Legal Services Corporation: Some Progress Made in Addressing Governance and Accountability Weaknesses, But Challenges Remain
Published: 2009-10-27T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In August 2007, GAO reported (GAO-07-993) that Legal Services Corporation (LSC) had not kept up with evolving reforms aimed at strengthening governance, accountability and internal controls. In December 2007, GAO reported (GAO-08-37) weaknesses in LSC's internal controls over grants management and oversight of grantees. GAO was asked to testify on the status of accountability practices of the LSC. GAO's testimony is primarily a summary of our prior reporting, but includes follow up work conducted between May and October 2009 to obtain information on the status of our prior recommendations.
section_title: What GAO Found
paragraphs: In August 2007, GAO reported that the governance practices of LSC's board fell short of the modern practices employed by other nonprofit corporations and public companies. Although the board members had demonstrated active involvement in LSC through regular board meeting attendance and participation, we pointed out several areas where LSC's governance practices could be strengthened. LSC's management practices had also not kept up with the current practices for key processes in risk assessment, internal control, and financial reporting. We pointed out certain areas where management's practices could be strengthened. GAO concluded that a properly implemented governance and accountability structure might have prevented incidents, such as compensation rates in excess of statutory caps, questionable expenditures, and potential conflicts of interest. GAO made 12 recommendations - 8 to the board and 4 to management. LSC's management has implemented all 4 recommendations to improve its management practices. The board has fully implemented 3 recommendations, but it needs to take additional actions to fully implement the other 5 recommendations. For example, LSC's board has fully implemented the key recommendation to establish an audit committee. However, another key recommendation for the board to implement procedures to periodically evaluate key management processes has not yet been fully implemented. LSC told GAO that it plans to take additional actions to more fully address the five recommendations. In December 2007, GAO reported weaknesses in LSC's internal controls over grants management and oversight of grantees that negatively affected LSC's ability to provide assurance that grant funds were being used for their intended purposes in compliance with applicable laws and regulations. Effective internal controls over grants and grantee oversight are critical to accomplishing LSC's mission because it relies extensively on grantees to provide legal services to individuals who otherwise could not afford to pay for legal counsel. GAO made 5 recommendations to address these issues. LSC management fully implemented two of our report recommendations, including following up on identified improper or potentially improper uses of grants funds. However, LSC has only partially implemented three key recommendations, including only limited action to implement an approach for selecting grantees for review using consistently applied, risk-based criteria. In order to improve LSC's board and management's ability to maintain accountability over LSC's mission, it will be critical for LSC's board and management to maintain priority focus on fully implementing all remaining GAO recommendations.

section_title: Letter
paragraphs: I am pleased to be here today to discuss our prior work on the Legal  Services Corporation’s (LSC) governance, accountability, and grants  management practices and the status of LSC’s efforts to address the  seventeen recommendations we made as a result of that work.
Today I will highlight our key findings and conclusions from our prior  reports on LSC’s governance and accountability practices, as well as the  internal control improvements needed in LSC grants management and  oversight. Our August and December 2007 reports contain a detailed  description of our findings, conclusions, and recommendations. In  addition, I will also provide the current status of LSC’s action to  implement the recommendations contained within those reports directed  at improving governance and management and grants management  internal controls.
LSC’s mission is to make federal funding available for legal assistance in  civil matters to low-income individuals throughout the United States on  everyday legal problems. LSC pursues this mission by making grants to  legal service providers (grant recipients) who serve low-income members  of the community who would otherwise not be able to afford legal  assistance (clients). Established by a federal charter in 1974 as a federally  funded, private nonprofit corporation, LSC is highly dependent on federal  appropriations for its operations. LSC received $390 million in  appropriations for fiscal year 2009. For fiscal year 2010 and 2011, LSC has  requested $485.8 million and $516.5 million, respectively.
LSC distributes funding to local legal-service providers based on the  number of low-income individuals living within a service area. LSC  management is responsible for ensuring that grant funds are used for their  intended purposes and in accordance with laws and regulations. Thus,  LSC is accountable for the effectiveness of its own internal controls and  for providing oversight and monitoring of grantees’ internal controls, use  of grant funds, and compliance with laws and regulations. LSC’s Board of  Directors is responsible for carrying out fiduciary duties in overseeing LSC  management’s operations and use of appropriated funds.
Effective governance and accountability, including internal control are key  to maintaining trust and credibility. Governance can be described as the  process of providing leadership, direction, and accountability in fulfilling  the organization’s mission, meeting objectives, and providing stewardship  of public resources, while establishing clear lines of responsibility for  results. Accountability represents the processes, mechanisms, and other  means—including financial reporting and internal controls—by which an  entity’s management carries out its stewardship and responsibility for  resources and performance. Internal control is an integral component of  an organization’s management that provides reasonable assurance that the  objectives of effectiveness and efficiency of operations, reliability of  financial reporting, and compliance with applicable laws and regulations  are being achieved.
We conducted the work for the August 2007 and December 2007 reports  on which this testimony was based from November 2006 through June  2007, and September 2006 through September 2007, respectively, in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe the evidence  obtained provided a reasonable basis for our audit findings and  conclusions based on our audit objectives. In addition, between May 2009  and October 2009 we obtained and reviewed available documentation and  discussed with LSC officials the status of actions to implement our August  and December 2007 recommendations.
subsections: section_title: LSC Has Made Improvements in its Governance and Management Practices But Key Actions Still Need to Be Completed
paragraphs: While LSC’s board and management have taken actions to improve its  governance and accountability practices towards fully implementing the  recommendations from our August 2007 report additional actions to fully  implement the other key recommendations are needed. In August 2007 we  reported, that since its inception over 30 years ago, LSC’s governance and  accountability practices, including its financial reporting and internal  control, had not kept pace with evolving governance and accountability  practices and as a result, its practices had fallen behind those of federal  agencies, U.S. government corporations,  and other nonprofit  corporations.
LSC’s board and management agreed with all twelve of our  recommendations in this area, the board has implemented corrective  actions for three of the eight recommendations made to the board and  management has implemented all four recommendations made to  management. For instance, in response to one of our eight  recommendations to the board, in March 2008 the board established an  audit committee, which filled an oversight gap of LSC’s internal control,  financial reporting and audit processes. However, another key  recommendation directed at the board developing and implementing  procedures to periodically evaluate key management processes, has yet to  be developed and fully implemented. This recommendation is key in that it  contributes to establishing an effective, supporting internal control  environment at LSC as well as assists the board in fulfilling its oversight  duties. As the board transitions to new board members, it will be  important for the new board to provide priority focused attention on fully  implementing the other five of our recommendations.
subsections: section_title: Governance Practices
paragraphs: In August 2007 we reported that the governance practices of LSC’s board  fell short of the modern practices employed by boards of nonprofit  corporations and public companies. Although the board members had  demonstrated active involvement in LSC through their regular board  meeting attendance and participation, we pointed out several areas where  LSC’s governance practices could be strengthened. Those areas included a  more comprehensive orientation program for new board members and an  ongoing training program that enables board members to stay current on  governance practices, the regulatory environment, and key management  practices. Although the LSC board had four committees, including finance  and operations and regulations, it did not have audit, ethics, or  compensation committees’ functions, important governance mechanisms  commonly used in corporate governance structures. The board had also  not assessed the performance, collectively or individually, of its board  members. Finally, the board had not implemented certain procedures that  are key to helping it carry out its fiduciary duties for overseeing LSC,  including evaluating key management processes, such as risk assessment,  risk mitigation, internal controls and financial reporting.
Our August 2007 report recommendations to improve and modernize the  governance processes and structure of LSC along with our views on the  status of LSC’s efforts to implement these recommendations (as of  October 20, 2009) are summarized in table 1.
LSC data we obtained and analyzed as part of our follow up work  conducted between May 2009 and October 2009, showed that the board  had fully implemented three of the eight recommendations, and had taken  some action on the remaining five recommendations. But full  implementation will be needed in order for the board’s actions to be fully  effective. The following summary highlights LSC actions and work that  remains to be done on the five recommendations that our analysis showed  were partially implemented.
In response to our recommendation that the board establish and  implement a comprehensive orientation program, LSC created a “wiki,”  which contains relevant information for LSC board members. However,  LSC management informed us that they are waiting for the pending board  member nominations to be confirmed by the U.S. Senate prior to holding a  formal orientation program.  In response to our recommendation that the board develop a plan for  providing regular training. LSC’s management informed us there have been  discussions about a training program and that the organizational updates  for training the board occurs during the quarterly board meetings and that  additional training needs of the board are determined by the self- assessments that the board members complete. LSC officials also stated  that since this is an overall experienced board, the recent self-assessments  did not indicate a need for training outside the organizational update.  Officials told us that LSC management is currently documenting a training  program, which we will evaluate when completed and implemented.
We recommended that the board establish a compensation committee  function to oversee compensation matters including LSC officers and  LSC’s overall compensation structure. Currently, the board’s Governance  and Performance Review Committee’s charter requires the committee to  annually review and report on LSC’s president and inspector general  performance and compensation. An LSC official told us that during the  October board meeting the board will be discussing and voting on a new  charter for the Governance and Performance Review Committee.  In response to our recommendation that the board conduct a periodic self- assessment of the board’s, the committees’ and each member’s individual  performance, the board has conducted and documented assessments for  the board and individuals. According to an LSC official, the committee  self-assessment process is still under discussion.
We recommended that the board develop and implement procedures to  periodically evaluate key management processes including at a minimum,  processes for risk assessment and mitigation, internal control and  financial reporting. The recently established audit committee’s charter  provides the audit committee with responsibility over internal controls  and therefore the evaluation of management’s processes. Although the  audit committee was established in March 2008, it has not yet completed  this key action.
section_title: Management Practices
paragraphs: In August 2007, we reported that LSC’s management practices did not  reflect current practices in the areas of risk assessment, internal control,  and financial reporting. We pointed out areas where management’s  practices could be strengthened. We found that management had not  implemented a systematic or formal risk assessment that evaluated the  risks the corporation faces from both external and internal sources. Such  an assessment provides a structure for implementing internal control and  other risk mitigation policies. In addition, senior management had not  established comprehensive policies or procedures regarding conflicts of  interest or other issues of ethical conduct. Without such policies and  procedures, LSC was at risk of not identifying potential conflicts of  interest and not taking appropriate actions to avoid potentially improper  transactions or actions on the part of LSC personnel. Also, management  had not conducted analysis of accounting standards to determine the most  appropriate standards for LSC to follow.
Our August 2007 report recommendations to improve and modernize key  management processes at LSC, along with our views on the status of LSC’s  efforts to implement those recommendations (as of October 20, 2009) are  summarized in Table 2.
section_title: Improved Internal Controls Needed over Grants Management and Oversight
paragraphs: While LSC has taken some actions with respect to our prior report’s grants  management-related recommendations, LSC has only partially  implemented some key recommendations in this area. LSC management  fully implemented two of our December 2007 report recommendations,  including following up on identified improper or potentially improper uses  of grants funds. However, LSC has only partially implemented three key  recommendations, including limited action on implementing an approach  for selecting grantees for review using consistently applied, risk-based  criteria. Full implementation of all of the remaining recommendations is  needed in order to ensure that LSC management has effective control over  its mission-critical grantees.
Our December 2007 review of grants management and oversight at LSC  identified weaknesses in LSC’s internal controls over grants management  and oversight that negatively affected LSC’s ability to monitor and oversee  grants and left grant funds vulnerable to misuse. At grantees we visited,  we also found poor fiscal practices and improper or potentially improper  expenditures that LSC could have identified with more effective oversight.  Although LSC has taken action to address two of the four  recommendations we made to management in our December 2007 report,  it has not yet implemented the two recommendations focused on oversight  of grantees use of funds. In order to strengthen the organizational  structure and governance of grantee oversight and monitoring, we made a  recommendation to the board to develop and implement policies that  clearly delineate organizational roles and responsibilities.
In December 2007 we reported on weakness in LSC’s control environment  regarding the lack of a clear definition of the authority and responsibilities  between two of the three organizational units that oversee the work of  grantees. At the time of our review, LSC management shared fiscal  oversight and monitoring of grantees with the OIG. Management’s  oversight role was conducted through two offices—the Office of Program  Performance (OPP) and the Office of Compliance and Enforcement  (OCE). We found that the roles and the division of responsibilities were  not clearly communicated between the OIG and OCE. The result was staff  confusion about the types and scope of grantee fiscal reviews that LSC  management could undertake on its initiative and strained relations  between management and the OIG. In addition, communication and  coordination between OCE and OPP was not sufficient to prevent gaps  and unnecessary duplication between the offices’ respective oversight  activities.
Regarding its oversight of grantees, the scope of LSC’s control activities  for monitoring grantee fiscal compliance was limited and feedback to  grantees not timely. In determining the timing and scope of grantee  oversight visits, LSC did not employ a structured or systematic approach  for assessing the risk of noncompliance or financial control weaknesses  across its 137 grantees. Without an analytically sound basis for assessing  risk and distributing its oversight resources, LSC did not have a basis for  knowing whether its oversight resources were being used effectively to  mitigate and reduce risk among its grantees.
LSC’s monitoring of grantee internal control systems needed to be  strengthened, because the scope of work in OCE’s fiscal reviews was not  sufficient in assessing grantee internal control and compliance for  purposes of achieving effective oversight. In the OCE site visits we  observed, staff did not follow up on questionable transactions and relied  heavily on information obtained through interviews. LSC also was not  timely in follow-up on an investigation into an alleged instance of  noncompliance referred to it by the OIG. Feedback to grantees was often  slow. As of September 2007, LSC had not yet issued reports to grantee  management for almost 19 percent (10 out of 53) of the 2006 site visits.  Without timely communications about the results of site visits, grantee  management does not have information about deficiencies and the related  corrective actions needed. In a grantee exit conference we observed, the  LSC review team did not communicate a number of findings they had  concluded were significant and in need of immediate attention. Effective  grantee monitoring is especially important for LSC because LSC has  limited options for sanctioning poorly performing grantees due to the  recurring nature of many of its grants.
In the limited reviews we performed at 14 grantees, we identified internal  control weaknesses at 9 grantees that LSC could have identified with more  effective oversight reviews. While control deficiencies at the grantees were  the immediate cause of the improper expenditures we found, weaknesses  in LSC’s controls over its oversight of grantees did not assure effective  monitoring of grantee controls and compliance or prevent the improper  expenditures. We also identified various weaknesses and improper  expenditures at grantees we visited. These weaknesses and improper  expenditures can result in a loss of credibility to the grantee and grantor  and also allow instances of fraud to take place if not addressed.
Our December 2007 report recommendations to improve its internal  control and oversight of grantees, along with our views on the status of  LSC’s efforts to implement those recommendations (as of October 20,  2009) are summarized in Table 3.
As a result of our follow-up work conducted between May 2009 and  October 2009, we determined that LSC management had fully implemented  two of the four recommendations we made to management. The remaining  two, as well as the recommendation to the board were partially  implemented. Based on our evaluation, the following summary highlights  LSC actions and work that remains to be done on the three  recommendations that remain partially implemented.
In response to our recommendation that LSC management use an  approach for selecting grantees for internal control and compliance  reviews that is founded on risk-based criteria and consistently applied,  LSC revised its OPP and OCE manuals to include criteria for use in  selecting grantees for reviews. Although LSC officials told us that the risk- based criteria was issued, they have not provided us with sufficient  evidence to demonstrate that the criteria is consistently applied. We will  evaluate LSC’s implementation as part of our current ongoing work.
We recommended that LSC address three factors—revise current  guidelines of fiscal compliance reviews to provide (1) a direct link of  results of OPP reviews and other audit findings, (2) guidance for  performing follow up responses during interviews, and (3) examples of  fiscal and internal control review procedures relative to individual risk  factors. LSC has updated its written guidelines for the fiscal component of  OCE’s regulatory and compliance reviews; however, the updates do not  include the three factors. LSC officials told us they will analyze their  current manuals and incorporate interview guidelines and other  information as needed. We will reevaluate this recommendation after LSC  management completes its analysis.  In response to our recommendation that the board develop and implement  policies and procedures that clearly delineate organizational roles and  responsibilities for grantee oversight and monitoring, the board-approved  updated descriptions of organizational roles and responsibilities. However,  internal controls discussed in the board approved descriptions are limited  to fiscal internal controls and do not include operational or other internal  controls that OPP and OCE are responsible for monitoring. According to  LSC’s management, the board’s description combined with OPP and OCE  manuals and documents address more than fiscal internal controls. We  will reevaluate this recommendation after LSC management analyzes and  gathers additional documentation to determine whether further actions  are needed to ensure clear organizational roles and responsibilities.
section_title: Conclusions
paragraphs: LSC’s Board of Directors and management have made progress on  implementing our prior recommendations including fully implementing  nine recommendations. The improvements that LSC has made in its  governance and accountability provide a good foundation for completing  implementation of the elements needed for a strong program of  governance and internal controls. Although management has implemented  the key recommendation of conducting and documenting a risk  assessment, ongoing risk assessment and a robust risk management  program is important to LSC’s overall internal control structure.
Further, although the board has implemented the key recommendation of  establishing an audit committee, the board must continue its efforts to  implement another key recommendation of developing and implementing  procedures to periodically evaluate management processes, including risk  assessment, mitigation, internal control and financial reporting. It will also  be important for the board to provide ongoing oversight of management’s  risk assessment and risk management program. Periodically evaluating  management will assist the board in fulfilling its oversight duty. Fully  implementing the remaining recommendations, will enable the board and  management to achieve the level of governance and internal control  needed to provide adequate assurance that LSC’s governance and internal  control structures are effective, and that grant funds are being used as  intended and in accordance with laws and regulations.
A strong governance structure and well established management practices  and internal controls will be crucial for LSC to maintain stable operations  during the upcoming board transition. Strong internal controls, with  ongoing risk assessment, monitoring, and oversight will also be key to  providing both the board and management with assurance that LSC funds  are being used for their intended purposes, in accordance with laws and  regulations and enable LSC to effectively adjust to evolving practices and  risks.
This concludes my prepared statement.
section_title: Contact and Acknowledgments
paragraphs: For further information about this testimony, please contact Susan  Ragland, Director, Financial Management and Assurance at (202) 512-8486,  or raglands@gao.gov. Contact points for our offices of Congressional  Relations and Public Affairs may be found on the last page of this  testimony. Major contributors to this testimony included Kimberley  McGatlin, Assistant Director; F. Abe Dymond, Assistant General Counsel;  Lauren S. Fassler; Bernice M. Lemaire; Mitch Owings; and Carrie Wehrly.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.