Internal Controls: The Morris K. Udall and Stewart L. Udall Foundation Has Made Significant Progress but Needs to Fully Document Certain Policies and Procedures
Published: 2015-11-06T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In December 2013, GAO issued a report that described the Foundation's actions to improve its internal control assessment process and its controls over personnel and contracting.
A fiscal year 2015 congressional directive includes a provision for GAO to conduct a follow-up evaluation of the Foundation's internal controls. This report examines the extent to which the Foundation has (1) made progress in improving its internal control environment, risk assessment, and monitoring activities; (2) designed and implemented effective internal control over certain of its personnel and contracting practices; and (3) designed and implemented effective internal control over receipts and disbursements activity.
For the 9-month period July 1, 2014, through March 31, 2015, GAO reviewed relevant Foundation documents, interviewed Foundation management, reviewed key processes, performed observations, and tested transactions for key internal control activities.
section_title: What GAO Found
paragraphs: The Morris K. Udall and Stewart L. Udall Foundation (Foundation), an executive branch agency, provides educational opportunities related to environmental policy and Native American health care and tribal policy and assists in resolving environmental disputes that involve federal agencies. Since GAO's 2013 report, the Foundation has made significant improvements to several key areas as detailed below.
The Foundation also has made significant progress designing and implementing internal control activities over certain of its personnel and contracting practices. However, the Foundation has not, as called for under federal internal control standards, (1) fully documented its policies and procedures related to the hiring and separation of employees and (2) updated and finalized its policies and procedures over its contracting practices to include all key internal control activities, such as providing evidence of management's receipt and review of contractors' invoices. Foundation officials stated that they had not yet performed these actions as they have focused their efforts during fiscal year 2015 on developing formal written internal control policies and procedures in areas that were previously identified by Foundation management as significant risks. However, the Foundation's Corrective Action Plan does not include steps to document hiring and separation policies and does not have a completion date for finalizing its contracting policies. Until this is addressed, there is an increased risk that procedures in these areas may not be consistently carried out, which in turn increases the risk that (1) employees could be hired or separated improperly and applicable laws and implementing regulations may not be consistently followed and (2) the Foundation may pay for erroneous amounts billed.
The Foundation also effectively designed and implemented internal controls over its receipts and disbursements activity. The Foundation designed formal written internal control policies and procedures in these areas consistent with federal internal control standards. Based on tests of randomly selected statistical samples of transactions, GAO found that the Foundation effectively implemented key internal control activities over the processing of its receipts and disbursements activity.
section_title: What GAO Recommends
paragraphs: GAO recommends that the Foundation (1) fully document its internal control policies and procedures related to the hiring and separation of employees and (2) update its draft written policies and procedures over its contracting practices to include all key internal control activities, issue them in final form, and establish a date for completion. In commenting on a draft of this report, the Foundation concurred with the recommendations and stated that they will be included in its 2016 Corrective Action Plan.

section_title: Letter
paragraphs: The Morris K. Udall and Stewart L. Udall Foundation (Foundation) was  established in 1992 as an executive branch agency to provide  educational opportunities related to environmental policy and Native  American health care and tribal policy and also to assist in resolving  environmental disputes that involve federal agencies. In December 2012,  a Department of the Interior (DOI) Office of Inspector General (OIG) audit  of the Foundation identified significant issues primarily related to the  Foundation’s failure to appropriately monitor and assess the effectiveness  of its internal controls as required and the absence of key internal controls  over its personnel and contracting practices. In December 2013, we  issued a report that described the Foundation’s actions to improve its  internal control assessment process and its controls over personnel and  contracting, and attempted to determine the extent to which the design of  the Foundation’s actions had been sufficiently documented and was  consistent with internal control standards and applicable laws and  regulations. However, because the procedures were in draft form, it was  too soon for us to assess the design of the changes.
A fiscal year 2015 congressional directive includes a provision for us to  conduct a follow-up evaluation of the Foundation’s internal controls to  determine the degree to which internal controls are being fully  implemented. This report discusses the extent to which the Foundation  has (1) made progress in improving its internal control environment, risk  assessment, and monitoring activities; (2) designed and implemented  effective internal control over certain of its personnel and contracting  practices; and (3) designed and implemented effective internal control  over its receipts and disbursements activity (consisting of payroll,  contracting, and other expense transactions).
The scope of our audit was the 9-month period July 1, 2014, through  March 31, 2015. The Foundation was in the process of making significant  changes to its internal control policies and procedures during the first 6  months of calendar year 2014. Therefore, we selected the 9-month  period, July 1, 2014, through March 31, 2015, as the period of our audit  because the transactions in this time period would have been processed  under more of the Foundation’s newly developed internal control policies  and procedures.
To determine the extent to which the Foundation has improved its internal  control environment, risk assessment, and monitoring activities, we  considered the criteria in the Federal Managers’ Financial Integrity Act  (FMFIA); Standards for Internal Control in the Federal Government; and  the implementing guidance in the Office of Management and Budget’s  (OMB) Circular No. A-123, Management’s Responsibility for Internal  Control, which defines management’s responsibility for internal control in  federal agencies. We interviewed Foundation officials regarding the  formal written internal control policies and procedures that management  has developed and implemented and other actions management has  taken to improve its internal control environment. We also interviewed  Foundation officials about internal risk assessment and monitoring  activities that management performed. In addition, we reviewed the  agency financial report (AFR) for fiscal year 2014 to determine  management’s conclusions on the Foundation’s internal controls. Further,  we interviewed Foundation officials and reviewed documentation  regarding how they developed internal control assurance statements and  the sources of information that provided the basis for the Foundation’s  annual assessment of and report on internal control under FMFIA.
To determine the extent to which the Foundation designed effective  internal control over certain of its personnel and contracting practices, we  interviewed Foundation officials, reviewed written internal control policies  and procedures, and performed walkthroughs of specific transactions to  inform our understanding of the internal control environment. We also  obtained, analyzed, and summarized the Foundation’s written internal  control policies and procedures related to certain of its personnel and  contracting practices for the 9-month period July 1, 2014, through   March 31, 2015, and compared them to the criteria in Standards for  Internal Control in the Federal Government. To test the implementation  of internal controls over certain of the Foundation’s personnel practices,  we tested key internal control activities for all new hires, separations of  employees, and outside employment transactions occurring during the  test period of our audit. To test the implementation of internal controls  over contracting practices, we conducted tests of key internal control  activities on a randomly selected statistical sample of contracting  disbursement transactions.
To determine the extent to which the Foundation designed effective  internal control over its receipts and disbursements activity (consisting of  payroll, contracting, and other expense transactions), we interviewed  Foundation officials, reviewed written internal control policies and  procedures, and performed walkthroughs of specific transactions. We  also obtained, analyzed, and summarized the Foundation’s written  internal control policies and procedures related to receipts and  disbursements activity for the 9-month period July 1, 2014, through   March 31, 2015, and compared them to the criteria in Standards for  Internal Control in the Federal Government. To test the implementation  and effectiveness of internal controls over receipts and disbursements  activity, we conducted tests of key internal control activities on randomly  selected statistical samples of receipt transactions, payroll disbursement  transactions, contracting disbursement transactions, and other expense  disbursement transactions occurring during the test period of our audit.  Appendix I provides additional information on our objectives, scope, and  methodology.
We conducted this performance audit from April 2015 to November 2015  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: The Foundation was established as an independent executive branch  agency in 1992 to honor Morris K. Udall’s 30 years of service in the  House of Representatives as a leader on issues related to the  environment and Native Americans. In 2009, its authorizing legislation  was amended to also honor Stewart L. Udall’s public service legacy. The  Foundation is committed to educating a new generation of Americans to  preserve and protect their national heritage through scholarship,  fellowship, and internship programs focused on environmental and Native  American issues. The Foundation consists of the Morris K. Udall and  Stewart L. Udall Trust Fund, which is used to operate the Foundation’s  education programs (Education Trust Fund), and the Environmental  Dispute Resolution Fund. The latter fund is available to the Foundation to  operate the U.S. Institute for Environmental Conflict Resolution (U.S.  Institute), which was established by the Environmental Policy and Conflict  Resolution Act of 1998 to promote the principles and practices of  environmental conflict resolution and to assist in resolving conflict over  environmental issues involving federal agencies. The Foundation had 22  full-time employees as of March 31, 2015. The Foundation depends on  federal appropriations for the majority of its operations and received no- year appropriations of roughly $5.5 million and $5.4 million in fiscal years  2014 and 2015, respectively.
Under its authorizing legislation, the Foundation is subject to the  supervision and direction of the Board of Trustees (Board), which consists  of 13 trustees, 11 of whom are voting members of the Board. The  authorizing legislation charges the Board with appointing the Executive  Director and setting his or her compensation. Further, the Foundation’s  operating procedures provide that the Board appoints senior  management staff members and sets their compensation; approves the  organizational structure for the Foundation’s staff; approves the  Foundation’s budget and arranges for an annual financial audit; sets  policies, including internal controls, for the conduct and management of  the agency’s finances, personnel, and programs to be implemented by its  staff; and approves the strategic direction and priorities for the  Foundation. Over the past 3 years, the Foundation has undergone  several external reviews of its internal control policies and procedures, as  shown in figure 1.
The Foundation developed a Corrective Action Plan during fiscal year  2013 to address the findings identified in the DOI OIG December 2012  audit report and related financial management weaknesses the  Foundation identified and to improve internal controls over its key  financial management processes. Major elements of the fiscal year 2013  Corrective Action Plan included (1) performing a complete assessment of  the Foundation’s current internal control structure to identify adequate,  inadequate, and missing controls and (2) developing (or contracting to  have developed) policies and procedures to implement appropriate  internal controls in all areas where inadequate or missing controls were  identified.
In 2013, the Foundation contracted with an external consultant to perform  an internal control review with an overall goal of achieving compliance  with OMB Circular No. A-123 and Standards for Internal Control in the  Federal Government. The external consultant’s September 2013 report  assessed the Foundation’s implementation of 34 control activities and  found no significant deficiencies. Specifically, the external consultant  reported that 25 control activities were adequate, 7 control activities had  operational deficiencies, and 2 had design deficiencies. The Foundation  exercised its option to order additional services from the external  consultant to perform a follow-up report assessing the implementation of  the recommendations included in its September 2013 report. In February  2014, the external consultant issued its follow-up report, which reported  that all seven operational deficiencies and one of the design deficiencies  had been corrected. Although the other design deficiency, which was  related to controls over the delegation of authority, had not been  corrected, the external consultant reported that the Foundation had  implemented compensating controls in this area.
In January 2014, the Foundation’s fiscal year 2014 appropriation  assigned the DOI OIG responsibility for providing oversight for the  Foundation and provided funding to the DOI OIG to conduct  investigations and audits of the Foundation.
In September 2014, the DOI OIG issued an inspection report on the  Foundation’s internal controls. The DOI OIG’s report objectives were to  determine whether the Foundation’s internal controls were consistent with  accepted internal control standards and applicable laws and regulations  in the areas of (1) personnel actions, (2) contracting actions, and   (3) internal control monitoring and assessment processes under FMFIA.  Its review was limited to the design of the internal controls at the  Foundation and did not include a determination as to whether the internal  controls were operating effectively. The DOI OIG concluded that in the  areas reviewed, the Foundation’s internal controls appeared consistent  with accepted standards and applicable regulations. However, the DOI  OIG (consistent with GAO’s December 2013 report) noted that the extent  to which the new internal controls help the Foundation successfully  comply with applicable laws and regulations will depend on the continued  involvement and rigorous oversight of the Board.
In December 2014, the Foundation renewed its 5-year interagency  agreement for assisted acquisitions with the DOI Interior Business  Center’s (IBC) Acquisition Services Directorate. With the exception of  contracts below the micropurchase threshold of $3,000, the agreement  specifies that IBC will perform technical evaluations of contract proposals  and award contracts on the Foundation’s behalf, based on best value and  within Federal Acquisition Regulation (FAR) guidelines. IBC provides  comprehensive acquisition services to federal agencies, managing the  entire process from planning, soliciting, and evaluating offers to awarding  and administering contracts through closeout. Pursuant to the terms of  the interagency agreement, IBC has agreed to assist the Foundation on  contracts related to environmental conflict resolution activities, including  mediation, facilitation, and assessment services. An IBC official serves as  the Contracting Officer for contracts that IBC awards to private service  providers on the Foundation’s behalf.
section_title: The Foundation Has Made Significant Progress in Improving Its Internal Control Environment and Performed Risk Assessment and Monitoring Activities
paragraphs: The Foundation has made significant progress in improving its internal  control environment by hiring experienced senior-level management  officials, establishing a senior leadership team, and providing internal  control and ethics training. The Foundation has also made significant  progress in improving its risk assessment activities by conducting a risk  assessment survey and developing written internal control policies and  procedures. Foundation management gains knowledge about the daily  operation of internal controls from the direct involvement it has with the  operations of the Foundation’s programs and activities. Such knowledge  serves as an important part of the Foundation’s monitoring activities and  provides the primary basis for management’s annual internal control  assessment.
subsections: section_title: Significant Progress Made in Improving Internal Control Environment
paragraphs: The Foundation has made significant progress in developing and  implementing changes to improve its internal control environment,  including the following.
Hiring of experienced senior-level management. In July 2013, the  Foundation hired a General Counsel with extensive experience in  providing legal advice in the areas of contracts, personnel, ethics,  fiscal, bankruptcy, and administrative law. The General Counsel has  been involved in updating and developing several of the Foundation’s  personnel and ethics policies for compliance with applicable federal  service and government ethics laws and implementing regulations. In  June 2014, the Foundation hired a new Director of Finance and  Operations with extensive experience in implementing and improving  internal controls at other federal government agencies, and who has  been involved in conducting risk assessments and improving internal  controls at the Foundation.
Establishing a senior leadership team. The Foundation established  the Foundation Leadership Team (FLT) consisting of six senior  executives including the Executive Director, General Counsel,  Director of Finance and Operations, Director of the U.S. Institute,  Director of Education Programs, and Director of the Washington,  D.C., office. The FLT, with authority from the Executive Director, is  responsible for, among other things, assessing internal control over  financial reporting. This includes clearly communicating the objectives  of the risk assessment survey.
Providing internal control and ethics training. The Director of  Finance and Operations has conducted training on internal control  with Foundation staff, which covered the definition of internal control,  common internal controls, why internal control is required, and the five  elements of internal control included in Standards for Internal Control  in the Federal Government, among other internal control-related  matters. In addition, the General Counsel has conducted ethics  training with Foundation staff, which covered ethical principles, laws  governing federal employee conduct, the Office of Government Ethics’  regulations entitled Standards of Ethical Conduct for Employees of the  Executive Branch, conflicts of interest, outside activities, and  postemployment restrictions. The General Counsel has also provided  ethics training to the Board, which covered many ethical principles  applicable to members of the Board.
section_title: Significant Progress Made in Improving Risk Assessment Activities
paragraphs: The Foundation has also made significant progress in developing and  implementing changes to improve its risk assessment activities, including  the following.
Conducting a risk assessment survey. The FLT surveyed all of the  Foundation’s employees regarding the impacts and likelihood of the  most significant risks to the Foundation and asked the employees to  indicate the elements in their work that they considered most  vulnerable. The Executive Director, the Director of Finance and  Operations, the General Counsel, and the Director of Education  Programs used the results of the employee risk assessment survey,  which included the identification of over 130 different risks, to prioritize  the most significant risks to the Foundation.
Based on this prioritization, the most significant risks identified by the  FLT included documentation and communication of the contract  procurement process, purchase card use, the travel process, and  travel card use. According to documents from the October 16, 2014,  Board meeting, the Director of Finance and Operations stated that the  Foundation’s short-term vision for internal controls is to continuously  evaluate the Foundation’s work and improve internal controls, along  the way eliminating the most significant risks identified in the  employee risk assessment survey, over time ensuring that the items  being resolved will be of lower risk. In addition, the FLT plans to use  the results of the employee risk assessment survey, and other  assessment activities, to assess internal control over financial  reporting and to develop further internal control policies and  procedures in the most significant risk areas. Foundation  management indicated that continuous risk assessment and  monitoring will be performed and improved upon each year. The  Foundation also communicated the results of the employee risk  assessment survey to Foundation staff, including the most significant  risks identified by the FLT. The Foundation has developed, or is in the  process of developing, formal written policies related to those risks,  which included documentation and communication of the contract  procurement process, purchase card use, the travel process, and  travel card use.
Developing written internal control policies and procedures. The  Foundation has developed, or is in the process of developing, written  internal control policies and procedures. For example, since July 1,  2014, the Foundation updated or implemented the following changes  to its documented internal control policies and procedures.
Travel. Implemented mandatory annual training requirement for  travelers; required staff arranging lodging and meetings for large  groups to use the process to request quotes from outside vendors  or contractors to increase competition; required the Foundation to  negotiate a lower per diem rate for staff in travel status over 30  days; implemented the Director of Finance and Operations review  of all travel vouchers prior to their being approved for payment;  and required all staff to fly to destinations using federal city-pair  fares when available.
Purchase cards. Implemented mandatory annual training  requirements for purchase card holders; reduced the number of  purchase card holders to three (two in Tucson, one in  Washington, D.C.); and required purchases over the  micropurchase threshold to be procured with a purchase order  rather than a purchase card.
Procurement process. Issued a draft of a new internal  contracting policy that reinforces adherence to the requirements of  the FAR by entering into an interagency agreement with the IBC  for both assisted acquisition contracts and administrative service  contracts.
Other. Completed the creation of position descriptions for all  Foundation staff, including the review of the position descriptions  by the General Services Administration (GSA); created a  Foundation pay schedule; created a standardized form for  performance plans; and implemented the requirement for  maintaining an inventory of sensitive property.
According to Foundation officials, the FLT plans to use the results of the  risk assessment survey, and other assessment activities, to continue  developing internal control policies and procedures for those areas in  which formal written internal control policies and procedures have not  been developed, including areas in which internal control activities have  been implemented but not documented in the Foundation’s internal  control policies and procedures.
section_title: Management Performed Monitoring Activities to Provide the Primary Basis for Its Required Internal Control Assessment and Considered Appropriate Sources of Information
paragraphs: In its fiscal year 2014 AFR, Foundation management provided an  unqualified statement of assurance that internal controls in effect, from  October 1, 2013, through September 30, 2014, provided reasonable  assurance that the Foundation met the objectives of FMFIA. The  Executive Director and the Director of Finance and Operations are  integrally involved in substantially all of the Foundation’s financial  transactions and activities. For example, the Executive Director and the  Director of Finance and Operations review and approve contracts related  to environmental conflict resolution activities, receipt of invoices, invoices  for payment, credit card authorizations, employees’ biweekly payroll, and  the monthly reconciliations of cash receipts and disbursements. As such,  Foundation management gains knowledge about the daily operation of  internal controls from the direct involvement it has with the operations of  the Foundation’s programs and activities. Such knowledge serves as an  important part of the Foundation’s monitoring activities and provides the  primary basis for management’s annual internal control assessment. In  addition to management’s knowledge gained from its integral and  substantial involvement in the daily operations of the Foundation,  management also considered the following sources of information, as  suggested in the FMFIA implementing guidance in OMB Circular   No. A-123, that contributed to the basis and support for the annual  internal control assessment:
External consultant’s assessments of internal control. As  reported in our December 2013 report, the Foundation took action to  comprehensively assess its internal controls and planned to make  changes based on the results of that assessment. Specifically, the  Foundation contracted with an external consultant to perform an  internal control review with an overall goal of achieving compliance  with OMB Circular No. A-123 and Standards for Internal Control in the  Federal Government. In our December 2013 report, we determined  that the design of this action was consistent with internal control  standards related to monitoring operations and internal controls and  with FMFIA requirements to assess the effectiveness of internal  controls.
The scope of work for the external consultant’s review included  performing an assessment of the Foundation’s internal control  structure at the time of the review to identify adequate, inadequate,  and missing controls; recommending improvements to controls and  the control environment; recommending procedures for annual  monitoring and testing of controls; recommending a format for the  annual statement of assurance; and reviewing and recommending  improvements for communication of control responsibilities to the  Foundation’s staff. The external consultant’s September 2013 report  assessed the Foundation’s implementation of 34 control activities and  identified no significant deficiencies. Of these, the external consultant  determined that 25 control activities were adequate, 7 control  activities had operational deficiencies, and 2 had design deficiencies.  The seven operational deficiencies were related to contracting, charge  card purchasing, records administration, data integrity, overtime and  compensatory time policy, safety procedures, and food and  refreshment policy for meetings. The two design deficiencies related  to delegation of authority and property disposition. The Foundation  exercised its option to order additional services from the external  consultant to perform a follow-up report assessing the implementation  of the recommendations included in its September 2013 report.
The external consultant issued its follow-up report in February 2014  assessing the Foundation’s implementation of the recommendations  included in the external consultant’s September 2013 report, which  found that all seven operational deficiencies and the property  disposition design deficiency identified in its September 2013 report  had been corrected. The delegation of authority design deficiency had  not been corrected, but compensating controls were put in place that  the external consultant determined adequately compensated for any  weakness caused by the control deficiency. The external  consultant’s follow-up report concluded as follows:   “Risk assessment has been strengthened by establishing the Director  of Finance and Operations position and including risk assessment as  part of the Director of Finance and Operations position description.  Many improvements have been made to strengthen internal controls  over the past year. A majority of the recommendations contained in  the first report have already been implemented. The Foundation has  made a concerted effort, and continues to take actions to ensure  compliance with the requirements of OMB Circular No. A-123 and  associated laws.”
DOI OIG’s assessments of internal control. In September 2014, the  DOI OIG performed a review of the Foundation to determine whether  the Foundation’s internal controls were consistent with accepted  internal control standards and applicable laws and regulations in the  areas of (1) personnel actions, (2) contracting actions, and (3) internal  control monitoring and assessment processes under FMFIA. The DOI  OIG review was limited to the design of the internal controls at the  Foundation and did not include a determination as to whether the  internal controls were operating effectively. The DOI OIG concluded  that the Foundation’s internal controls in the areas reviewed appeared  consistent with accepted standards and applicable regulations.
Audit of the Foundation’s fiscal year 2014 financial statements.  During its audit of the Foundation’s financial statements for the year  ended September 30, 2014, the Foundation’s independent auditor  identified no deficiencies in internal controls that were considered a  material weakness or a significant deficiency in financial reporting.
Reviews of financial management systems. GSA performs payroll  and financial services for the Foundation. These services include  furnishing all necessary payroll support functions, receipt and  disbursement of funds, financial reporting and related accounting  functions, and execution of all investments in Department of the  Treasury obligations. GSA is considered to be part of the  Foundation’s financial management; however, Foundation  management is responsible for the integrity and objectivity of the  financial information presented in the financial statements.
To support management’s annual assurance statement in its fiscal  year 2014 AFR for the financial and payroll services provided by GSA,  the Foundation relied on the independent service auditor’s Statement  on Standards for Attestation Engagements (SSAE) No. 16 reports on  GSA’s (1) Pegasys Financial Management System and (2) Payroll  Accounting and Reporting (PAR) System. The SSAE No. 16 reports  on the Pegasys Financial Management System and the PAR System  covered the period of July 1, 2013, to June 30, 2014, and both were  unqualified opinions. In addition, the Foundation also relied on the  letters from GSA that notified the Foundation that from July 1, 2014,  through September 30, 2014, there were no significant changes to the  system controls for the Pegasys Financial Management System and  the PAR System.
section_title: Significant Progress Has Been Made in Designing and Implementing Effective Internal Control over Certain Personnel and Contracting Practices, but Related Policies Were Not Yet Fully Documented
paragraphs: The Foundation has made significant progress in designing and  implementing internal control activities and improving internal control over  certain of its personnel and contracting practices, which were highlighted  in our December 2013 report. For example, the Foundation has  developed a formal written Disciplinary Policy and an Outside  Employment Policy and is in the process of drafting guidance for its  contracting practices. In addition, the Foundation has implemented  internal control activities over certain of its personnel and contracting  practices. For example, we found that management reviewed and  approved an employee’s completed outside employment application and  the Contracting Officer’s Representative coordinated with the Program  Managers to determine that all contracted work that has been billed is  complete. However, the Foundation has not developed formal written  internal control policies related to the hiring and separation of employees.
subsections: section_title: Design and Implementation of Internal Control over Certain Personnel Practices
paragraphs: Most of the payroll activities, including processing employee time cards  and issuing payments, are outsourced to GSA through an interagency  agreement that specifies that GSA serves as the principal advisor on  matters related to human resource management. However, the  Foundation maintains responsibility for all other personnel functions. The  Foundation’s General Counsel has issued certain personnel policies,  such as the Disciplinary Policy and the Outside Employment Policy, to  help ensure that the Foundation’s policies comply with applicable federal  civil service and government ethics laws and implementing regulations.  However, the Foundation did not have formal written policies related to  the hiring and separation of employees. Despite this, we found that  controls over employee hiring, separation, and outside employment had  been implemented effectively during our period of review.
Design of internal controls over employee hiring and  separations. The Foundation acknowledged that it did not have  formal written internal control policies and procedures related to the  hiring of employees and did not have complete formal written internal  control policies related to the separation of employees, including  those who separate voluntarily (such as through retirement or a  change in employment) or involuntarily. The General Counsel has  developed the formal written Disciplinary Policy for an employee’s  removal pursuant to disciplinary action and poor performance, which  relates to involuntary separations.
Foundation officials stated that they had not yet documented these  internal control policies and procedures because they focused their  efforts during fiscal year 2015 on (1) developing formal written internal  control policies and procedures that were identified by the FLT’s risk  assessment survey and (2) implementing control activities in areas in  which the Foundation has not yet had the opportunity to develop  formal written internal control policies and procedures. During our  previous audit, Foundation officials informed us that they planned to  develop and complete formal written internal control policies and  procedures over certain personnel practices by early 2014, such as  the Disciplinary Policy and Outside Employment Policy. However,  such plans did not include developing formal written internal control  policies and procedures for hiring of employees and certain other  separation processes, and the Foundation’s Corrective Action Plan  did not include plans to do so.
Federal standards for internal control require that internal control and  all transactions and other significant events need to be clearly  documented, and the documentation should be readily available for  examination. The documentation should appear in management  directives, administrative policies, or operating manuals and may be in  paper or electronic form. All documentation and records should be  properly managed and maintained. A lack of formal written internal  control policies and procedures related to the hiring and separation of  employees increases the risk that (1) procedures related to hiring and  separations, such as management’s review and approval of an  employee’s qualifications and proposed salary before hire and  ensuring that separated employees are properly removed from the  payroll, may not be properly or consistently carried out and   (2) applicable laws and implementing regulations may not be  consistently followed.
Implementation of internal controls over employee hiring.  Although the internal control policies and procedures were not  fully documented, we found that the Foundation had sufficiently  implemented key internal control activities related to the hiring of  employees. We interviewed Foundation officials and conducted  walkthroughs of specific new hire transactions and determined  that the Foundation performed certain key internal control  activities relating to the hiring of employees during the test period  of our audit. Such key internal control activities included  management’s review of GSA position descriptions and noting  that each new employee’s salary was within the range of pay in  the GSA position description, management’s review and approval  of the new employee’s Office of Personnel Management (OPM)  request for personnel action, management’s review of monthly  detailed spreadsheets attesting to the addition of the new  employee, and management’s review of monthly reports attesting  to the addition of the new employee’s salary. We assessed the  design of these key internal control activities and found them to be  consistent with criteria in Standards for Internal Control in the  Federal Government. We tested these key internal control  activities for all five employees who were newly hired during the  test period of our audit, and found that they had been  implemented effectively.
Implementation of internal controls over employee  separations. Similar to hiring, we found that although the  separation policies and procedures were not fully documented, the  Foundation had sufficiently implemented key internal control  activities related to the separation of employees. We interviewed  Foundation officials and conducted walkthroughs of specific  employee separation transactions and determined that the  Foundation performed certain key internal control activities related  to the separation of employees during the test period of our audit.  Such key internal control activities included management’s review  and approval of the separated employee’s OPM request for  personnel action, management’s review of monthly detailed  spreadsheets attesting to the removal of the employee, and  management’s review of monthly reports attesting to the removal  of the employee’s salary. We assessed the design of these key  internal control activities and found them to be consistent with  criteria in Standards for Internal Control in the Federal  Government. We tested these key internal control activities for all  eight employees who voluntarily separated during the test period  of our audit, and found that they had been implemented  effectively. There were no involuntary separations during the  period of our review.
Design and implementation of internal controls over outside  employment. The Foundation has a formal written Outside  Employment Policy, which requires employees to obtain management  approval prior to engaging in any outside employment, whether that  employment is compensated or voluntary. Based on our review of the  Outside Employment Policy, interviews of Foundation officials, and  walkthroughs of specific outside employment transactions during the  test period of our audit, we identified the Foundation’s key internal  control activities for employees engaging in outside employment.  Such key internal control activities included each employee’s  completed outside employment application; management’s review  and approval of the employee’s completed outside employment  application; and a legal opinion prepared by the General Counsel,  which included a review of applicable statutory and regulatory  provisions to ensure that the employee was in compliance with  applicable laws and regulations. We assessed the design of these key  internal control activities and found them to be consistent with criteria  in Standards for Internal Control in the Federal Government. We  tested these key internal control activities for all four employees who  applied for outside employment during the test period of our audit, and  found that the Foundation’s key internal control activities for outside  employment were implemented effectively in accordance with the  Foundation’s Outside Employment Policy.
section_title: Design and Implementation of Internal Control over Contracting Practices
paragraphs: The Foundation’s interagency agreement with IBC helps improve  management and oversight of the environmental conflict resolution  contracts that IBC services. The total amount paid on the environmental  conflict resolution contracts was approximately $2.0 million for the 9- month period July 1, 2014, through March 31, 2015. In December 2014,  the Foundation modified its agreement with IBC to include administrative  contracts, which effectively removed the Foundation completely from the  awarding and administration of contracts. As IBC is much more  experienced in acquisition matters, this modification assists the  Foundation in implementing sound contracting practices.
Accordingly, the Foundation’s draft guidance over its contracting practices  focuses on (1) the steps leading up to the submission of contracting  transactions and information to IBC and (2) the reconciliation of the output  of contracting activity to the reports received from IBC. The draft guidance  details certain key internal control activities that the Foundation has  implemented in this area. However, we noted that not all key internal  control activities were included in the Foundation’s draft guidance. For  example, the key control activity to document evidence of management’s  receipt and review of contractors’ invoices, including a comparison of the  scope and nature of services provided and labor hours billed, was not  included in the draft guidance. Federal standards for internal control  require that internal control and all transactions and other significant  events be clearly documented and that the documentation be readily  available for examination. Foundation officials stated that they had not yet  fully documented and finalized internal control policies and procedures  related to contracting because, as noted previously, they focused their  efforts on implementing control activities in areas in which the Foundation  had not yet developed formal written policies and procedures. As  documented in its Corrective Action Plan, Foundation management  planned to update and finalize its formal written internal control policies  and procedures over its contracting practices. However, the Corrective  Action Plan did not establish a date by which the Foundation planned to  complete the action to fully update and finalize its formal written internal  control policies and procedures over its contracting practices. A lack of  fully developed and finalized written internal control policies and  procedures related to the Foundation’s contracting practices increases  the risk that procedures related to its contracting practices may not be  consistently carried out, which in turn increases the risk that the  Foundation may, for example, pay for erroneous amounts billed.
Based on our review of the Foundation’s draft guidance on its contracting  practices, interviews of Foundation officials, and walkthroughs of specific  contracting transactions during the test period of our audit, we identified  the Foundation’s key internal control activities. Such key internal control  activities included management approval of checklists attesting that no  conflicts of interest exist; evidence of management review and approval  of contracts; and evidence of management receipt and review of  contractor invoices, including a comparison of the scope and nature of  services provided and labor hours billed. We assessed the design of  these key internal control activities by comparing them to the criteria in  Standards for Internal Control in the Federal Government and found them  to be consistent with federal internal control standards. As discussed in  the section below, we performed testing on a randomly selected statistical  sample of contracting disbursements during the test period of our audit,  and found that the Foundation’s key internal control activities over its  contracting practices were implemented effectively in accordance with the  Foundation’s draft guidance and other key internal control activities not  yet documented.
section_title: The Foundation Effectively Designed and Implemented Internal Control over Receipts and Disbursements Activity
paragraphs: The Foundation has designed formal written internal control policies and  procedures for processing receipts activity and disbursements activity  (consisting of payroll, contracting, and other expense transactions).  Based on our review of these internal control policies and procedures, we  identified the key internal control activities related to the processing of  receipts and disbursements, compared them to the criteria in Standards  for Internal Control in the Federal Government, and found them to be  consistent with federal internal control standards. We selected and tested  random statistical samples of receipt and disbursement transactions for  the test period of our audit and determined that the Foundation’s key  internal control activities over the processing of its receipts and  disbursements activity were implemented effectively in accordance with  its formal written internal control policies and procedures.
subsections: section_title: Design and Implementation of Internal Control over Receipts
paragraphs: The Foundation has formal written internal control policies and  procedures for processing its receipts activity. Based on our review of  these internal control policies and procedures, interviews of Foundation  officials, and walkthroughs of specific receipt transactions during the test  period of our audit, we identified the Foundation’s key internal control  activities for processing its receipts activity. Such key internal control  activities included supervisory review of project data in the Foundation’s  Program Management Database (PMD); management review and  approval of all invoices, such as invoices for training services provided to  external parties in PMD; and management review of the invoices  spreadsheet attesting to the total amount of invoices. We assessed the  design of these key internal control activities by comparing them to the  criteria in Standards for Internal Control in the Federal Government and  found them to be consistent with federal internal control standards. We  selected and tested a random statistical sample of 36 receipt transactions  made during the test period of our audit, and found that the Foundation’s  key internal control activities over the processing of its receipts activity  were implemented effectively in accordance with the Foundation’s formal  written internal control policies and procedures.
section_title: Design and Implementation of Internal Control over Disbursements
paragraphs: The Foundation’s disbursements activity consists of payroll, contracting,  and other expense transactions. For services for which IBC pays the  contractor and seeks reimbursement from the Foundation through GSA,  GSA asks the Foundation which fund should be used to pay IBC. GSA  charges the amount against the Foundation’s obligation balance and  transfers the funds to IBC from the Foundation’s Fund Balance with  Treasury account. For other expense transactions, such as rent and  supplies, the Foundation receives vendor invoices and bills, which it then  submits to GSA for payment to the vendor.
Payroll disbursements. The Foundation has formal written internal  control policies and procedures for processing its payroll  disbursements activity. Based on our review of these internal control  policies and procedures, interviews of Foundation officials, and  walkthroughs of specific payroll disbursement transactions during the  test period of our audit, we identified the Foundation’s key internal  control activities for processing employee payroll. Such key internal  control activities included management’s review and approval of  requests for personnel actions, management’s review of monthly  detailed spreadsheets attesting to the correct salary for employees,  supervisory review of employees’ time cards and amendments, and  management review and electronic sign-off on employees’ time cards  and amendments. We assessed the design of these key internal  control activities by comparing them to the criteria in Standards for  Internal Control in the Federal Government and found them to be  consistent with federal internal control standards. We randomly  selected 10 biweekly pay periods from the 9-month period of our audit  and then randomly selected five transactions from each pay period,  which resulted in 50 payroll disbursement transactions during the test  period of our audit. Based on our selection and testing of these payroll  disbursement transactions, we found that the Foundation’s key  internal control activities over the processing of its payroll  disbursements activity were implemented effectively in accordance  with the Foundation’s formal written internal control policies and  procedures.
Contracting disbursements. The Foundation has formal written  internal control policies and procedures for processing its contracting  disbursements activity. Based on our review of these internal control  policies and procedures, interviews of Foundation officials, and  walkthroughs of specific contracting disbursements transactions  during the test period of our audit, we identified the Foundation’s key  internal control activities for processing its contracting disbursement  activity. Such key internal control activities included management  approval of checklists attesting that no conflicts of interest exist;  evidence of management review and approval of contracts; and  evidence of management receipt and review of contractor invoices,  including a comparison of the scope and nature of services provided  and labor hours billed. We assessed the design of these key internal  control activities by comparing them to the criteria in Standards for  Internal Control in the Federal Government and found them to be  consistent with federal internal control standards. We selected and  tested a random statistical sample of 37 contracting disbursement  transactions made during the test period of our audit, and found that  the Foundation’s key internal control activities over the processing of  its contracting disbursements activity were implemented effectively in  accordance with the Foundation’s formal written internal control  policies and procedures.
Other expense disbursements. The Foundation has formal written  internal control policies and procedures for processing its other  expense disbursements activity, such as rent and utilities. Based on  our review of these internal control policies and procedures,  interviews of Foundation officials, and walkthroughs of specific other  expense disbursement transactions during the test period of our audit,  we identified the Foundation’s key internal control activities for  processing other expense disbursements. Such key internal control  activities included supervisory review of invoices; evidence of  management receipt of invoices; management’s review and approval  of all credit card authorization forms; and management’s review and  approval of all invoices, which included evidence of receipt of  services. We assessed the design of these key internal control  activities by comparing them to the criteria in Standards for Internal  Control in the Federal Government and found them to be consistent  with federal internal control standards. We selected and tested a  random statistical sample of 50 other expense transactions made  during the test period of our audit, and found that the Foundation’s  key internal control activities over the processing of its other expense  disbursements activity were implemented effectively in accordance  with the Foundation’s formal written internal control policies and  procedures.
section_title: Conclusions
paragraphs: Since the release of GAO’s report in December 2013, the Foundation has  made significant progress in improving its internal control environment,  risk assessment, and monitoring activities; designing and implementing  internal control activities over certain of its personnel and contracting  practices; and designing and implementing internal control activities over  its receipts and disbursements activity. However, we found that the  Foundation had not documented formal written internal control policies  and procedures for its hiring of employees and certain other separation  processes and did not include plans to do so in its Corrective Action Plan.  In addition, the Foundation had not fully updated and finalized formal  written internal control policies and procedures for its contracting  practices, including all key internal control activities, such as evidence of  management’s receipt and review of contractors’ invoices, and had not  established a date by which it planned to complete the action to finalize  its policies and procedures for its contracting practices. Until the  Foundation fully documents its internal control policies and procedures for  certain of its personnel practices, and updates and finalizes its draft  guidance for its contracting practices, there is an increased risk that  procedures in these areas may not be consistently carried out, which in  turn increases the risk that (1) employees could be hired or separated  improperly and applicable laws and implementing regulations may not be  consistently followed and (2) the Foundation may pay for erroneous  amounts billed.
section_title: Recommendations for Executive Action
paragraphs: We recommend that the Foundation’s Executive Director take the  following two actions:
Fully document the Foundation’s internal control policies and  procedures related to the hiring and separation of employees.
Update the Foundation’s draft written policies and procedures over its  contracting practices to include all key internal control activities, issue  them in final form, and establish a date by which these actions will be  completed.
section_title: Agency Comments
paragraphs: We provided a draft of this report to the Foundation for comment. In its  written comments, which are reprinted in appendix II, the Foundation  concurred with our recommendations and stated that it will implement the  recommended actions. In addition, the Foundation stated that our  recommendations will be incorporated in the Foundation’s risk  assessment documentation, established as a priority, and included in the  Foundation’s fiscal year 2016 Corrective Action Plan.
We are sending copies of this report to the Executive Director of the  Morris K. Udall and Stewart L. Udall Foundation, the Deputy Inspector  General of the Department of the Interior, and interested congressional  committees. In addition, the report is available at no charge on the GAO  website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-9399 or malenichj@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. Key contributors to this report are listed in  appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to determine the extent to which the Morris K. Udall  and Stewart L. Udall Foundation (Foundation) has (1) made progress in  improving its internal control environment, risk assessment, and  monitoring activities; (2) designed and implemented effective internal  control over certain of its personnel and contracting practices; and   (3) designed and implemented effective internal control over its receipts  and disbursements activity (consisting of payroll, contracting, and other  expense transactions).
The scope of our audit was the 9-month period July 1, 2014, through  March 31, 2015. The Foundation was in the process of making significant  changes to its internal control policies and procedures during the first 6  months of calendar year 2014. Therefore, we selected the 9-month period  July 1, 2014, through March 31, 2015, as the period of our audit because  the transactions in this time period would have been processed under  more of the Foundation’s newly developed internal control policies and  procedures.
subsections: section_title: Internal Control Environment, Risk Assessment, and Monitoring Activities
paragraphs: To determine the extent to which the Foundation has improved its internal  control environment, risk assessment, and monitoring activities, we  considered the criteria in the Federal Managers’ Financial Integrity Act  (FMFIA); Standards for Internal Control in the Federal Government; and  the implementing guidance in the Office of Management and Budget’s  (OMB) Circular No. A-123, Management’s Responsibility for Internal  Control, which defines management’s responsibility for internal control in  federal agencies. We interviewed Foundation officials regarding the  formal written internal control policies and procedures that management  has developed and implemented and other actions management has  taken to improve its internal control environment. We also interviewed  Foundation officials about internal risk assessment and monitoring  activities that management performed. In addition, we reviewed the  agency financial report for fiscal year 2014 to determine management’s  conclusions on the Foundation’s internal controls. Further, we interviewed  Foundation officials and reviewed documentation regarding how they  developed internal control assurance statements and the sources of  information that provided the basis for the Foundation’s annual  assessment of and report on internal control under FMFIA.
section_title: Internal Control over Certain Personnel and Contracting Practices
paragraphs: To determine the extent to which the Foundation designed effective  internal control over certain of its personnel and contracting practices, we  interviewed Foundation officials, reviewed written internal control policies  and procedures, and performed walkthroughs of specific transactions to  inform our understanding of the internal control environment. We also  obtained, analyzed, and summarized the Foundation’s written internal  control policies and procedures related to certain of its personnel and  contracting practices for the 9-month period July 1, 2014, through   March 31, 2015, and compared them to the criteria in Standards for  Internal Control in the Federal Government.
To test the implementation of internal controls over certain of the  Foundation’s personnel practices, we tested key internal control activities  for all new hires, separations of employees, and outside employment  transactions.
subsections: section_title: Personnel Practices
paragraphs: 1.  Hiring. For the 9-month period July 1, 2014, through March 31, 2015,  we tested the key control activities for all five newly hired employees.  We assessed the design of these key internal control activities by  comparing them to the criteria in Standards for Internal Control in the  Federal Government to determine whether these key internal control  activities were consistent with federal internal control standards. We  tested these key control activities by inspecting the following:  management’s review of General Service Administration (GSA)  position descriptions and noting that each new employee’s salary was  within the range of pay in the GSA position description,  management’s review and approval of the new employee’s Office of  Personnel Management (OPM) request for personnel action,  management’s review of monthly detailed spreadsheets attesting to  the addition of the new employee, and management’s review of  monthly reports attesting to the addition of the new employee’s  salary.  2.  Separations. For the 9-month period July 1, 2014, through March 31,  2015, we tested the key control activities for all eight separated  employees. We assessed the design of these key internal control  activities by comparing them to the criteria in Standards for Internal  Control in the Federal Government to determine whether these key  internal control activities were consistent with federal internal control  standards. We tested these key control activities by inspecting the  following: management’s review and approval of the separated  employee’s OPM request for personnel action, management’s review  of monthly detailed spreadsheets attesting to the removal of the  employee, and management’s review of monthly reports attesting to  the removal of the employee’s salary.  3.  Outside employment. For the 9-month period July 1, 2014, through  March 31, 2015, we tested the key control activities for all four  employees who applied for outside employment. We assessed the  design of these key internal control activities by comparing them to  the criteria in Standards for Internal Control in the Federal  Government to determine whether these internal control activities  were consistent with federal internal control standards. We tested  these key control activities by inspecting the following: the employee’s  completed outside employment application; management’s review  and approval of the employee’s completed outside employment  application; and a legal opinion prepared by the General Counsel,  which included a review of applicable statutory and regulatory  provisions to ensure that the employee was in compliance with  applicable laws and regulations.
section_title: Contracting Practices
paragraphs: To test the implementation of internal controls over contracting practices,  we conducted tests of key internal control activities on a randomly  selected statistical sample of 37 contracting disbursement transactions,  as described in the section below.
section_title: Random Statistical Sampling of Receipts and Disbursements Activity
paragraphs: To determine the extent to which the Foundation designed effective  internal control over its receipts and disbursements activity (consisting of  payroll, contracting, and other expense transactions), we interviewed  Foundation officials, reviewed written internal control policies and  procedures, and performed walkthroughs of specific transactions. We  also obtained, analyzed, and summarized the Foundation’s written  internal control policies and procedures related to receipts and  disbursements activity for the 9-month period July 1, 2014, through   March 31, 2015, and compared them to the criteria in Standards for  Internal Control in the Federal Government to determine whether these  key control activities were consistent with federal internal control  standards.
Table 1 summarizes the receipts and disbursements activity for the 9- month period July 1, 2014, to March 31, 2015, and randomly selected  statistical sample sizes for each area. As noted above, we conducted  internal control-related walkthroughs and interviews, all of which indicated  that the designed internal controls were implemented. We incorporated  assurances gained from these additional audit steps into sample size  determinations to improve efficiency while maintaining effectiveness. We  planned our testing of each area to be 95 percent confident that the  actual error rate associated with sampling error inherent in these  statistical samples is less than or equal to 6.9 percent.
To test the implementation and effectiveness of internal controls over  receipts and disbursements activity (consisting of payroll, contracting, and  other expense transactions), we conducted transaction tests of key  internal control activities as described below.
subsections: section_title: Receipts Activity
paragraphs: 1.  For the 9-month period July 1, 2014, through March 31, 2015, we  selected and tested a random statistical sample of 36 receipt  transactions to determine whether the Foundation’s key internal  control activities over the processing of its receipts activity were  implemented effectively in accordance with the Foundation’s formal  written internal control policies and procedures. We tested these key  control activities over the processing of receipt transactions by  inspecting the following: supervisory review of project data in the  Project Management Database (PMD), management review and  approval of all invoices, such as invoices for training services provided  to external parties in PMD, and management review of the invoices  spreadsheet attesting to the total amount of invoices.
section_title: Disbursements Activity
paragraphs: 1.  Payroll disbursements. For the 9-month period July 1, 2014, through  March 31, 2015, we randomly selected 10 biweekly pay periods from  the 9-month period of our audit and then randomly selected five  transactions from each pay period, which resulted in 50 payroll  disbursement transactions. We then determined whether the  Foundation’s key internal control activities over the processing of its  payroll disbursements activity were implemented effectively in  accordance with the Foundation’s formal written internal control  policies and procedures. We tested the key control activities over the  processing of payroll disbursement transactions by inspecting the  following: management’s review and approval of requests for  personnel actions, management’s review of monthly detailed  spreadsheets attesting to the correct salary for employees,  supervisory review of employees’ time cards and amendments, and  management review and electronic sign-off on employees’ time cards  and amendments.  2.  Contracting disbursements. For the 9-month period July 1, 2014,  through March 31, 2015, we selected and tested a random statistical  sample of 37 contracting disbursement transactions to determine  whether the Foundation’s key internal control activities over the  processing of its contracting disbursements activity were implemented  effectively in accordance with the Foundation’s formal written internal  control policies and procedures. We tested the key control activities  over the processing of contracting disbursement transactions by  inspecting the following: management approval of checklists attesting  that no conflicts of interest exist; evidence of management review and  approval of contracts; and evidence of management receipt and  review of contractor invoices, including a comparison of the scope and  nature of services provided and labor hours billed.  3.  Other expense disbursements. For the 9-month period July 1, 2014,  through March 31, 2015, we selected and tested a random statistical  sample of 50 other expense transactions to determine whether the  Foundation’s key internal control activities over the processing of its  other expense disbursements activity were implemented effectively in  accordance with the Foundation’s formal written internal control  policies and procedures. We tested the key control activities over the  processing of other expense disbursement transactions by inspecting  the following: supervisory review of invoices; evidence of  management receipt of invoices; management’s review and approval  of all credit card authorization forms; and management’s review and  approval of all invoices, which included evidence of receipt of  services.
We conducted this performance audit from April 2015 to November 2015  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Morris K. Udall and Stewart L. Udall Foundation
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, William Boutboul (Assistant  Director), Sharon Byrd, Francine DelVecchio, Lauren S. Fassler, Wilfred  Holloway, Gail Luna, Cynthia Ma, Kevin McAloon, and Diana Vu made  significant contributions to this report.