Department of Homeland Security 

Office of Inspector General 

Internal Controls in the 


FEMA Disaster Acquisition Process 


OIG-09-32 February 2009 
 

 Office of Inspector General 

U.S. Department of Homeland Security

 Washington, DC 25028 

February 19, 2009 

Preface 

The Department of Homeland Security (DHS) Office of Inspector General (OIG) was 

established by the Homeland Security Act of 2002 (Public Law 107-296) by amendment to 

the Inspector General Act of 1978. This is one of a series of audit, inspection, and special 

reports prepared as part of our oversight responsibilities to promote economy, efficiency, 

and effectiveness within the department. 

This report presents the results of the audit of the Federal Emergency Management 

Agency’s internal controls governing disaster acquisitions. We contracted with the 

independent public accounting firm of Urbach Kahn & Werlin LLP (UKW) to perform the 

audit. The contract required that UKW perform its audit according to generally accepted 

government auditing standards. UKW identified six areas where internal controls could be 

strengthened. 

UKW is responsible for the attached report dated January 28, 2009, and the conclusions 

expressed in the report. 

The recommendations herein have been developed to the best knowledge available to our 

contractor and have been discussed in draft with those responsible for implementation. We 

trust that this report will result in more effective, efficient, and economical operations. We 

express our appreciation to all who contributed to the preparation of this report. 

Richard L. Skinner 


Inspector General 

 

 

 

 

 

 

January 28, 2009 

Mr. Matt Jadacki 

Deputy Inspector General for Office of Emergency Management Oversight 

Office of Inspector General 

Department of Homeland Security 

245 Murray Drive, Building 410 

Washington, DC 20528 

Dear Mr. Jadacki: 

Urbach Kahn and Werlin performed an audit of internal controls over the Federal 

Emergency Management Agency disaster acquisition process. The audit objective was to 

determine the extent that internal controls over the disaster acquisition process have 

improved since the 2005 Gulf Coast hurricanes and to identify weaknesses that remain. 

This report presents the results of the audit and includes recommendations the agency can 

implement to enhance the acquisition program’s overall success. We performed the audit 

as stipulated in Task Order TPDFIGBPA070009A-0071. 

We appreciate the opportunity to have conducted the audit. Should you have any 

questions, or if we can be of any further assistance, please call me at (571) 227-9500. 

Partner 

Sincerely, 

Roger Von Elm, CPA, CGFM 
Table of Contents/Abbreviations 


Executive Summary.........................................................................................................................1
 

Background......................................................................................................................................2
 

Results of Audit ...............................................................................................................................3
 

Improving FEMA Internal Controls ..........................................................................................3 


Recommendation .......................................................................................................................5
 

Management Comments and Contractor Analysis ....................................................................5 


Strengthening Contract Files Oversight.....................................................................................6 


Recommendations......................................................................................................................9
 

Management Comments and Contractor Analysis ....................................................................9 


Improving Performance Management of Contracting Officers.................................................9 


Recommendation .....................................................................................................................11
 

Management Comments and Contractor Analysis ..................................................................11 


Improving COTR Performance Feedback ...............................................................................11 


Recommendation .....................................................................................................................12
 

Management Comments and Contractor Analysis ..................................................................12 


Enhancing Oversight of Recommended Corrective Actions...................................................13 


Recommendation .....................................................................................................................13
 

Management Comments and Contractor Analysis ..................................................................13 


Improving Contract Closeout Timeliness ................................................................................14 


Recommendations....................................................................................................................14
 

Management Comments and Contractor Analysis ..................................................................15 


Appendices 

Appendix A: Purpose, Scope, and Methodology...................................................................16 


Appendix B: Management Comments to the Draft Report...................................................17 


Appendix C: FEMA Acquisition Management Division Organization Chart ......................18 


Appendix D: Report Distribution ..........................................................................................19 

Table of Contents/Abbreviations 


Abbreviations 

CO Contracting Officer 

COTR Contracting Officer’s Technical Representative 

DHS Department of Homeland Security 

FAR Federal Acquisition Regulation 

FEMA Federal Emergency Management Agency 

FMFIA Federal Managers’ Financial Integrity Act of 1982 

FY Fiscal Year 

GAO Government Accountability Office 

IMAT Incident Management Assistance Team 

OAM FEMA Office of Acquisition Management 

OMB Office of Management and Budget 

OIG Office of Inspector General 

UKW Urbach Kahn & Werlin LLP 
OIG
 

Department of Homeland Security 

Office of Inspector General 

Executive Summary 

Urbach Kahn & Werlin LLP audited the Federal Emergency 

Management Agency’s (FEMA) acquisition process to determine the 

extent to which internal controls have improved since the 2005 Gulf 

Coast hurricanes and to identify weaknesses that remain. FEMA has 

begun to establish a control environment over the disaster acquisition 

process. However, additional safeguards to protect assets and prevent 

and detect errors should be implemented. FEMA should: 

�	 

�	 

�	 

�	 

�	 

�	 

Establish an internal control board and assess the adequacy of its 

internal controls annually; 

Hold contracting officers accountable for their contract file 

maintenance responsibilities; 

Implement departmental policy requiring that contracting 

officers report to contracting professionals for technical 

performance elements; 

Hold contracting officer’s technical representatives accountable 

for their delegated contract management tasks in performance 

evaluations; 

Determine what audit findings and recommendations the Office 

of Acquisition Management is responsible for and ensure that 

corrective action is taken; and 

Comply with Federal Acquisition Regulation on contract close 

out, so that unused funds can be spent to address future needs. 

FEMA concurred with the recommendations and has begun to address 

some of the weaknesses identified in the report. 

Internal Controls in the FEMA Disaster Acquisition Process 

Page 1 
Background 

Federal program managers are continually seeking ways to better 

achieve agencies’ missions and program results. A key factor in 

helping achieve such outcomes is to implement appropriate internal 

controls. Internal controls comprise the plans, methods, and 

procedures that an agency uses to meet missions, goals, and 

objectives, and in doing so (1) support performance-based 

management and (2) help prevent fraud, waste, and abuse. 

Internal Controls 

An integral component of an organization’s 

management that provides reasonable assurance that 

the following objectives are being achieved: 

�

�

�

Effectiveness and efficiency of operations, 

Reliability of financial reporting, and 

Compliance with applicable laws and regulations. 

Standards for Internal Control in the Federal Government 

(GAO/AIMD-00-21.3.1, November 1999) 

Internal controls, along with monitoring controls to determine their 

effectiveness, help screen out fraud and are the most effective and 

efficient means to do so. Figure 1, below, illustrates the important 

role internal controls play in fraud prevention. 

Figure 1: Using Internal Controls to Prevent Fraud 

Source: UKW, from a U.S. Government Accountability Office figure1 

1 INDIVIDUAL DISASTER ASSISTANCE PROGRAMS: Framework for Fraud Prevention, Detection, and 

Prosecution, (GAO-06-954T, July 2006). 

Internal Controls in the FEMA Disaster Acquisition Process 

Page 2 
As programs change and agencies strive to improve operational 

processes, they must continually assess and update internal controls as 

necessary to ensure effectiveness. For example, in response to lessons 

learned from the 2005 Gulf Coast hurricanes, FEMA has: 

�	 

�	 

Restructured the Chief Procurement Office; 

Created the Office of Acquisition Management (OAM);2 

�	 

�	 

�	 

�	 

Increased the number of prepositioned contracts to support 

disaster response activities; 

Established a contracting officer’s technical representative 

(COTR) training program; 

Developed a strategy map and scorecard to guide its internal 

operations; and 

Identified initiatives for strengthening the internal controls of 

acquisition operations. 

However, much work remains to be done. FEMA has yet to 

implement hundreds of recommendations that would result in more 

effective, efficient, and economical operations.3

 Government 

internal control standards,4 which define the minimum level of 

acceptable quality for internal controls, prescribe that internal control 

monitoring should ensure that audit findings are promptly resolved. 

Results of Audit 

Improving FEMA Internal Controls 

In fiscal year (FY) 2007, FEMA could not provide reasonable assurance of 

the effectiveness of its internal controls. FEMA has yet to implement the 

Federal Managers’ Financial Integrity Act of 1982 (FMFIA) and a number 

of key corrective actions. Additionally, FEMA does not yet have formal 

processes in place to provide oversight of internal control improvements, 

2 In January 2009, OAM was renamed the Acquisition Management Division as part of a FEMA Management 


Directorate realignment. See Appendix C for updated organization chart.
 3 Status Report on Open Recommendations to DHS Components (OIG-08-27, February 2008). 
 4 Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1, November 1999). 


Internal Controls in the FEMA Disaster Acquisition Process 

Page 3 
 

including a FEMA-wide accountability structure for monitoring ongoing 

internal control activities. 

Office of Management and Budget (OMB) Circular A-123 and the statute it 

implements, FMFIA, are at the heart of federal requirements to improve 

internal controls. The circular defines 

management’s responsibility for internal 

controls and provides guidance on 

improving the accountability and 

effectiveness of operations by 

establishing, assessing, correcting, and 

reporting on internal controls. 

Management is responsible for setting 

the “Tone at the Top,” or the ethical 

atmosphere created in the workplace. 

By not implementing FMFIA and not 

taking timely corrective actions, 

FEMA’s management has not set the 

What is “TONE AT THE TOP?” 

“Tone at the Top” refers to the 

ethical atmosphere created in the 

workplace by the organization’s 

leadership. Employees pay close 

attention to the behavior and 

actions of their bosses, and they 

follow their lead. In short, 

employees will do what they 

witness their bosses doing. 

Association of Certified Fraud Examiners 

“Tone at the Top” that is critical to strong internal controls. 

FMFIA requires managers to examine internal controls annually to 

determine how well they are performing, how they may be improved, and 

the degree to which they help identify and address major risks for fraud, 

waste, abuse, and mismanagement. FEMA has not assessed internal 

controls annually, nor has it established an internal control review board to 

formally oversee internal control improvements. OMB Circular A-123 

requires agencies to integrate internal controls into their systems to direct 

and guide operations and encourages agencies to establish a senior 

management council or internal control board to address management 

accountability and related issues within the broader context of agency 

operations. 

FEMA offices, including OAM, have not performed required internal 

control reviews. The Acting Chief Financial Officer said, “We are not as far 

along as we need to be” with implementing Circular A-123. Office of the 

Chief Financial Officer officials said that key staff vacancies and the 

catastrophic nature of the 2005 hurricane season caused delays in 

implementing the circular. FEMA has written a draft internal control board 

charter, but as of September 2008, it had not approved the charter or 

established the board. 

Internal Controls in the FEMA Disaster Acquisition Process 

Page 4 
The draft internal control board charter shows the Chief Financial Officer as 

the council chair. To demonstrate management’s commitment to support a 

healthy internal control 

environment and to bring 

appropriate focus to the 

crosscutting issues affecting 

not only OAM, but also all of 

FEMA, the internal control 

board should be chaired by the 

FEMA Administrator or 

Deputy Administrator. Having 

the chair at a higher level 

would demonstrate 

management’s commitment to 

Senior Management Council Chair 

To ensure senior management 

involvement, many agencies have created 

their own senior management council, 

often chaired by the agency’s lead 

management official, to address 

management accountability and related 

issues in the broader context of agency 

operations. 

OMB Circular A-123 

a strong control system. It would also focus attention on acquisition process 

improvement initiatives that contribute to the Administrator’s inability to 

provide a positive assurance statement on FEMA internal controls. 

Recommendation: 

We recommend that the Administrator, Federal Emergency 

Management Agency 

Recommendation #1: Implement the requirements of the Federal 

Managers’ Financial Integrity Act at the office and branch level in 

FEMA and establish an internal control board chaired by either the 

FEMA Administrator or Deputy Administrator. 

Management Comments and Contractor Analysis 

FEMA concurred with the recommendation and said that it would 

provide a detailed corrective action plan in its 90-day response. We 

consider FEMA’s planned action responsive to the recommendation. 

Internal Controls in the FEMA Disaster Acquisition Process 

Page 5 
Strengthening Contract Files Oversight 

The contract file is the record 

of what the government 

bought, how they bought it, 

and how the contractor 

performed. OAM does not 

routinely monitor contracting 

officers’ (CO) compliance 

with contract file policies and 

procedures, organization and 

Effective Internal Controls 

Ensure all transactions and other significant 

events are authorized, approved, and clearly 

documented, and the documentation is readily 

available for examination. 

Standards for Internal Control in the Federal Government 

(GAO-AIMD-00-21.3.1, November 1999) 

maintenance regulations, and contract closeout requirements. FEMA could 

not locate 27% of the contract files requested for review. Many contract 

files are not organized and are missing key information. 

Federal Acquisition 

Regulation (FAR) 

Subpart 4.8 contains the 

requirements for 

establishing, maintaining, 

and disposing of contract 

files. It requires that 

contract file 

documentation be 

sufficient to constitute a 

Contract File Documentation Should – 

�	 

�	 

�	 

�	 

Provide a complete background to inform 

decisions at each step of the acquisition process 

Support actions taken 

Provide information for reviews and 

investigations 

Furnish essential facts in the event of litigation 

or congressional inquiries. 

Federal Acquisition Regulation 

complete history of the 

acquisition. FAR Subparts 4.802 and 4.803 describe types of contract files 

and examples of records that they should contain, the contract file 

organization requirements, and maintenance and closeout guidance. 

Contract files should contain items such as the following: 

�	 

�	 

�	 

�	 

�	 

Purchase request, acquisition planning, and other presolicitation 

requirements; 

Justifications and approvals; 

Evidence of the availability of funds; 

Cost/price proposals; 

Basis for the acquisition and the award; 

Internal Controls in the FEMA Disaster Acquisition Process 

Page 6 
�	 

�	 

�	 

Assignment of contract responsibilities, including payment 


responsibilities;
 

Independent government cost estimates; and 

CO’s determination of the contractor’s responsibility. 

COs could not find many of the contract files we requested. Figure 2 shows 

that COs could not locate 32 of the 120 contract files we requested (27 %). 

Headquarters’ COs could not find 16 of 24 files (67%). Regional and 

disaster field office COs could not find 16 of 96 files (17%). In some 

instances, COs did not provide files until months after they were requested, 

or COs provided files that they created to respond to our request. 

Figure 2: UKW Contract Files Requested and Received from FEMA 

0 

20 

40 

60 

80 

100 

120 

140

Number of Contract Files

Files requested 

Files received 

Files not received 

Headquarters Field Total 

Source: UKW 

OAM did not have a standardized approach to documentation and file 

maintenance. COs had access to acquisition file checklists designed for 

various contract types and situations. These checklists appeared to be in line 

with FAR requirements and showed what items to include in the contract 

file. However, COs were not required to use the checklists, and we did not 

find them in most of the files we reviewed. Basic documents were missing 

from the files, and many existing documents did not contain authorizing 

signatures. The missing or unsigned documents included contracts, COTR 

designation letters, FEMA Form 40-1 “Requisition and Commitment for 

Services and Supplies,” and FEMA Form 60-1 “Requisition for Supplies, 

Equipment and/or Services.” 

Supervisors did not hold COs accountable for maintaining complete, 

organized files, and OAM did not monitor file contents to ensure that they 

were complete and organized. The condition of contract files appeared to 

relate directly to the responsible CO’s diligence in file maintenance. 

Internal Controls in the FEMA Disaster Acquisition Process 

Page 7 
 

At one office, the CO was adamant about the files leaving “a footprint” so 

that anyone could pick up a contract file and know the history of the 

contract. This CO used the FEMA acquisition file checklist (FEMA 

Form 40-13) for every file created in the region and in the disaster response 

field office the CO supported. However, the CO and other FEMA officials 

told us the checklist had been rescinded from FEMA procedures. 

At OAM headquarters, COs found 8 of 24 contract files (33%) we 

requested. The 8 contract files were not consistent in content or structure. 

COs included an acquisition file checklist in only two files. Documentation 

was missing from most of the headquarters contract files. 

Contracting staff turnover contributed to and exacerbated file maintenance 

issues. Frequently, contract files were transferred as a result of personnel 

changes and if the file was not in order at this point, it was difficult if not 

impossible for the newly assigned CO to put the file in order. 

When contract files are disorganized and incomplete, particularly when COs 

change, the incoming CO has no way of knowing what has been done up to 

the point when the file was passed on. Also, not monitoring a CO’s 

adherence to contract file organization and maintenance requirements 

exposes FEMA to fraud, waste, and abuse. It is difficult, if not impossible, 

to establish what the contract was for, if appropriate contracting competition 

rules were followed, if the government received a fair price, and if the goods 

or services were properly delivered and paid for. 

In September 

2008, the OAM 

Director issued 

two standard 

operating 

procedures that 

address aspects 

Recent FEMA Standard Operating Procedures 

�	 

�	 

“Labeling and Organizing Official Contract File Folders” 

“Transfer of Contract Files from the Joint Field Office to 

the Appropriate Regional Office” 

FEMA Office of Acquisition Management 

of the contract files management problems. The procedures require FEMA 

COs and contract specialists to create and maintain contract file folders as 

required by the FAR, and to retain files in a central file location during 

periods of inactivity and when completed. The procedures require COs at 

disaster field offices to transfer files, which include a complete acquisition 

history, prior to leaving the field office. 

Both procedures include checklists that reference FAR requirements and 

require contracting staff to identify specific document locations. The 

checklists could serve as a mechanism to hold contracting staff accountable 

for their file management responsibilities. With modification, the 

procedures for transferring files from disaster field offices could be 

Internal Controls in the FEMA Disaster Acquisition Process 

Page 8 
expanded to include all instances when a contract file is transferred from 

one CO to another. For additional information on acquisition policies and 

procedures and acquisition workforce issues, see Challenges Facing 

FEMA’s Acquisition Workforce, OIG-09-11, November 2008. 

Recommendations: 

We recommend that the Director, Office of Acquisition 

Management: 

Recommendation #2: Require that all files transferred from one 

contracting officer to another contracting officer meet criteria 

consistent with policy included in the standard operating procedure 

on joint field office file transfer. 

Recommendation #3: Require supervisors to monitor contract file 

maintenance and hold contracting officers and contracting specialists 

accountable by including, in the annual performance evaluation 

process, an assessment of their contract file maintenance activities. 

Management Comments and Contractor Analysis 

FEMA concurred with the recommendations and said that it would provide 

a detailed corrective action plan in its 90-day response. We consider 

FEMA’s planned action responsive to the recommendations. 

Improving Performance Management of Contracting Officers 

COs who work in regions or in disaster 

operations field offices commonly 

report to and receive performance 

appraisals from supervisors who are 

not certified contracting professionals. 

This is contrary to DHS policy, and 

because the rating official is frequently 

a manager reporting to superiors who 

have program delivery responsibilities, 

it creates a potential conflict-ofinterest situation for the CO. 

GS-1102 Rating Official 

The Head of Contracting Activity 

shall ensure that all GS-1102s in 

their organizational element have a 

certified GS-1102 contracting 

professional designated as the rating 

official of record for GS-1102 

technical performance factors. 

DHS Management Directive # 0781.1 

Internal Controls in the FEMA Disaster Acquisition Process 

Page 9 
Internal control standards indicate that key duties and responsibilities need 

to be divided or segregated among different people to reduce the risk of 

error or fraud, and that transactions should be authorized and executed only 

by persons acting within the scope of their authority. DHS MD 0781.1, 

Contracting Professional 

(GS-1102) Career 

Information, requires that 

certified contracting 

professionals evaluate the 

technical performance of all 

contracting professionals. 

FEMA has not consistently 

implemented MD 0781.1 

requirements. 

Conflict of Interest 

Any relationship that is or appears to be not in 

the best interest of the organization...a conflict 

of interest would prejudice an individual's 

ability to perform his or her duties and 

responsibilities objectively. 

Institute of Internal Auditors 

OAM officials said that they provide technical assistance and guidance to 

regional and disaster response field office contracting staff, but that the 

CO’s supervisor, usually a Finance/Administration Section manager, 

evaluates the CO’s performance for all performance factors. In essence, the 

CO’s performance evaluation is provided by the “customer,” which may 

potentially affect the CO’s independence. 

In 2007, the Director of OAM discussed changing regional CO reporting 

responsibilities with regional managers. Regional managers opposed the 

change. 

One regional CO reporting to regional program managers said that although 

he had never been forced to take actions that he did not feel comfortable 

with, sometimes the bosses did not like the decisions the CO had to make 

and did not like it when he called OAM for technical assistance. 

During FY 2007, FEMA began to assemble new national and regional 

response teams, called Incident Management Assistance Teams (IMATs), to 

ensure FEMA’s capability to immediately deploy qualified and experienced 

personnel and capabilities in support of any disaster incident response. 

FEMA’s IMAT concept of operations places the teams in the FEMA 

Disaster Operations Directorate. Some teams will include a full-time CO 

with a reporting chain similar to regional and disaster field office COs. 

COs are responsible for ensuring that acquisitions take place according to 

federal contracting rules. Having a CO’s technical performance and career 

advancement controlled by the customer or a supervisor who is not a 

certified contracting professional increases the risk of fraud, waste, abuse, 

and mismanagement in the FEMA disaster acquisition process. 

Internal Controls in the FEMA Disaster Acquisition Process 

Page 10 
Recommendation: 

We recommend that the Director, Office of Acquisition 

Management: 

Recommendation #4: Implement policy in compliance with 

Department of Homeland Security Management Directive #0781.1 

and require that all contracting officers have a certified contracting 

professional as their rating official of record for technical 

performance factors. Contracting officers should report to 

headquarters Office of Acquisition Management. 

Management Comments and Contractor Analysis 

FEMA concurred with the recommendation and said that it would provide 

a detailed corrective action plan in its 90-day response. We consider 

FEMA’s planned action responsive to the recommendation. 

Improving COTR Performance Feedback 

FEMA COTRs serve an important, 

clearly defined role in the 

acquisition process. In November 

2007, the OAM Director issued 

policy that established COTR 

responsibilities and requirements. 

According to the policy, the 

program office recommends a 

COTR for the contract, and the CO 

appoints the COTR and establishes 

COTR expectations in writing. 

Common COTR Responsibilities 

�	 

�	 

�	 

�	 

�	 

Monitor contractor’s performance 

Maintain a file documenting COTR 

actions 

Communicate with contractor regarding 

performance 

Alert CO to contractor deficiencies 

Review and approve invoices 

FEMA Office of Acquisition Management Policy 

The appointment letter lists the COTR’s duties and responsibilities. 

COTRs perform their technical acquisition functions under the CO’s 

direction, but the FEMA performance management system does not hold 

them accountable for their COTR duties. COTRs frequently work for the 

program office that requested the contract and report to a program office 

supervisor. Often, the COTR function is a collateral duty, and the CO does 

not rate the COTR’s contract management performance. 

Internal Controls in the FEMA Disaster Acquisition Process 

Page 11 
Human capital permeates virtually every effort within an agency, including 

successfully acquiring goods and services, and executing and monitoring 

contracts. Human capital policies and practices, a critical factor in the 

control environment, should include a performance management system that 

provides candid and constructive feedback to help people understand their 

contributions and help the organization achieve its goals. 

With no formal process in place for the CO to provide performance 

feedback to the COTR’s supervisor, the COTR’s evaluation may not reflect 

contract technical oversight responsibilities. The COTR is not ensured 

credit for contract oversight accomplishments or counseling to address 

performance deficiencies. This could reduce the effectiveness and 

consistency of both the contracting and the evaluation process. OAM said 

that DHS has considered creating a policy to require the COTR’s supervisor 

to include the CO’s performance feedback in the COTR’s annual appraisal. 

Recommendation: 

We recommend that the Administrator, Federal Emergency 

Management Agency: 

Recommendation #5: Revise the performance management process 

so that the supervisor of record includes the contracting officer’s 

written assessment of the contracting officer’s technical 

representative’s contract management performance in the annual 

performance appraisal. The assessment should address factors listed 

in the designation letter. 

Management Comments and Contractor Analysis 

FEMA concurred with the recommendation and said it would provide a 

detailed corrective action plan in its 90-day response. We consider 

FEMA’s planned action responsive to the recommendation. 

Internal Controls in the FEMA Disaster Acquisition Process 

Page 12 
Enhancing Oversight of Recommended Corrective Actions 

FEMA and OAM do not 

effectively track audit 

findings and 

recommendations, and do not 

have an accurate report on 

the status of corrective 

actions relative to those audit 

Tracking Audit Recommendations 

Audit follow-up is an integral part of good 

management, and is a shared responsibility of 

agency management officials and auditors. 

OMB Circular A-50 Revised 

recommendations. These weaknesses exist because FEMA does not place 

sufficient emphasis on effectively tracking audit results. Consequently, 

there is increased risk of inefficient and ineffective operations, and 

management is not able to provide assurance that issues reported in audits 

are addressed. 

FEMA maintains corrective action plans in separate audit files, but does not 

have an effective automated tracking system to monitor its response to 

GAO, OIG, and other internal studies and evaluations. FEMA uses a 

“spreadsheet approach,” which relies on manual input as new audit 

recommendations are issued or changes in the status of corrective actions 

occur. 

FEMA is developing an automated tracking system. We reviewed 

information from the new system on OAM audit recommendations and 

found it to be incomplete and unreliable. OAM does not have a current or 

accurate list of audit recommendations for which it is responsible. Without 

a current, accurate inventory of open recommendations, OAM may not take 

recommended corrective actions to improve the acquisition process. 

Recommendation: 

We recommend that the Director, Office of Acquisition 

Management: 

Recommendation #6: Determine what audit findings and 

recommendations the Office of Acquisition Management is 

responsible for and ensure that corrective action is taken. 

Management Comments and Contractor Analysis 

FEMA concurred with the recommendation and said that it would provide 

a detailed corrective action plan in its 90-day response. We consider 

FEMA’s planned action responsive to the recommendation. 

Internal Controls in the FEMA Disaster Acquisition Process 

Page 13 
Improving Contract Closeout Timeliness 

As discussed in the preceding 

sections of this report, effective 

internal controls help FEMA to 

better achieve mission and 

program results, including 

compliance with applicable 

laws and regulations. Effective 

internal controls would have 

prompted COs in FEMA’s 

Effective Internal Controls 

Help ensure that management’s directives are 

carried out. Control activities should be 

effective and efficient in accomplishing the 

agency’s control objectives.

Standards for Internal Control in the Federal 

Government (GAO/AIMD-00-21.3.1, November 1999) 

regional and disaster operations field offices to adhere to the FAR and 

FEMA guidance governing contract closeouts. These COs did not close out 

contracts within the timeframes prescribed under FAR Subpart 4.804-1 and 

the FEMA Disaster Contracting Desk Guide, resulting in unliquidated 

obligations5

 of more than $5 billion that could be used for other needs. 

COs are required to start the contract closeout process when FEMA has 

received and paid for all the goods and services it purchased. However, 

OAM did not monitor contract closeouts or hold COs accountable. Further, 

missing and incomplete contract files make it difficult to close contracts in a 

timely manner. 

OAM officials agreed that the issue of closing contracts and deobligating 

unused funds was serious, and they have begun to address it. FEMA has 

hired a contractor to assist in closing contracts whose performance periods 

have ended. OAM officials told us that they have deobligated $76 million 

since the contractor began work in 2007. Although this is a sizeable 

amount, given over $5 billion in unliquidated obligations, much work 

remains. 

Recommendations: 

We recommend that the Director, Office of Acquisition 

Management: 

Recommendation #7: Require each contracting officer to close out 

contract files according to timeframes in the Federal Acquisition 

Regulation and FEMA policy. 

5

 An obligation occurs when FEMA signs a contract; an unliquidated obligation is the amount of a financial 

obligation not yet expended (Source: U.S. Department of Agriculture, Departmental Regulation 2230-001, 

Reviews of Unliquidated Obligations, August 22, 2006). 

Internal Controls in the FEMA Disaster Acquisition Process 

Page 14 
Recommendation #8: Accelerate closeout of eligible contracts so 

that funds are more quickly made available for future use. 

Management Comments and Contractor Analysis 

FEMA concurred with the recommendations and said that it would provide 

a detailed corrective action plan in its 90-day response. With regard to 

recommendation #7, FEMA said that either the Management Directorate’s 

Acquisition Management Division personnel, or contractor support, will 

close out contract files. With regard to recommendation #8, FEMA said 

that the Acquisition Management Division is working with the Office of 

the Chief Financial Officer to address the close-out of eligible contracts. 

We consider FEMA’s current and planned actions responsive to the 

recommendations. 

Internal Controls in the FEMA Disaster Acquisition Process 

Page 15 
Appendix A 

Purpose, Scope, and Methodology 

DHS OIG contracted with UKW to audit internal controls over the 

FEMA acquisition process. The audit objective was to determine 

the extent to which internal controls have improved since the 2005 

Gulf Coast hurricanes and to identify weaknesses that remain. 

We conducted this performance audit according to generally 

accepted government auditing standards (Government Auditing 

Standards, July 2007 revision). Those standards require that we 

plan and perform the audit to obtain sufficient, appropriate 

evidence to provide a reasonable basis for our findings and 

conclusions based on our audit objectives. We believe that the 

evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives. 

The audit focused on acquisitions from October 2006 through 

July 2008. We reviewed FEMA and OAM records and a 

judgmental sample of contract files selected at headquarters and 

field offices. We performed work at FEMA headquarters in 

Washington, DC; at the Brentwood, Tennessee Joint Field Office; 

the Atlanta, Georgia and Kansas City, Missouri Regional Offices; 

and the New Orleans and Baton Rouge, Louisiana Transitional 

Recovery Offices. We held discussions with FEMA officials 

throughout the audit and discussed audit results with FEMA 

officials on November 5, 2008. 

To establish criteria for this audit, we researched U.S. laws and 

regulations; DHS directives; FEMA policies and guidance; and 

OMB, GAO, and Office of Federal Procurement Policy (OFPP) 

requirements and guidelines applicable to internal control and to 

acquisition activities. We reviewed assessments of the FEMA 

acquisition process prepared by FEMA contractors and prior 

reports and congressional testimony by FEMA, DHS OIG, and 

GAO to identify their findings and recommendations related to 

FEMA’s acquisition process. We reviewed information, including 

contract file checklists, contained on the Virtual Acquisition 

Office, an acquisition knowledge management subscription service 

that is available to OAM staff. 

Internal Controls in the FEMA Disaster Acquisition Process 

Page 16 
Appendix B 

Management Comments to the Draft Report 

Internal Controls in the FEMA Disaster Acquisition Process 

Page 17 
Appendix C 

FEMA Acquisition Management Division Organization Chart 

Source: FEMA 

Internal Controls in the FEMA Disaster Acquisition Process 

Page 18 
Appendix D 

Report Distribution 

Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chief of Staff 

General Counsel 

Executive Secretary 

Director, GAO/OIG Liaison Office 

Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs 

Assistant Secretary for Office of Legislative Affairs 

FEMA Audit Liaison (Job Code DC7A01) 

Office of Management and Budget 

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees, as 

appropriate 

Internal Controls in the FEMA Disaster Acquisition Process 

Page 19 
ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4199, 

fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig. 

OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 

misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 

Attention: Office of Investigations - Hotline, 

245 Murray Drive, SW, Building 410, 

Washington, DC 20528. 

The OIG seeks to protect the identity of each writer and caller.