of data for both non-profit and for- profit recipients separately by comparing the data we received from NIH to the single audit reports and other documentation (e.g., MDLs) we also received. We identified some initial errors in the for-profit data, so we reviewed the audits of all for-profit recipients to ensure that we captured all risk factors associated with each audit in our analysis. After conducting this additional quality assurance, we determined that the data were sufficient to use in our analyses. In our findings, we describe the risk factors that were originally missing from the NIH data. To determine the extent to which NIH uses audit findings when making award decisions and the extent to which NIH tracks effectiveness, we reviewed HHS, NIH, and recipient documents (e.g., policies, single audit report packages) and conducted interviews with DFAS, OPERA, and ASFR staff. We reviewed documentation and policies to help inform our interview questions. Limitations We did not independently verify that the population of MDLs provided by ASFR and NIH was complete. NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Background | 6 Standards We conducted this study in accordance with the Quality Standards for Inspection and Evaluation issued by the Council of the Inspectors General on Integrity and Efficiency. NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Background | 7 FINDINGS NIH did not consistently ensure that recipients took appropriate and timely corrective action on single audit findings, as required NIH did not issue MDLs within the required 6 months for over half of the MDLs in our review. These delays put NIH in noncompliance with Federal requirements and put recipients at risk of mismanaging Federal funds. Due to delays in issuing some MDLs, NIH may no longer have the legal authority to ensure that some recipients address audit findings. NIH also did not prioritize its activities on the basis of risk, in contrast to HHS policy recommendations. NIH reported that it issues MDLs in the order in which it receives the single audits rather than by risk. For over half of the audits in our review, NIH did not issue management decision letters within the required 6 months Across all recipients (non-profit and for-profit) in our review, NIH did not issue MDLs within the required 6 months for over half of the audits. On average, the late MDLs were 313 days (about 10 months) beyond the 6-month deadline at the time of our analysis. MDLs were more often late for for-profit recipients: • Seventy-four percent (40 out of 54) of MDLs for single audits of for-profit recipients were late. At the time of our analysis, DFAS had not issued MDLs for 23 of the 40 single audits. The 40 late MDLs ranged from 21 to 678 days late and were, on average, over a year (368 days) late. 34 • In contrast, 33 percent (11 out of 33) of MDLs for single audits of non-profit recipients were late. At the time of our analysis, DFAS had issued all 11 of the late MDLs (i.e., none were pending). These 11 late MDLs ranged from 4 days to 247 days late, with an average of less than 4 months (112 days) late. NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Findings | 8 Exhibit 2: NIH did not meet Federal timelines for issuing MDLs for more single audits of for-profit recipients than for non-profit recipients. Source: OIG analysis of audits with MDLs due from NIH between September 1, 2020, and August 31, 2021. These data indicate that NIH does not consistently follow its updated policy to issue MDLs timely. This policy was put into place to implement OIG's previous recommendation to issue MDLs within the required 6 months. 35 NIH's system for tracking MDLs of for-profit recipients may contribute to MDL delays due to the manual nature of the process. NIH manually updates a spreadsheet to track audits of for-profit recipients to whom it needs to issue an MDL. As a result of our data request in July 2022, DFAS identified two single audits of for-profit recipients that it was responsible for resolving but had not previously included in its spreadsheet. DFAS stated that the spreadsheet was missing these two audits due to human error and the challenges posed by manually tracking single audits of for-profit recipients. DFAS began tracking these two single audits as a result of our July 2022 data request. These MDLs were eventually issued 815 days and 563 days beyond the 6-month deadline. DFAS does not use risk to prioritize its review, in contrast to HHS recommendations DFAS reported that it issues MDLs in the order in which it receives the single audits rather than by risk. Of the single audits with at least one risk factor, over half had late MDLs (27 of 48). 36 Exhibit 3 provides examples of some of the high-risk findings associated with late MDLs in our review. Further, nearly all (37 of 40) of the late MDLs of for-profit recipients were for recipients of SBIR funding, which is also considered high-risk. 37 NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Findings | 9 Exhibit 3: Examples of high-risk single audit findings of recipients with late MDLs Source: OIG analysis of audits with MDLs due from NIH between September 1, 2020, and August 31, 2021. Further, DFAS is not accurately capturing all of the risk factors that could assist with prioritization by risk. The manually updated NIH spreadsheet that tracks audits of for- profit recipients did not capture all of the risk factors associated with each single audit in our review. 38 Specifically, we identified, through our review of single audit findings, the following risk factors that were not documented in the tracking spreadsheet: • 5 material weaknesses, • 10 questioned costs, and • 10 repeat findings. NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Findings | 10 NIH's delays in issuing management decision letters may jeopardize its ability to ensure that some recipients address audit findings During our review, we identified nine single audits for which the 2-year review period had already expired or that were approaching the end of the 2-year review period. For these nine single audits, NIH had neither issued an MDL nor conducted other followup with the recipient. As a result, some of these recipients have a valid reason to claim that the single audit findings no longer warrant further action. In these cases, NIH may have missed the opportunity to ensure that these recipients' financial practices have appropriate internal controls to protect taxpayer dollars from mismanagement. Specifically, we identified five single audits of for-profit recipients for which the 2-year period had already expired. Of these five single audits, three had HHS-identified risk factors, including material weaknesses and a questioned cost. For the remaining four single audits, NIH was approaching the 2-year deadline and had neither issued an MDL nor conducted other followup. Three of these four audits were 5 to 7 days prior to the 2-year deadline, and the fourth audit was 4 months prior to the 2-year deadline. Three of these audits had HHS-identified risk factors, including a qualified opinion, material weaknesses, and repeat findings. We notified NIH about these single audits, and NIH confirmed that it had not previously followed up with these recipients. After receiving the notification from us, NIH followed up with these recipients before the 2-year deadline passed. NIH's use of single audits in making decisions about new and ongoing awards during our review period was limited NIH's use of single audit findings to proactively inform decision making and monitoring of new and ongoing awards during our review period was limited. NIH policies convey to ICs that audit findings must be used in making award decisions, and NIH reported that ICs follow these policies. However, information about audit findings was not readily available and ICs did not modify any award terms and conditions for new or ongoing awards as a result of single audit findings during our review period. NIH stated that ICs still used the outdated NEAR alert list to inform award decisions; this list has not been updated since 2018. NIH reported that it is in the process of finalizing a tool that will replace the NEAR alert list. The new tool will be updated at least monthly. NIH also reported that OPERA issues alerts, which can be based on vulnerabilities related to single audit findings, help inform ICs' award decisions. However, NIH did not issue any OPERA alerts for awardees in our review.39 This is despite multiple NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Findings | 11 single audits in our review identifying HHS-identified risk factors that pose continued financial or management vulnerabilities. 40 The processes that grant officials must follow to obtain single audit information pertinent to new or ongoing awards is also limited and inefficient. NIH instructs grant officials to check the publicly available Federal Audit Clearinghouse or obtain the most recent single audit directly from the recipient. 41 However, neither the Federal Audit Clearinghouse nor the single audits themselves reflect the current status of any findings (i.e., resolved or unresolved). Therefore, neither of these steps would allow a grant official to determine whether an MDL has been issued or whether a recipient has taken sufficient corrective action to address the findings. NIH grant officials do not have direct access to HHS's Audit Tracking and Analysis System. Therefore, to obtain this information, grant officials must coordinate with DFAS to determine the current status of any findings related to HHS awards via HHS's Audit Tracking and Analysis System. HHS's Audit Tracking and Analysis System, as is indicated in its name, only contains information about HHS awards. There is no governmentwide system for tracking the resolution status of single audit findings. Instead, ASFR reported that it has the responsibility for determining the status of single audit findings assigned to other Federal agencies (e.g., to determine if MDLs were issued). However, ASFR acknowledged that it does not conduct this outreach to other Federal agencies. The limited use of single audit findings in making new and ongoing award decisions could put awards that fund important research at risk of mismanagement. Three recipients received new or ongoing funding from NIH that totaled over $14 million while the recipients' MDLs were late and pending, meaning that NIH had not documented that the recipients were taking appropriate and timely action to address single-audit findings. These three recipients were for-profit recipients who received high-risk SBIR awards, and the single audits in our review for two of these recipients contained HHS-identified risk factors. Further, the three recipients were among those for which the 2-year period was approaching without an MDL or other followup from NIH. NIH reported that it was in the process of moving its guidance for staff to review and mitigate risks for single audits to a standalone document specific to the review of annual audits. NIH believes that moving this guidance will ensure that grant officials access and use information about the status of single audit findings when making award decisions and providing ongoing oversight. However, NIH did not describe how it would verify that staff are following the guidance when making award decisions. NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Findings | 12 ASFR provides some data to NIH, but NIH does not track the effectiveness of single audit processes and single audits' use As a part of its coordinating role for HHS, ASFR reported in June 2023 that it recently finalized and implemented nine single-audit metrics. These metrics would, among other things, allow NIH to assess the timeliness of issuing MDLs, particularly for high- priority findings. ASFR analyzes the data across various timeframes and by HHS Operating and Staffing Division. ASFR reported that it shares the analysis with each HHS Operating and Staffing Division, including NIH, at several points throughout the year. ASFR also reported that it will consider adding additional metrics in Fiscal Year 2024. Some of ASFR's data establish targets, but the targets do not conform with Federal regulation. Specifically, ASFR identifies a 50-percent target for MDLs issued within 6 months. In contrast, Federal regulation requires that all MDLs be issued within 6 months. Additionally, ASFR's data do not include certain information that could be valuable to NIH in tracking the effectiveness of single audit processes and single audits' use. ASFR does not include data that would help NIH identify trends in single audit findings across recipients. According to HHS, identifying and addressing these trends is one way NIH could identify deficiencies in NIH's own operations and policies. ASFR also does not analyze the data separately for non-profit versus for-profit (including foreign) recipients. Finally, ASFR does not track how long MDLs are overdue to determine whether they are nearing the end of the 2-year review period. Considering the limitations in ASFR's data, NIH also does not have its own procedures for collecting, reviewing, and taking action on relevant information. This information could include whether grant officials are using single audit findings to inform decisions about new or ongoing awards. NIH could, for example, track how often safeguards (e.g., modified terms and conditions) are implemented as a result of single audit findings, and whether these safeguards are associated with a subsequent reduction in single audit findings across those awardees. Doing so would help NIH ensure the integrity of awards it funds to recipients with HHS-identified risk factors. If NIH collected and analyzed this information, it could also improve the information it shares with HHS and, in turn, with OMB for the Compliance Supplement, which helps focus future single audits on the issues most likely to threaten the integrity of R&D awards, such as those that NIH funds. NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Findings | 13 CONCLUSION AND RECOMMENDATIONS Single audits are an important tool to help protect Federal funds from mismanagement. However, NIH did not consistently meet Federal requirements to (1) ensure that extramural recipients take appropriate and timely corrective action on single audit findings; (2) use single audit findings in making decisions about new and ongoing awards; and (3) track the effectiveness of its single audit processes and single audits' use. These findings, paired with OIG's other work in this area, demonstrate concerning vulnerabilities in NIH's oversight and use of single audits to help protect important research, both foreign and domestic, from mismanagement. Single audits can address recipients' financial mismanagement practices (e.g., unallowable costs) that take funding away from the research itself. Such research helps advance the treatment, management, and cure of serious diseases, such as cancer. Mismanagement of this type of research could impair or delay important medical advances. We offer the following recommendations to NIH to help ensure its compliance with Federal single-audit requirements intended to prevent mismanagement of Federal funds: Ensure that the 6-month requirement for issuing MDLs for all single audits is met NIH should ensure that it is complying with the 6-month Federal requirement for issuing MDLs. Compliance with this requirement helps NIH ensure that recipients are taking appropriate and timely corrective actions on single audit findings. To avoid delays in MDLs of for-profit (including foreign) recipients, in particular, NIH should take additional quality assurance steps to ensure that its manual updates to its tracking spreadsheet include all audits for these recipients. Use risk to prioritize the issuance of MDLs As encouraged by HHS policy, NIH should implement a process for prioritizing MDLs for findings that pose a greater risk to Federal programs and funds. This includes single audits with HHS-identified risk factors and single audits of recipients receiving funding from high-risk programs (e.g., SBIR). To ensure that NIH is appropriately prioritizing risk, it needs to ensure that it is identifying and capturing all of the HHS- identified risk factors associated with an audit. This includes ensuring that its tracking spreadsheet for audits of for-profit (including foreign) recipients contains all risk factors. Then, NIH should use the risk factors in prioritizing its work so the most high- NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Conclusion and Recommendations | 14 risk recipients and findings are addressed as soon as possible within the required 6- month period. Ensure that relevant single audit data are available and used by NIH staff to inform decisions about new and ongoing awards NIH should ensure that it is using available information on single audits to inform decisions for new and ongoing awards as efficiently as possible. NIH should finalize the tool to replace the NEAR alert list and monitor if and how staff use the tool. Until NIH implements a tool to replace the NEAR alert list, NIH should ensure that its system for issuing OPERA alerts consistently incorporates and communicates information about single audits containing HHS-identified risk factors. NIH should also move its guidance for staff to review and mitigate risks identified in single audits to the standalone document specific to the review of annual audits, as planned. Then, NIH should verify that staff are following the guidance, such as by tracking whether safeguards (e.g., modified terms and conditions) are implemented to address high-risk single audit findings. In addition, NIH should ensure that its grant officials efficiently access and use information about the status of single audit findings assigned to HHS and other Federal agencies when making award decisions. Until a governmentwide database containing this information exists, NIH could work with ASFR to ensure that HHS's systems are current and complete regarding the status of all Federal agencies' findings and, to the extent appropriate, shared with HHS grants officials and with other Federal agencies for use in making decisions about new and ongoing awards. Track the effectiveness of single audit processes and single audits' use NIH should ensure that it is complying with Federal requirements to track the effectiveness of its single audit processes and single audits' use. As such, NIH should work with ASFR to: • Ensure that current metrics and targets conform with Federal regulations; • Establish metrics to track how long MDLs are overdue and whether any are nearing the end of the 2-year review period; • Collect and analyze data separately for non-profit, domestic versus for-profit or foreign recipients; and • Identify trends in single audit findings across recipients. If ASFR chooses not to collect and analyze this data, NIH should collect and analyze it. NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Conclusion and Recommendations | 15 Finally, NIH should use these data to monitor its processes and use of single audits and make improvements, as necessary, to ensure that they are as effective as possible. For example, NIH could track how often safeguards, such as modifying terms and conditions, are used as a result of single audit findings, and whether these safeguards are associated with a subsequent reduction in single audit findings across those awardees. If terms and conditions are not updated for unresolved high-risk single audit findings before new or ongoing awards are funded to the recipients, NIH could further improve its guidance and consider offering training to IC grant officials to ensure that they understand expectations on how they should use single audit findings when making award decisions. NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Conclusion and Recommendations | 16 AGENCY COMMENTS AND OIG RESPONSE NIH concurred with all four of OIG's recommendations. In response to our first recommendation, NIH stated that it will ensure that the 6- month requirement for issuing MDLs for all single audits is met. NIH will also ensure that its tracking spreadsheet includes all single audits for recipients with findings assigned to NIH. In response to our second recommendation, NIH noted that it will add fields in its tracking spreadsheet to capture all risk factors associated with single audits. NIH will use those risk factors to prioritize its resolution of the highest-risk findings as soon as possible within the required 6-month period. In response to our third recommendation, NIH stated that it recently released a new tool in eRA that replaces the NEAR alert list. NIH added that OPERA will manually provide monthly updates and that NIH will consider automating this information at a later time. Additionally, NIH plans to transition to a standalone compliance document for staff to review and mitigate risks identified in single audits. In response to our fourth recommendation, NIH provided an update on the new reports ASFR provides to NIH. ASFR will now provide seven new reports, including information on metrics for foreign and for-profit single audits; the timeliness of unresolved audit findings; and risk factors, among other things. OIG believes NIH's planned actions will implement these recommendations and improve NIH's oversight and use of single audits. For the full text of NIH's comments, see the Appendix. NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Agency Comments and OIG Response | 17 APPENDIX Appendix: Agency Comments Following this page are the official comments from NIH. NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Appendix | 18 NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Appendix | 19 NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Appendix | 20 NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Appendix | 21 NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Appendix | 22 NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Appendix | 23 ACKNOWLEDGMENTS AND CONTACT Acknowledgments Margaret Dore served as the team leader for this study. Others in the Office of Evaluation and Inspections who conducted the study include Lucio Verani, Rebekah Schwartz, Victoria Coxon, and Brianna Weldon. Office of Evaluation and Inspections headquarters staff who provided support include Joe Chiarenzelli, Robert Gibbons, and Sara Swisher. This report was prepared under the direction of Dwayne Grant, Regional Inspector General for Evaluation and Inspections in the Atlanta regional office, and Jaime Stewart, Assistant Regional Inspector General. Contact To obtain additional information concerning this report, contact the Office of Public Affairs at Public.Affairs@oig.hhs.gov. OIG reports and other information can be found on the OIG website at oig.hhs.gov. Office of Inspector General U.S. Department of Health and Human Services 330 Independence Avenue, SW Washington, DC 20201 NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Acknowledgments and Contact | 24 ABOUT THE OFFICE OF INSPECTOR GENERAL Office of Inspector General https://oig.hhs.gov The mission of the Office of Inspector General (OIG) is to provide objective oversight to promote the economy, efficiency, effectiveness, and integrity of the Department of Health and Human Services (HHS) programs, as well as the health and welfare of the people they serve. Established by Public Law No. 95-452, as amended, OIG carries out its mission through audits, investigations, and evaluations conducted by the following operating components: The Office of Audit Services. OAS provides auditing services for HHS, either by conducting audits with its own audit resources or by overseeing audit work done by others. The audits examine the performance of HHS programs, funding recipients, and contractors in carrying out their respective responsibilities and provide independent assessments of HHS programs and operations to reduce waste, abuse, and mismanagement. The Office of Evaluation and Inspections. OEI's national evaluations provide HHS, Congress, and the public with timely, useful, and reliable information on significant issues. To promote impact, OEI reports also provide practical recommendations for improving program operations. The Office of Investigations. OI's criminal, civil, and administrative investigations of fraud and misconduct related to HHS programs and operations often lead to criminal convictions, administrative sanctions, and civil monetary penalties. OI's nationwide network of investigators collaborates with the Department of Justice and other Federal, State, and local law enforcement authorities. OI works with public health entities to minimize adverse patient impacts following enforcement operations. OI also provides security and protection for the Secretary and other senior HHS officials. The Office of Counsel to the Inspector General. OCIG provides legal advice to OIG on HHS programs and OIG's internal operations. The law office also imposes exclusions and civil monetary penalties, monitors Corporate Integrity Agreements, and represents HHS's interests in False Claims Act cases. In addition, OCIG publishes advisory opinions, compliance program guidance documents, fraud alerts, and other resources regarding compliance considerations, the anti-kickback statute, and other OIG enforcement authorities. NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 About OIG | 25 ENDNOTES 1 Recipients may conduct several types of audits. Many recipients choose to conduct single audits to meet the annual audit requirement. Alternatively, a recipient may perform a program-specific audit if it receives permission and only receives Federal funding in one program area. We use the term "single audits" to encompass both single and program-specific audits. 2 45 CFR § 75.507 and 45 CFR § 75.514. 3 Corrective action plans outline how the recipient will address each single audit finding included in the current year audit reports. The corrective action plan must provide the name(s) of the contact person(s) responsible for the corrective action, the corrective action planned, and the anticipated completion date. If the recipient does not agree with the single audit findings or believes corrective action is not required, then the corrective action plan must include an explanation and specific reasons. HHS Single Audit Resolution Standard Operating Procedure (v1.2), September 2019. 45 CFR § 75.511(c). 4 45 CFR § 75.513(c)(3). 5 45 CFR § 75.513(c)(3). 6 45 CFR § 75.521(d). 7 HHS Single Audit Resolution Standard Operating Procedure (v1.2), Review of the Recipient's Response, pages 7-8, September 2019. 8HHS Single Audit Resolution Standard Operating Procedure (v1.2), Initial Step in Audit Resolution Review, page 6, September 2019. 9 Our use of the term "new" includes both continuing awards and supplemental awards. A continuing award is the granting of a request for funding to renew, by one or more budget periods, a project that would otherwise expire. A supplemental award is the granting of a request for additional funds beyond those currently awarded, including those for a low-cost extension. HHS, HHS Grants Policy Administration Manual, Part I. Audits b.(17), December 2015. The Grants Policy Administration Manual establishes HHS policies for the administration of grants and cooperative agreements and reflects the departmental policies that result from the implementing regulations at 45 CFR part 75. 10 HHS Grants Policy Administration Manual, Part I. Audits b.(17), December 2015. 11 45 CFR § 75.513(c)(3)(iv). 12The National Institutes of Health Submitted OIG Clearance Documents for Just Over One-Half of Its Audit Recommendations, and the Remaining 225 Recommendations Were Unresolved as of September 30, 2016 (A-07-19-03236) January 21, 2020. 13HHS OIG, W-00-21-59457, ongoing. Accessed at https://oig.hhs.gov/reports-and-publications/workplan/summary/wp- summary-0000580.asp on May 9, 2023. 14 45 CFR § 75.513(c)(3). 15 NIH is responsible for overseeing the resolution process when the single audit findings relate to awards funded by NIH, even if HHS is not the cognizant agency for audit. The cognizant agency for audit is the Federal agency designated to carry out the responsibilities described in OMB's Uniform Guidance in the event that the recipient expends more than $50 million of Federal awards in a fiscal year. The cognizant agency for audit must be the Federal awarding agency that provides the most direct funding to a non-Federal recipient unless OMB designates a specific cognizant agency for audit. The oversight agency for audit is the Federal awarding agency that provides the most direct funding to a recipient that is not assigned a cognizant agency for audit. When there is no direct funding, the Federal agency with the most indirect funding is to assume the oversight responsibilities. 2 CFR § 200.513(a)(1) and 45 CFR § 75.513(a)(1). 16 DFAS is within NIH's Office of Acquisition Management Policy. 17 45 CFR § 75.521(d). NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Endnotes | 26 18 45 CFR § 75.511(b)(3). 19HHS policy states that staff should conduct risk reviews of the single audit findings and reports to focus and tailor their audit resolution activities. HHS Single Audit Resolution Standard Operating Procedure (v1.2), page 6, September 2019. 20Program Basics – What Is the Purpose of the SBIR and STTR Programs? Accessed at https://www.sbir.gov/tutorials/program- basics/tutorial-1 on March 23, 2023. 21 A modified opinion can be a qualified opinion (when financial information may contain misstatements that are limited in scope), an adverse opinion (when audit evidence indicates that financial records may contain pervasive material misstatements), or a disclaimer of opinion (when the auditor is unable to form an opinion due to the absence of financial records or insufficient cooperation from the recipient's management). AICPA, AU-C Section 705 Modifications to the Opinion in the Independent Auditor's Report. Accessed at https://www.aicpa.org/Research/Standards/AuditAttest/ DownloadableDocuments/AU-C-00705.pdf on September 9, 2021. 22 The National External Audit Review Center is now called the Single Audit Division. 23 HHS Grants Policy Administration Manual, Part I. Audits b.(17), December 2015. 24 NIH's Office of Extramural Research, Pre-award Financial Capability Review Compliance Guidance, August 25, 2020. 25NIH is composed of 27 Institutes and Centers, each with a specific research concentration, often focusing on certain body systems or types of disease. NIH, Institutes at NIH. Accessed at https://www.nih.gov/institutes-nih on March 20, 2023. 2645 CFR § 75.513(c)(3)(iv). The HHS awarding agency must "develop a baseline, metrics, and targets to track, over time, the effectiveness of the Federal agency's process to follow-up on audit findings and on the effectiveness of Single Audits in improving non-Federal entity accountability and their use by HHS awarding agencies in making award decisions." 27 HHS Single Audit Resolution Standard Operating Procedure (v1.2), Audit Metrics, pages 16-17, September 2019. 2845 CFR § 75.513(c)(4). The Compliance Supplement reflects the areas of compliance that OMB identifies as the areas for auditors to focus on during the review period. The Compliance Supplement focuses the auditor to test the compliance requirements most likely to cause improper payments, fraud, waste, or abuse, or generate audit findings for which the Federal awarding agency will take sanctions. In establishing the Compliance Supplement each year, OMB uses input from HHS and other agencies. 29Starting in 2019 and continuing in 2021, the Compliance Supplement reduced the areas for compliance reviews from a maximum of 12 to a maximum of 6. This reduction focused the agencies and the auditors on the areas that are most important for federal awarding agencies to manage programs more efficiently, moving from a focus on compliance to one on performance. 30Office of Management and Budget, 2021 Compliance Supplement, July 2021. Accessed at https://www.whitehouse.gov/wp- content/uploads/2021/08/OM.B-2021-Compliance-Supplement_Final_V2.pdf on March 23, 2023. 31 45 CFR § 75.501(a). 3245 CFR § 75.501(i-j)- Audit Requirements. 45 CFR § 74.26. For-profit recipients that expend $750,000 or more in HHS awards per year are subject to audit requirements [45 CFR § 75.501(j)]. 33ASFR's Office of Program Audit Coordination serves as the central point of contact for coordinating audit resolution and followup activities across HHS. 81 FR 88249, p. 88251. ASFR's Audit Resolution Division (ARD) is a subcomponent within the Office of Program Audit Coordination. ARD reviews all audit-related documentation, determines if there are findings in the current report, and assigns them to the responsible HHS agency. ARD then sends the material to the responsible HHS agency to complete the audit resolution process. 34 The MDL for the foreign recipient in our review was 77 days late. 35 The National Institutes of Health Submitted OIG Clearance Documents for Just Over One-Half of Its Audit Recommendations, and the Remaining 225 Recommendations Were Unresolved as of September 30, 2016 (A-07-19-03236) January 21, 2020. NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Endnotes | 27 36 One of these 27 single audits was for the foreign recipient in our review, which had a late MDL. The single audit contained a questioned cost. 37 One of the three remaining MDLs was for the foreign recipient that did not receive SBIR funding. 38 To conduct this analysis, we used the HHS-identified risk factors outlined in Exhibit 1. 39NIH did provide examples of two recipients with OPERA alerts, but neither of these recipients was in our review. These alerts required ICs to request DFAS to conduct a financial capability review prior to funding any awards to these recipients in a fiscal year. 40Twenty-nine audits of for-profit recipients had at least one HHS-identified risk factor. Nineteen audits of non-profit recipients had at least one HHS-identified risk factor. 41 The Federal Audit Clearinghouse, the main NIH source for information about single audit findings assigned to other Federal agencies, is transitioning to the General Services Administration (GSA) in October 2023, and ASFR reported that this transition will also shut down HHS's Audit Tracking and Analysis System. ASFR reported that HHS's Audit Tracking and Analysis System will be replaced with a new case management system but did not provide details on the new system. NIH Did Not Consistently Meet Federal Single Audit Requirements for Extramural Grants OEI-04-21-00160 Endnotes | 28