Hurricane Sandy Relief: Improved Guidance on Designing Internal Control Plans Could Enhance Oversight of Disaster Funding
Published: 2013-11-26T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In late October 2012, Hurricane Sandy devastated portions of the Mid-Atlantic and northeastern United States, leaving victims of the storm and their communities in need of financial assistance for disaster relief aid. On January 29, 2013, the President signed the Disaster Relief Appropriations Act, 2013, which provided approximately $50 billion in supplemental appropriations, before sequestration, to 61 programs at 19 federal agencies for expenses related to the consequences of Hurricane Sandy. The act required agencies to submit internal control plans for the funds in accordance with OMB criteria by March 31, 2013.
The act mandated GAO to review the design of agencies' internal control plans. This report addresses the extent to which (1) the internal control plans prepared by federal agencies complied with OMB guidance and (2) OMB's guidance was effective for providing comprehensive oversight of the internal control risks for the programs receiving funds for Sandy disaster relief. To address these objectives, GAO reviewed agencies' Sandy disaster relief internal control plans; M-13-07; and relevant GAO, inspector general, and financial statement audit reports. GAO also reviewed the internal control plans and M-13-07 against internal control standards.
section_title: What GAO Found
paragraphs: In response to the Disaster Relief Appropriations Act, 2013, agencies prepared Hurricane Sandy disaster relief internal control plans based on Office of Management and Budget (OMB) guidance but did not consistently apply the guidance in preparing these plans. OMB Memorandum M-13-07 (M-13-07), Accountability for Funds Provided by the Disaster Relief Appropriations Act, directed federal agencies to provide a description of incremental risks they identified for Sandy disaster relief funding as well as an internal control strategy for mitigating these risks. Each of the 19 agencies responsible for the 61 programs receiving funds under the act submitted an internal control plan with specific program details using a template provided by OMB. Agencies' plans ranged from providing most of the required information to not providing any information on certain programs. For example, each of the 61 programs was required to discuss its protocol for improper payments; however, GAO found that 38 programs included this information, 11 included partial information, and 12 included no information.
OMB's guidance was an important step in the oversight of Sandy disaster funding, addressing internal controls, improper payments protocol, and unexpended grant funds. However, several weaknesses limited its effectiveness in providing a comprehensive oversight mechanism for these funds. Specifically, the guidance (1) focused on the identification of incremental risks without adequate linkages to demonstrate that known risks had been adequately addressed, (2) provided agencies with significant flexibility without requirements for documentation or criteria for claiming exceptions, and (3) resulted in certain agencies developing their internal control plans at the same time that funds needed to be quickly distributed. GAO found that OMB guidance:
Asked agencies to focus on mitigating incremental risk, so the resulting plans did not provide comprehensive information on all known risks and internal controls that may affect the programs that received funding. Linking the additional risks identified in the plans to the complete set of known risks and related internal controls can help agency management and Congress to provide effective oversight of the funds.
Allowed agencies significant flexibility in deciding whether they needed to design additional internal controls, and did not provide specific criteria for agencies to claim exemptions from requirements. GAO found that some agencies did not discuss certain additional internal controls in their plans, despite having identified incremental risks.
Did not require agencies to document their rationales for not including additional internal controls in their plans. As a result, it was not apparent from the internal control plans the extent to which the agencies considered the need for these additional internal controls.
Was developed and issued in a short time frame in response to the act. By the time that the agencies submitted their internal control plans on March 31, 2013, they reported that they had already obligated approximately $4.6 billion. Standard internal control guidance for disaster funding could help ensure that controls are designed timely.
section_title: What GAO Recommends
paragraphs: GAO recommends that OMB develop more robust guidance for agencies to design internal control plans for future disaster relief funding. OMB staff generally agreed with GAO's recommendation.

section_title: Letter
paragraphs: In late October 2012, Hurricane Sandy devastated portions of the Mid- Atlantic and northeastern United States, leaving victims of the storm and  their communities in need of immediate disaster relief aid. On January 29,  2013, the President signed the Disaster Relief Appropriations Act, 2013  (Disaster Relief Act), which included approximately $50 billion in  supplemental appropriations for fiscal year 2013 to 61 specific programs  or appropriation accounts at 19 federal agencies for expenses related to   The Disaster Relief Act required  the consequences of Hurricane Sandy.these federal agencies to submit their plans for ensuring internal control  over the Sandy disaster relief funding by March 31, 2013, to GAO,  respective inspectors general (IG), the Office of Management and Budget  (OMB), and the Committees on Appropriations of the U.S. Senate and the  House of Representatives.
The Disaster Relief Act also required OMB to establish criteria for the  agencies to follow in developing internal control plans for managing the  risks associated with the additional Sandy disaster-related funding. On  March 12, 2013, OMB established these criteria in Memorandum M-13-07  (M-13-07), Accountability for Funds Provided by the Disaster Relief  Appropriations Act.design of the internal control plans for each federal agency receiving  funds. In response to the mandate, on June 28, 2013, we briefed your  committee staffs on our preliminary observations and discussed the  extent to which federal agencies designed effective internal control plans  for their programs that received funds for Sandy disaster relief.
The Disaster Relief Act mandated GAO to review the  This report provides the results of our final review to determine the extent  to which (1) the internal control plans prepared by federal agencies  complied with OMB guidance and (2) OMB’s guidance was effective for  providing comprehensive oversight of the internal control risks for the  programs receiving funds for Sandy disaster relief. To address our  objectives, we reviewed the Sandy disaster relief internal control plans for  the 19 federal agencies administering the 61 programs receiving funds  under the Disaster Relief Act and compared them to M-13-07. reviewed the internal control plans and M-13-07 against Standards for   In addition, we compared  Internal Control in the Federal Government.the agencies’ identified incremental risks to prior GAO and IG findings  associated with internal control risks for agency programs receiving funds  for Sandy disaster relief.
We conducted this performance audit from March 2013 to November  2013 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. A more detailed  explanation of our objectives, scope, and methodology can be found in  appendix I.
In addition to other Department of Defense (DOD) components, Department of the  Army—Army Corps of Engineers—Civil (USACE), received supplemental appropriations.  For the purposes of this report, we treated USACE as one of the 19 federal agencies,  separate from DOD.
subsections: section_title: Background
subsections: section_title: Disaster Relief Act
paragraphs: The Disaster Relief Act included approximately $50 billion in  supplemental appropriations for fiscal year 2013 to 19 agencies for 61  specific programs for expenses related to the consequences of Hurricane  Sandy. Under the authority granted by the Balanced Budget and  Emergency Deficit Control Act of 1985, as amended, OMB determined  that these supplemental appropriations were to be included in the fiscal  year 2013 base subject to sequestration under section 251A of that act.  The amounts included in this report are drawn from the Disaster Relief  Act as originally enacted, and are not adjusted to account for  sequestration. Figure 1 shows the distribution of Sandy disaster relief  funding by agency. Appendix II presents more detailed information on the  supplemental appropriations provided by the Disaster Relief Act.
Most of the agencies’ supplemental appropriations provided by the  Disaster Relief Act are related to grant programs. As shown in figure 2,  grant programs received more than $41 billion of the approximately   $50 billion provided by the Disaster Relief Act.
The Disaster Relief Act also provides an oversight framework for these  funds in regard to improper payments and the recapture of unexpended  grant funds. Specifically, the Disaster Relief Act states that all programs and activities receiving these funds shall be deemed  “susceptible to significant improper payments,” for purposes of the  Improper Payments Information Act of 2002 (IPIA), and  funds for grants shall be expended by the grantees within the 24- month period following the agency’s obligation of funds for the grant,  unless OMB waives this requirement for a particular grant program  and submits a written justification for such waiver to the Committees  on Appropriations of the U.S. Senate and the House of  Representatives. The act states that agencies shall include a term in  the grant that requires the grantee to return any funds to the agency  that are not expended within this 24-month period.
In addition, the Disaster Relief Act states that through September 30,  2015, the Recovery Accountability and Transparency Board (Recovery  Board) shall develop and use information technology resources and  oversight mechanisms to detect and remediate waste, fraud, and abuse  in the obligation and expenditure of funds to support oversight of Sandy  disaster relief funding. The act also states that the Recovery Board will  coordinate its activities with OMB, each federal agency receiving  appropriations related to the impact of Hurricane Sandy, and the IG of  each such agency.
section_title: OMB Guidance
paragraphs: As noted above, the Disaster Relief Act required OMB to establish criteria  for agencies to use in developing their Sandy disaster relief internal  control plans. Internal controls serve as the first line of defense in  safeguarding assets and in preventing and detecting fraud, abuse, and  errors. Given the magnitude of funding provided by the Disaster Relief  Act, it is important for federal agencies to ensure that the funds  appropriated under the act are used for their intended purposes. OMB  established the criteria in M-13-07, which provides an overview of the  internal control planning and reporting requirements for all programs  funded under the act with a focus on (1) developing additional internal  controls warranted beyond previously existing controls, (2) managing all  Sandy disaster-related funding with the same discipline and rigor as  programs that are traditionally designated as high risk for improper  payments, and (3) managing unexpended grant funds. M-13-07 notes  that as required by OMB Circular No. A-123, Management’s  Responsibility for Internal Control (OMB Circular A-123), agencies must  have established internal control plans to prevent waste, fraud, and abuse  of federal program funds.management is responsible for establishing and maintaining internal  control to achieve the objectives of effective and efficient operations,  reliable financial reporting, and compliance with applicable laws and  regulations.
Specifically, OMB Circular A-123 states that  As illustrated in figure 3, OMB directed agencies to describe incremental  risks identified for each program administering Sandy disaster relief  funding as well as the internal control strategy for mitigating each of these  risks (if applicable).
M-13-07 also discusses the roles of other parties involved in supporting  Sandy disaster relief efforts, including the Recovery Board, the Hurricane  Sandy Rebuilding Task Force (Task Force), and agency IGs. The Task  Force was established on December 7, 2012, under Executive Order  13632.opportunities for federal agencies to work together to support recovery  from Hurricane Sandy and to promote strong accountability for the use of  the disaster relief funds. M-13-07 also notes that the Task Force is  supported by a program management office that is working with agencies  to ensure stakeholder engagement, establish performance metrics to  gauge recovery efforts, and monitor the execution of Sandy disaster relief  funding. Further, M-13-07 emphasizes that agency internal control plans  should reflect consideration of early and frequent engagement between  agencies and IGs to discuss issues affecting the Disaster Relief Act’s  disaster-related programs and activities in order to identify and mitigate  potential risk.
M-13-07 states that the Task Force is responsible for identifying  In addition to issuing M-13-07, OMB took steps to help agencies develop  internal control plans for managing the risks related to Sandy funds.   These activities occurred prior to and following the release of the  guidance. On February 19, 2013, OMB sent the Chief Financial Officer  community advance notice of the forthcoming OMB guidance. This notice  identified minimum requirements for agency internal control plans that  would be included and further explained in the OMB guidance. Also, as  reported by OMB staff and agency officials, OMB met with the agencies  to discuss agency risk assessments and the development of internal  control plans.
section_title: Agencies Did Not Consistently Apply OMB M-13-07 in Preparing Their Sandy Disaster Relief Internal Control Plans
paragraphs: In accordance with M-13-07, each of the 19 agencies that received funds  under the act submitted a Sandy disaster relief internal control plan with  specific program details using the template provided by OMB. OMB  guidance directed agencies to develop internal control plans based on  incremental risk. We found that agencies identified incremental risk  related to Sandy activities for 38 of the 61 programs receiving funding  under the Disaster Relief Act. Our review of the internal control plans  disclosed that agencies did not consistently apply M-13-07 in preparing  these plans. Specifically, agencies’ plans ranged from providing most of  the required information to not providing any information on certain  programs. M-13-07 provides an overview of the internal control planning  and reporting requirements for all programs funded under the act with a  focus on three major areas: (1) additional internal controls for Sandy- related activities, (2) improper payments protocol, and (3) management of  unexpended grant funds.
subsections: section_title: Additional Internal Controls for Sandy-Related Activities
paragraphs: M-13-07 states that agency internal control plans for Sandy-related  program funding shall reflect consideration of elements such as  conducting additional levels of review, increasing monitoring and  oversight of grant recipients, continuing collaboration with the IG  community, and expediting review and resolution of audit findings.
The first element of additional internal control listed in M-13-07 is  additional levels of review of award decisions, payment transactions, and  other critical process elements that impact the use of Disaster Relief Act  funds. This requirement applied to the 38 programs that identified  incremental risk related to Sandy disaster relief funding. However, M-13- 07 notes that agencies should adopt more expansive review procedures,  as appropriate. This allowed agencies to determine whether additional  levels of review were necessary for their award decisions, payment  transactions, and other critical process elements. M-13-07 did not require  agencies to document their rationales for determining whether additional  levels of review were appropriate. Table 1 summarizes the requirement to  conduct additional levels of review per M-13-07.
As illustrated in table 2, our review found that agencies’ discussion in their  internal control plans of conducting additional levels of review for 38  programs that identified incremental risk related to Sandy activities varied.  Certain agencies did not discuss additional levels of review for programs  for which they identified incremental risk. Of the 38 programs that  identified incremental risk, 8 programs did not discuss award decisions,  11 programs did not discuss payment transactions, and 12 programs did  not discuss critical process elements that impact the use of Disaster  Relief Act funds. However, it is not clear from the Sandy disaster relief  internal control plans whether these agencies determined that additional  levels of review were not appropriate for these programs.
While the requirement for additional levels of review did not apply to the  23 programs that did not identify incremental risk, some agencies also  discussed conducting additional levels of review for certain programs for  which they did not identify incremental risk in their Sandy disaster relief  internal control plans. Of the 23 programs that did not identify incremental  risk, 5 programs discussed additional levels of review for award  decisions, payment transactions, and other critical process elements. For  example, one agency planned to add an additional level of review by  establishing an executive council to make final decisions on project  selection for its Hurricane Sandy funding.
The second element of additional internal control listed in M-13-07 is  increasing monitoring and oversight of grant recipients through   (1) increased frequency and specificity of grantee reports, (2) additional  site visits, and (3) additional technical assistance and training for grant  recipients. This requirement applies to all 17 grant programs that  identified incremental risk related to Sandy disaster relief funding.  However, M-13-07 notes that agencies should adopt increased  monitoring and oversight of grant recipients to the extent appropriate and  possible under budgetary constraints. This allowed agencies to justify not  designing controls for increased monitoring and oversight of grant  recipients because of low program risk or budgetary constraints. M-13-07  did not require agencies to document their rationales for determining  whether increased monitoring and oversight of grant recipients were  appropriate. Table 3 summarizes the requirement to increase monitoring  and oversight of grant recipients per M-13-07.
As illustrated in table 4, our review found that agencies’ discussion in their  internal control plans of increasing monitoring and oversight of grant  recipients varied. For most of the 17 grant programs, agencies planned to  increase monitoring and oversight mechanisms for their grant recipients.  For example, one agency planned to increase monitoring and oversight of  grant recipients by requiring financial and milestone progress reports from  its Hurricane Sandy grantees on a monthly basis, rather than quarterly, as  required of its other grantees.
Conversely, certain agencies did not discuss additional monitoring and  oversight of grant recipients for some grant programs. Specifically, of the  17 grant programs, 5 did not discuss increasing the frequency and  specificity of grantee reporting, 6 did not discuss conducting additional  site visits, and 9 did not discuss providing additional technical assistance  and training to recipients. However, it is not clear from the Sandy disaster  relief internal control plans whether these agencies determined that  increasing monitoring and oversight of grant recipients was not necessary  for these programs or not possible under budgetary constraints.
The third element of additional internal control listed in M-13-07 is that  agencies should continue early and frequent engagement with their  respective IG. This requirement applied to all programs that identified  incremental risk related to Sandy disaster relief funding. Table 5  summarizes the requirement to collaborate with the IG community per   M-13-07.
As illustrated in table 6, our review found that agencies discussed  collaboration with their IGs for most programs, regardless of whether they  identified incremental risk. For example, one agency noted in its Sandy  disaster relief internal control plan that it planned to hold monthly  meetings with its IG to discuss ongoing audits and foster additional  coordination through participation in program conferences and training.  While the requirement for continued collaboration with the IG community  applied to the 38 programs that identified incremental risk, 15 programs  that did not identify incremental risk also discussed continuing  collaboration with their respective IGs in their Sandy disaster relief  internal control plans. Of the 38 programs that identified incremental risk,  3 did not discuss continuing collaboration with the agency’s IG to identify  and mitigate potential risk.
The fourth element of additional internal control listed in M-13-07 is that  agencies should expedite the review and resolution of audit findings. M- 13-07 states that agencies shall resolve all audit findings, which include  findings from GAO, IG, and single audit reports, within 6 months after  completion of the audit to the extent practicable. This requirement applied  to all programs that identified incremental risk. Additionally, for grant  programs that identified incremental risk, M-13-07 states that agencies  should avoid granting extension requests for audit report submission and  should explore the feasibility of conducting additional audit activities to  review internal control procedures prior to funding the activity. Table 7  summarizes the requirement to expedite review and resolution of audit  findings per M-13-07.
As illustrated in table 8, our review found that agencies’ discussion in their  internal control plans of expediting review and resolution of audit findings  varied. While the requirement applied to the 38 programs that identified  incremental risk, not all agencies discussed resolving all audit findings  within 6 months after completion of the audit. Specifically, of the 38  programs, there were 12 programs that identified incremental risk and did  not discuss expediting review and resolution of audit findings in their  internal control plans. However, while the requirement applied to the 38  programs that identified incremental risk, 5 programs that did not identify  incremental risk also discussed expediting review and resolution of audit  findings in their Sandy disaster relief internal control plans.
For the 17 grant programs, agencies did not discuss avoidance of  granting extension requests for audit report submission and exploring the  feasibility of conducting additional audit activities prior to funding the  activity. Specifically, for the 17 grant programs, 14 did not discuss  avoiding granting extension requests for audit report submission and 11  did not discuss exploring the feasibility of conducting additional audit  activities prior to funding the activity. It is not clear from the Sandy  disaster relief internal control plans whether agencies determined that  these additional audit activities prior to funding the activity would not be  feasible.
The Disaster Relief Act states that all programs and activities receiving  funds under the act shall be deemed to be “susceptible to significant  improper payments” for purposes of IPIA. M-13-07 adds that all federal  programs or activities receiving funds under the act are required to  calculate and report an improper payment estimate. Additionally, M-13-07  notes that agencies shall manage all Sandy-related funding with the same  discipline and rigor as programs that are traditionally designated as high  risk for improper payments. Table 9 summarizes the requirement related  to improper payments protocol.
As illustrated in table 10, our review of agencies’ disaster relief internal  control plans for all 61 programs found that agencies discussed  developing a sampling methodology to produce and report an estimate of  improper payments in the fiscal year 2014 reporting period for 38  programs. Agencies discussed improper payments, but did not discuss  producing and reporting an estimate of improper payments for 11  programs. Agencies did not discuss improper payments for 12 programs.
The Disaster Relief Act states that funds for grants shall be expended by  the grantees within the 24-month period following the agency’s obligation  of funds for the grant, unless OMB waives this requirement for a particular  grant program and submits a written justification for such waiver to the  Committees on Appropriations of the U.S. Senate and the House of  Representatives. The act also states that agencies shall include a term in  the grant that requires the grantee to return any funds to the agency that  are not expended within this 24-month period. M-13-07 expands on the  act by stating that agencies shall ensure that each proposed grant activity  has clear timelines for execution and completion within the statutory  period available for grantee expenditure. Table 11 summarizes the  requirements related to the management of unexpended grant funds.
As illustrated in table 12, our review found that some agencies’ internal  control plans did not address OMB’s four requirements related to the  management of unexpended grant funds for all 17 grant programs.  However, it is not clear whether all of these four requirements apply to  each grant program because agencies may be planning to request  waivers of the 24-month expenditure requirement for certain of their grant  programs.
section_title: Several Weaknesses Limited the Effectiveness of OMB’s Guidance in Providing Comprehensive Oversight of Sandy Disaster Funding
paragraphs: OMB issued guidance to provide oversight over Sandy disaster funding,  which represents an important step toward accountability over these  funds. Several weaknesses limited the effectiveness of this guidance in  providing a comprehensive oversight mechanism for these funds.  Specifically, the guidance (1) focused on the identification of incremental  risks without adequate linkages to demonstrate that known risks had  been adequately addressed, (2) provided agencies with significant  flexibility without requirements for documentation or criteria for claiming  exceptions, and (3) resulted in certain agencies’ developing their internal  control plans at the same time that funds needed to be quickly distributed.  The demand for rapid response and recovery assistance suggests that a  proactive approach is needed in providing guidance to agencies to ensure  accountability over disaster relief funding, prior to a disaster occurring.
subsections: section_title: Linkage to Known Control Risks Could Help Ensure That All Risks Are Considered
paragraphs: The internal control plans prepared by the agencies under M-13-07 were  intended to mitigate incremental risk, and therefore they did not provide  comprehensive information on all known risks and internal controls that  may affect the programs that received the Sandy disaster funding. For  many years, we and the IG community have identified internal control  weaknesses in the federal government related to agencies receiving  funds for disaster assistance. For example, following Hurricane Katrina,  we reported on a number of internal control weaknesses related to  contracting issues, such as federal agencies involved in responding to the  disaster that had inadequate acquisition plans for carrying out their  assigned responsibilities, insufficient knowledge of the market or unsound  ordering practices that led to excessive or wasteful expenditures, and  insufficient staff available for monitoring and oversight. We also  identified control weaknesses related to grants management following  Hurricanes Katrina and Rita, such as determining the amount of damage that was actually disaster related;  sharing project information among intergovernmental participants  during project development, and limitations in how the status of  projects is tracked; and inadequate human capital capacity, especially early on in the  recovery.
Similarly, IGs have reported on internal control weaknesses related to  accountability over disaster assistance. For example, IGs have reported  that grantees did not complete their disaster relief projects in a timely  manner and did not ensure the use of funds for intended purposes, and  that states did not provide timely reporting on activity progress related to  grant funding as some activities were not reported on until the projects  were complete.
When we compared the incremental risks identified by the agencies  receiving funds for Sandy disaster relief with risks identified in prior GAO,  IG, and financial statement audit reports related to grants management,  contract management, improper payments, and other internal control  weaknesses for programs receiving Sandy funding, we determined that  some of the risks in these reports were not included in the Sandy disaster  relief internal control plans. For example, one agency that reported that it  will expend its Sandy disaster relief funds through contracts did not  identify any incremental risks. Our review of prior GAO, IG, and financial  statement audit reports found significant risks related to the agency’s  contract management. According to Standards for Internal Control in the  Federal Government, internal control should provide for an assessment of  the risks the agency faces from both external and internal sources.  Management needs to comprehensively identify risks and should  consider all significant interactions between the entity and other parties as  well as internal factors at both the entity-wide and activity levels. Because  the internal control plans prepared by the agencies are a subset of the  complete set of risks related to programs receiving Sandy disaster relief  funding, they are not effective for providing comprehensive oversight of  Sandy disaster relief funds.assessment is necessary to help to ensure that agencies have  considered all risks when designing internal controls.
section_title: Specific Criteria and Justification for Significant Decisions Could Improve Guidance
paragraphs: As described previously, OMB guidance listed various elements of  additional internal control that at a minimum should have been reflected in  the agencies’ internal control plans. However, the guidance included  language that allowed agencies significant flexibility in deciding whether  they needed to design additional internal controls. M-13-07 did not  provide specific criteria for agencies to follow to claim exemptions from  requirements, and the guidance did not require agencies to document  their rationales for not including additional internal controls in their internal  control plans. For example, M-13-07 states that agencies should conduct  additional levels of review “as appropriate” and should increase  monitoring and oversight of grant recipients “to the extent appropriate to  mitigate risk and possible under budgetary constraints.” The guidance did  not provide criteria for determining “appropriateness” or “budgetary  constraints.” We found that some agencies did not discuss additional  levels of review despite having identified incremental risk and did not  discuss increased monitoring and oversight of grant recipients for some of  their grant programs. Because M-13-07 did not require agencies to  document their reasons for these omissions, the extent to which the  agencies considered the need for these additional internal controls is not  apparent from the Sandy disaster relief internal control plans.
Additionally, M-13-07 required agencies to make an annual certification  that the appropriate policies and controls were in place for activities and  expenses related to Hurricane Sandy. M-13-07 provides agencies  flexibility by stating that this annual certification for Hurricane Sandy  funding “can be included” as part of the agencies’ annual assurance  statements. According to OMB staff, OMB expected agencies to leverage  their existing annual internal control review process performed in  accordance with OMB Circular A-123 to include the internal controls  related to activities and expenses funded by the Disaster Relief Act  related to Hurricane Sandy. However, M-13-07 did not include specific  requirements linking the annual review of controls to any additional  control requirements for disaster-related funding. In light of the amount of  funds involved and the risks associated with the funds provided by the  Disaster Relief Act, on August 2, 2013, we sent a letter to the Director of  OMB requesting consideration for sending written instructions to federal  agencies to ensure that agency management includes the programs  receiving funds for disaster assistance for Hurricane Sandy in their annual  internal control reviews and assessments for fiscal year 2013. Such  linkage between the incremental risks and mitigating controls related to  disaster funding and efforts to address known internal control risks would  be an important factor in providing comprehensive oversight of the  internal control risks for the programs receiving disaster relief funds.
section_title: Standard Guidance Could Help Ensure That Controls Are Designed Timely
paragraphs: In addition to the lack of comprehensive information on risks and internal  controls, there is a risk that the incremental internal controls for Sandy  disaster relief funding may not have been designed in time for its  distribution. The Disaster Relief Act, which required OMB to issue  guidance, was enacted on January 29, 2013. OMB had a short time  frame to develop and issue the internal control guidance. As noted earlier,  on February 19, 2013, OMB sent the Chief Financial Officer community  advance notice of its impending guidance, and OMB finalized its guidance  by issuing M-13-07 on March 12, 2013. In many cases, agencies  developed and implemented the internal control plans at the same time  that the funds needed to be quickly distributed. The Disaster Relief Act  required agencies to submit their internal control plans by March 31,  2013, and agencies reported that they had already obligated  approximately $4.6 billion as of that date.
The limitations we identified in implementing M-13-07 illustrate that  developing comprehensive internal control plans while a disaster unfolds  is not feasible, and a proactive approach could help ensure that controls  are designed timely. For example, OMB has provided standard  procurement guidance, through its Emergency Acquisitions Guide, to  assist the federal contracting community with carrying out procurement  activities during disasters and other emergencies. As we have  previously reported, following a disaster, decision makers face a tension  between the demand for rapid response and recovery assistance— including assistance to victims—and implementing appropriate controls  and accountability mechanisms. The risk for fraud and abuse grows  when billions of dollars are being spent quickly. Weather-related events  have cost the nation tens of billions of dollars in damages over the past  decade. In our 2013 high-risk series, we reported that the United States  Global Change Research Program has observed that the impacts and  costliness of weather disasters will increase in significance, as what are  considered “rare” events become more common and intense because of  climate change. We previously reported that the growing number of  disaster declarations—98 in fiscal year 2011 compared with 65 in 2004— has contributed to higher federal disaster costs. These impacts pose  significant financial risks for the federal government, which owns  extensive infrastructure, insures property through federal flood and crop  insurance programs, provides technical assistance to state and local  governments, and provides emergency aid in response to natural  disasters. Without standard internal control guidance in place prior to  future disasters, agencies may not be able to ensure that internal controls  for disaster relief funding are effectively designed and timely implemented  for all related funding.
section_title: Conclusions
paragraphs: When disasters occur, the destruction caused by those disasters must be  addressed immediately, and disaster relief funding must be delivered  expeditiously. However, the risk for fraud and abuse increases when  billions of dollars are being spent quickly. Our past work and that of the IG  community has shown that effective controls and comprehensive  accountability mechanisms for the use of resources related to a disaster  are essential to ensure that resources are used appropriately. Relying on  incremental disaster relief internal control plans cannot ensure that  comprehensive information on risks and related internal controls will be  adequate to ensure the safeguarding of disaster funds. Although M-13-07  represents an important step in the right direction, establishing more  robust internal control guidance that can be applied to future disaster  relief funding would allow agencies to proactively identify risks and  develop internal controls prior to receiving such funding. Further, linking  the additional risks identified in incremental plans to the complete set of  known risks and related internal controls can help agency management  and external entities, including Congress, to provide effective oversight of  the funds.
section_title: Recommendation for Executive Action
paragraphs: To proactively prepare for oversight of future disaster relief funding, we  recommend that the Director of OMB develop standard guidance for  federal agencies to use in designing internal control plans for disaster  relief funding. Such guidance could leverage existing internal control  review processes and should include, at a minimum, the following  elements:  robust criteria for identifying and documenting incremental risks and  mitigating controls related to the funding and requirements for documenting the linkage between the incremental  risks related to disaster funding and efforts to address known internal  control risks.
section_title: Agency Comments
paragraphs: We requested comments on a draft of the report from the Director of the  Office of Management and Budget or her designee. On November 14,  2013, staff from OMB’s Office of Federal Financial Management provided  oral comments and stated that they generally agreed with our  recommendation and requested additional information on the findings to  inform future guidance. They also provided technical comments, which  we incorporated as appropriate.
We are sending copies of this report to interested congressional  committees, the Director of the Office of Management and Budget, and  the 19 agencies receiving funds under the Disaster Relief Act. In addition,  the report is available at no charge on the GAO website at  http://www.gao.gov.
If you or your staffs have any questions about this report, please contact  me at (202) 512-2623 or davisbh@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff members who made key contributions to  this report are listed in appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: The Disaster Relief Appropriations Act, 2013 (Disaster Relief Act),mandated GAO to review the design of the internal control plans prepared  by federal agencies receiving funds under the Disaster Relief Act. This  report addresses the extent to which (1) the internal control plans  prepared by federal agencies complied with Office of Management and  Budget (OMB) guidance and (2) OMB’s guidance was effective for  providing comprehensive oversight of the internal control risks for the  programs receiving funds for Sandy disaster relief.
To determine the extent to which the internal control plans prepared by  federal agencies complied with OMB guidance, we obtained the Sandy  disaster relief internal control plans for the 19 federal agencies  administering the 61 programs receiving funds under the Disaster Relief  Act and compared them to OMB Memorandum M-13-07 (M-13-07).
To determine the extent to which OMB’s guidance was effective for  providing comprehensive oversight of the internal control risks for the  programs receiving funds for Sandy disaster relief, we reviewed the  internal control plans and M-13-07 against Standards for Internal Control  in the Federal Government. We interviewed OMB staff and agency officials regarding the development and implementation of M-13-07. In  addition, we compared the agencies’ identified incremental risks to prior  GAO and inspector general (IG) findings associated with internal control  risks for agency programs receiving funds for Sandy disaster relief.  Specifically, we reviewed the following:
GAO, High-Risk Series: An Update,
GAO reports and findings from 2010 to 2013 that focused on  programs receiving funding under the Disaster Relief Act, and GAO  work related to Hurricane Katrina or the American Recovery and  Reinvestment Act of 2009; agencies’ IG reports from 2010 to 2013 that focus on programs  receiving Disaster Relief Act funds; agencies’ fiscal year 2012 financial statement auditor’s reports,  including reports on internal control over financial reporting and  reported noncompliance with laws and regulations, fiscal year 2012  reported improper payments, and management’s statement of  assurance related to 31 U.S.C. § 3512(c)-(d), commonly known as the  Federal Managers’ Financial Integrity Act, and OMB Circular No. A- 123; agencies’ fiscal year 2012 annual reviews of programs and  identification of those susceptible to significant improper payments.
In addition, we obtained information from agencies regarding the status of  obligations of Sandy disaster relief funding and the impact of  sequestration on these funds. We also obtained information from agency  IGs regarding their ongoing or planned audit work related to Sandy  disaster relief funding.
We conducted this performance audit from March 2013 to November  2013 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
section_title: Appendix II: Federal Agencies’ Programs or Appropriation Accounts Receiving Supplemental Funds under the Disaster Relief Appropriations Act, 2013
paragraphs: Table 13 presents the federal agencies and programs or appropriation  accounts receiving funding under the Disaster Relief Act. Under the  authority granted by the Balanced Budget and Emergency Deficit Control  Act of 1985, as amended, OMB determined that these supplemental  appropriations were to be included in the fiscal year 2013 base subject to  sequestration under section 251A of that act. The amounts included in  this report are drawn from the Disaster Relief Act as originally enacted  and are not adjusted to account for sequestration.
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Michael Hansen (Assistant  Director), Kim McGatlin (Assistant Director), Gloria Cano, Oliver Culley,  Francine DelVecchio, Gabrielle Fagan, Patrick Frey, James Healy,  Wilfred Holloway, Jason Kelly, Jason Kirwan, Felicia Lopez, Andrew  Seehusen, Danietta Williams, and Matthew Zaun made key contributions  to this report.