Regulatory Guidance Processes: Agencies Could Benefit from Stronger Internal Control Practices
Published: 2015-09-23T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Regulatory guidance is an important tool agencies use to communicate timely information about regulatory and grant programs to regulated parties, grantees, and the public. Guidance provides agencies flexibility to articulate their interpretations of regulations, clarify policies, and address new issues more quickly than may be possible using rulemaking. The potential effects of guidance and risks of legal challenges underscore the need for consistent processes for the development, review, dissemination, and evaluation of guidance.
This statement discusses four key questions addressed in GAO's April 2015 report on regulatory guidance: (1) what it is; (2) how agencies use it; (3) how agencies decide whether to use guidance or undertake rulemaking; and (4) steps agencies can take to ensure more effective guidance processes. To conduct that work, GAO reviewed relevant requirements, written procedures, guidance, and websites, and interviewed agency officials.
section_title: What GAO Found
paragraphs: What is regulatory guidance? One of the main purposes of guidance is to explain and help regulated parties comply with agencies' regulations. Even though not legally binding, guidance documents can have a significant effect on regulated entities and the public, both because of agencies' reliance on large volumes of guidance documents and because the guidance can prompt changes in the behavior of regulated parties and the general public.
How do agencies use regulatory guidance? The four departments GAO reviewed—Agriculture (USDA), Education (Education), Health and Human Services (HHS), and Labor (DOL)—and the 25 components engaged in regulatory or grant making activities in these departments used guidance for multiple purposes, such as clarifying or interpreting regulations and providing grant administration information. Agencies used many terms for guidance and agency components issued varying amounts of guidance, ranging from about 10 to more than 100 guidance documents each year. Departments typically identified few of their guidance documents as “significant,” generally defined by the Office of Management and Budget (OMB) as guidance with a broad and substantial impact on regulated entities.
How do agencies determine whether to issue guidance or undertake rulemaking? According to officials, agencies considered a number of factors when deciding whether to issue a regulation or guidance. However, the key criterion in making the choice was whether they intended the document to be binding; in such cases agencies proceeded with regulation.
How can agencies ensure more effective guidance processes that adhere to applicable criteria? All four departments we studied identified standard practices to follow when developing guidance but could also strengthen their internal controls for issuing guidance.
Agencies addressed OMB's requirements for significant guidance to varying degrees. Education and USDA had written departmental procedures for approval as required by OMB. DOL's procedures were not available to staff and required updating. HHS had no written procedures. In addition, USDA, DOL, and Education consistently applied OMB's public access and feedback requirements for significant guidance, while HHS did not.
In the absence of specific government standards for non-significant guidance—the majority of issued guidance—the application of internal controls is particularly important. The 25 components GAO reviewed addressed some control standards more regularly than others. For example, few components had written procedures to ensure consistent application of guidance processes. However, all components could describe standard review practices and most used tools to document management approval of guidance. Not all components conferred with external nonfederal stakeholders when developing guidance. Finally, nearly half of the components GAO reviewed did not regularly evaluate whether issued guidance was effective and up to date.
section_title: What GAO Recommends
paragraphs: GAO is making no new recommendations in this statement. In the April 2015 report, GAO recommended steps to ensure consistent application of OMB requirements for significant guidance and to strengthen internal controls in guidance production processes. The agencies generally agreed with the recommendations.

section_title: Letter
paragraphs: Thank you for the opportunity to discuss our report on regulatory  guidance processes, which we issued earlier this year. Regulatory  guidance is an important tool that agencies use to communicate timely  information about the implementation of regulatory and grant programs to  regulated parties, grantees, and the general public. Guidance can take a  variety of formats and names including directives, interpretive  memorandums, fact sheets, and Dear Colleague letters. The Office of  Management and Budget (OMB) defines the term “guidance document”  as an agency statement of general applicability and future effect, other  than a regulatory action, that sets forth a policy on a statutory, regulatory,  or technical issue or an interpretation of a statutory or regulatory issue.
Guidance documents provide agencies valuable flexibility to clarify their  requirements and policies, and to address new issues and circumstances  more quickly than may be possible using rulemaking. Although not legally  binding, guidance documents can have far-reaching effects. Guidance  documents can vary—by type, purpose, and amount—among agencies  and subcomponents of the same agency, and have often been reported  to outnumber regulations in terms of the number of documents issued  annually.
My remarks today highlight answers to four key questions addressed in  our April 2015 report on regulatory guidance processes:  1.  What is regulatory guidance?  2.  How do agencies use regulatory guidance?  3.  How do agencies determine whether to issue guidance or undertake  rulemaking?  4.  How can agencies ensure more effective guidance processes that  adhere to applicable criteria?
To conduct that work, we reviewed guidance processes at 25  components that engaged in regulatory or grant-making activities in four  departments—Agriculture (USDA), Education (Education), Health and  Human Services (HHS), and Labor (DOL). The scope of that review  focused on guidance issued to external parties that explained regulatory  and grant-related requirements and other policies. We reviewed agencies’  written procedures, guidance documents, and websites. We also  interviewed department and component officials on guidance practices.  We selected and applied four government-wide internal control standards  to guidance processes. We identified both opportunities for improved  internal controls related to guidance and highlighted agency practices that  could be applied to guidance processes in other agencies. We conducted  the work on which this statement is based in accordance with generally  accepted government auditing standards. Those standards require that  we plan and perform the audit to obtain sufficient, appropriate evidence to  provide a reasonable basis for our findings and conclusions based on our  audit objectives. We believe that the evidence obtained provides a  reasonable basis for our findings and conclusions based on our audit  objectives. More details on our methodology can be found in our report.
Mr. Chairman, agencies must exercise diligence when using guidance.  Although guidance documents are not legally binding, they can affect the  actions of stakeholders and other interested parties, as well as agencies’  staffs, because guidance articulates agencies’ interpretations and policy  choices. The potential effects of these documents—and the risks of legal  challenges to agencies—underscore the need for consistent and well- understood processes for the development, review, dissemination, and  evaluation of guidance.
Our April 2015 report found that agencies and their components used  guidance for multiple purposes. Further, we also found that all four  departments identified standard practices to follow when developing  guidance. However, stronger application of internal controls would help  ensure that guidance processes achieve desired results and prevent  errors. Components primarily relied on websites to disseminate guidance,  but could do more to improve online access, such as making guidance  documents easier to find and ensuring that they are current. We  recommended that HHS and DOL ensure consistent application of OMB  requirements for guidance. We also recommended that USDA,  Education, HHS, and DOL strengthen the use of internal controls in  guidance production processes and improve online guidance  dissemination. All four agencies generally agreed with the  recommendations.
subsections: section_title: Regulatory Guidance Is a Tool for Agency Communication
paragraphs: One of the main purposes of guidance is to explain and help regulated  parties comply with agency regulations. As shown in figure 1, guidance  may explain how agencies plan to interpret regulations. Agencies  sometimes include disclaimers in their guidance to note that the  documents have no legally binding effect on regulated parties or the  agencies. Even though not legally binding, guidance documents can have  a significant effect on regulated entities and the public, both because of  agencies’ reliance on large volumes of guidance documents and because  the guidance can prompt changes in the behavior of regulated parties and  the general public. Nevertheless, defining guidance can be difficult. To  illustrate that difficulty, several of the components told us that they do not  consider many of the communication documents they issue to the public  to be guidance.
Regulations and guidance documents serve different purposes. The  Administrative Procedure Act (APA) established broadly applicable  requirements for informal rulemaking, also known as notice and comment  rulemaking. Among other things, the APA generally requires that  agencies publish a notice of proposed rulemaking in the Federal Register.  After giving the public an opportunity to comment on the proposed  regulation by providing “written data, views, or arguments,” and after  considering the public comments received, the agency may then publish  the final regulation. To balance the need for public input with competing  societal interests favoring the efficient and expeditious conduct of certain  government affairs, the APA exempts certain types of rules from the  notice and comment process, including “interpretative rules” (we will refer  to these as interpretive rules in this statement) and “general statements of  policy.” Regulations affect regulated entities by creating binding legal  obligations. Regulations are generally subject to judicial review by the  courts if, for example, a party believes that an agency did not follow  required rulemaking procedures or went beyond its statutory authority.
Despite the general distinctions between regulations and guidance  documents, legal scholars and federal courts have at times noted that it is  not always easy to determine whether an agency action should be issued  as a regulation subject to the APA’s notice and comment requirements, or  is guidance or a policy statement, and therefore exempt from these  requirements. Among the reasons agency guidance may be legally  challenged are procedural concerns that the agency inappropriately used  guidance rather than the rulemaking process or concerns that the agency  has issued guidance that goes beyond its authority. On March 9, 2015,  the Supreme Court held that an agency could make substantive changes  to an interpretive rule without going through notice and comment under  the APA. This decision overturned prior federal court rulings that had held  that an agency is precluded from substantively changing its interpretation  of a regulation through issuance of a new interpretive rule without notice  and comment. Other concerns raised about agency use of guidance  include consistency of the information being provided, currency of  guidance, and whether the documents are effectively communicated to  affected parties.
subsections: section_title: Departments Considered Few of Their Guidance Documents as Significant under OMB’s Definition
paragraphs: An OMB Bulletin establishes policies and procedures for the  development, issuance, and use of “significant” guidance documents.  OMB defines “significant guidance documents” as guidance with a broad  and substantial impact on regulated entities. Pursuant to a memorandum  issued by the Director of OMB in March 2009, OMB’s Office of  Information and Regulatory Affairs (OIRA) reviews some significant  guidance documents prior to issuance. All significant guidance  documents, whether reviewed by OIRA or not, are subject to the OMB  Bulletin. “Economically significant guidance documents” are also  published in the Federal Register to invite public comment. Non- significant guidance is not subject to the OMB Bulletin, and any  procedures for developing and disseminating it are left to agency  discretion.
Selected departments considered few of their guidance documents to be  significant as defined by OMB. For example, as of February 2015,  agencies listed the following numbers of significant guidance documents  on their websites: Education, 139; DOL, 36; and USDA, 34. We were  unable to determine the number of significant guidance documents issued  by HHS. In contrast, some of the agencies issued hundreds of non- significant guidance documents. All selected components told us that they  did not issue any economically significant guidance. OIRA staff told us  they accepted departments’ determinations of which types of guidance  meet the definition of significant guidance.
section_title: Agencies Issued a Wide Variety of Guidance Serving Multiple Purposes
subsections: section_title: Agencies Used Many Terms for Non-significant Guidance
paragraphs: The selected components we reviewed differed in both the terminology  they used for their external non-significant guidance documents and in  the amounts of non-significant guidance they issued. We found the  components used many names for these guidance documents—for  example, Education components’ guidance documents included FAQs  and “Dear Colleague” letters, while DOL components used varied terms  including bulletins, “Administrator Interpretations,” directives, fact sheets,  and policy letters.
The components issued varying amounts of guidance ranging from 10 to  more than 100 documents issued by a component in a single year.  Component officials said a component’s mission or the types of programs  it administers can affect the number of guidance documents issued.  Officials from DOL’s Bureau of Labor Statistics (BLS) told us their agency,  as a non-regulatory component, rarely issues guidance. They said BLS  has issued about 10 routine administrative memorandums each year  related to the operation of two cooperative agreement statistical  programs. In contrast, DOL Occupational Safety and Health  Administration (OSHA) officials told us they have regularly issued  guidance to assist with regulatory compliance, and could easily produce  100 new or updated products each year to provide guidance to  stakeholders. Although the DOL Office of Workers’ Compensation  Programs has regulatory authority, officials told us that they have not  frequently issued guidance because their authorizing statutes have not  changed recently and their programs focus on administering benefits.
section_title: Agencies Issued Non- significant Guidance Serving Multiple Purposes
paragraphs: Agencies have used guidance for multiple purposes, including explaining  or interpreting regulations, clarifying policies in response to questions or  compliance findings, disseminating suggested practices or leadership  priorities, and providing grant administration information.
subsections: section_title: Explain or Interpret New, Immediate, or Upcoming Regulations
paragraphs: Component officials told us they used guidance to summarize regulations  or explain ways for regulated entities to meet regulatory requirements.  For example, Education officials told us that they often follow their  regulations with guidance to restate the regulation in plainer language, to  summarize requirements, to suggest ways to comply with the new  regulation, or to offer best practices.
In a few cases, components used guidance to alert affected entities about  immediate statutory requirements or to anticipate upcoming requirements  to be promulgated through the rulemaking process. Education officials  told us they often used guidance to help their field office staff understand  and apply new statutory requirements. While this may provide timely  information about new or upcoming requirements, it may also cause  confusion as details are revised during the rulemaking process. Officials  from USDA’s Food and Nutrition Service (FNS) told us that when a new  statute becomes effective immediately and there is little ambiguity in how  the statute can be interpreted, they use a “staging process.” In this  process, they issue informational guidance so their stakeholders are  aware of and consistently understand new requirements before the more  time-consuming rulemaking process can be completed. Other officials  told us that in rare instances, they have issued guidance while a  proposed rule is out for comment. They noted that statutory deadlines for  implementation may require them to issue guidance before issuing a final  rule.
Component officials cited instances in which they used guidance to  provide information on upcoming requirements to be promulgated through  regulation to those affected. In one example, HHS’s Office of Child Care  within the Administration for Children and Families issued  recommendations to its grantees to foreshadow future binding  requirements. In that case, the office issued an Information Memorandum  in September 2011 recommending criminal background checks. It later  published a proposed rule in May 2013 to mandate the background  checks.
section_title: Clarify Policies in Response to Questions or Compliance Findings
paragraphs: Multiple component officials told us that they used guidance to clarify  policies in response to questions received from the field, or regional office  input about questions received from grantees or regulated entities.  Officials at Education’s Office for Civil Rights and OSHA told us that they  often initiated guidance in response to findings resulting from their  investigatory or monitoring efforts, among other things.
section_title: Distribute Information on Suggested Practices or Leadership Priorities
paragraphs: Component officials also told us that they used guidance to distribute  information on program suggestions (sometimes called best practices). In  particular, we heard this from component officials who administered  formula grants in which wide discretion is given to grantees, such as  states. Officials at Education’s Office of Postsecondary Education told us  that component leadership initiates guidance related to priorities the  administration wants to accomplish. One example they cited was a Dear  Colleague letter explaining that students confined or incarcerated in  locations such as juvenile justice facilities were eligible for federal Pell  grants.
section_title: Provide Guidance on Grant Administration
paragraphs: Components that administered grants also issued procedural guidance  related to grant administration. For example, BLS issued routine  administrative memorandums to remind state partners of federal grant  reporting requirements and closeout procedures. In other examples, DOL  provided guidance on how to apply and comply with Office of Disability  Employment Policy grants.
section_title: Agencies Weighed Various Factors When Choosing Whether to Issue a Regulation or Guidance
paragraphs: Officials considered a number of factors before deciding whether to issue  guidance or undertake rulemaking. Among these factors, a key criterion  was whether officials intended for the document to be binding (in which  case they issued a regulation). Officials from all components that issue  regulations told us that they understood when guidance was inappropriate  and when regulation was necessary and that they consulted with legal  counsel when deciding whether to initiate rulemaking or issue guidance.  According to DOL officials, new regulations may need to be issued if  components determined that current regulations could not reasonably be  interpreted to encompass the best course of action, a solution was not  case specific, or a problem was widespread. An Education official told us  that Education considered multiple factors, including the objective to be  achieved, when choosing between guidance and regulations. Similarly,  HHS’s Administration for Community Living officials told us that they  considered a number of factors, including whether the instructions to be  disseminated were enforceable or merely good practice. For example,  when Administration for Community Living officials noticed that states  were applying issued guidance related to technical assistance and  compliance for the state long-term care ombudsman program differently,  they decided it would be best to clarify program actions through a  regulation, as they could not compel the states to comply through  guidance. Officials believed that a regulation would ensure consistent  application of program requirements and allow them to enforce those  actions. They issued the proposed rule in June 2013 and the final rule in  February 2015.
FNS officials told us that the decision to issue guidance or undertake  rulemaking depended on (1) the extent to which the proposed document  was anticipated to affect stakeholders and the public, and (2) what the  component was trying to accomplish with the issued document. OIRA  staff concurred that agencies understood what types of direction to  regulated entities must go through the regulatory process.
section_title: Agencies Can Ensure More Effective Guidance Processes through Consistent Adherence with OMB Requirements and Stronger Internal Controls
subsections: section_title: Agencies Did Not Always Adhere to OMB Requirements for Significant Guidance
paragraphs: We found that agencies did not always adhere to OMB requirements for  significant guidance. The OMB Bulletin establishes standard elements  that must be included in significant guidance documents and directs  agencies to (1) develop written procedures for the approval of significant  guidance, (2) maintain a website to assist the public in locating significant  guidance documents, and (3) provide a means for the public to submit  comments on significant guidance through their websites. Education and  USDA had written procedures for the approval of significant guidance as  directed by OMB. While DOL had written approval procedures, they were  not available to the appropriate officials and DOL officials noted that they  required updating. HHS did not have any written procedures. We found  that Education, USDA, and DOL consistently applied OMB’s public  access and feedback requirements for significant guidance, while HHS  did not.
We made recommendations to HHS and DOL to better adhere to OMB’s  requirements for significant guidance. Both agencies concurred with  those recommendations. Without written procedures or wide knowledge  of procedures for the development of significant guidance, HHS and DOL  may be unable to ensure that their components consistently follow other  requirements of the OMB Bulletin and cannot ensure consistency in their  processes over time. Further, because agencies rely on their websites to  disseminate guidance, it is important that they generally follow  requirements and guidelines for online dissemination for significant  guidance.
section_title: Stronger Application of Internal Controls for Guidance Processes Could Achieve Desired Results and Prevent Errors
paragraphs: In the absence of government-wide standards for the production of non- significant guidance, officials must rely upon internal controls—which are  synonymous with management controls—to ensure that guidance  policies, processes, and practices achieve desired results and prevent  and detect errors. We selected four components of internal control and  applied them to agencies’ guidance processes (see appendix I).  Departments and components identified diverse and specific practices  that addressed these four components of internal control. However, the  departments and components typically had not documented their  processes for internal review of guidance documents. Further, agencies  did not consistently apply other components of internal control. Some of  the selected components identified practices to address these internal  controls that we believe could be more broadly applied by other agencies.  Wider adoption of these practices could better ensure that components  have internal controls in place to promote quality and consistency of their  guidance development processes.
To improve agencies’ guidance processes, we recommended that the  Secretaries of USDA, HHS, DOL, and Education strengthen their  components’ application of internal controls by adopting, as appropriate,  practices developed by other departments and components, such as  assessment of risk; written procedures and tools to promote the  consistent implementation and communication of management directives;  and ongoing monitoring efforts to ensure that guidance is being issued  appropriately and has the intended effect. USDA, Education, HHS, and  DOL generally agreed with the recommendations.
subsections: section_title: Determine Appropriate Level of Review to Manage Risk
paragraphs: Although no component can insulate itself completely from risks, it can  manage risk by involving management in decisions to initiate guidance,  prioritize among proposed guidance, and determine the appropriate level  of review prior to issuance. In addition, if leadership is not included in  discussions related to initiation of guidance, agencies risk expending  resources developing guidance that is unnecessary or inadvisable.
At a few components, officials told us that leadership (such as component  heads and department-level management) decided whether to initiate  certain guidance, and guidance did not originate from program staff for  these components. For example, guidance at DOL’s Employee Benefits  Security Administration related to legal, policy, and programmatic factors  were proposed by office directors and approved by Assistant Secretaries  and Deputy Assistant Secretaries. In most other cases, ideas for  additional guidance documents originated from program staff and field  offices or from leadership, depending on the nature of the guidance.
Education officials told us that component program staff and leadership  work together to identify issues to address in guidance.
At most components, officials told us that they determine the appropriate  level of review and final clearance of proposed guidance, and in many  cases guidance was reviewed at a higher level if the document was  anticipated to affect other offices or had a particular subject or scope.  Risk was one factor agency officials considered when determining the  anticipated appropriate level of review and final clearance of proposed  guidance. For example, officials at the Employee Benefits Security  Administration told us that the need for department-level clearance  depended on various factors, including likely congressional interest,  potential effects on areas regulated by other DOL components, expected  media coverage, and whether the guidance was likely to be seen as  controversial by constituent groups. A few agencies reported they  considered two other factors in making this decision: whether guidance  was related to a major priority or would be “impactful.”
section_title: Maintain Written Policies and Procedures for the Production of Non-significant Guidance
paragraphs: Control activities (such as written procedures) help ensure that actions  are taken to address risks and enforce management’s directives. Only 6  of the 25 components we reviewed had written procedures for the entire  guidance production process, and several of these components  highlighted benefits of these procedures for their guidance processes.  These components included HHS’s Administration for Children and  Families Office of Head Start and five DOL components. The DOL Mine  Safety and Health Administration’s written procedures contained  information officials described as essential to the effective and consistent  administration of the component’s programs and activities. OSHA officials  reported that their written procedures were designed to ensure that the  program director manages the process for a specific policy document by  considering feedback and obtaining appropriate concurrence to ensure  that guidance incorporates all comments and has been cleared by  appropriate officials. The Deputy Assistant Secretary resolves any  disagreements about substance, potential policy implications, or assigned  priority of the document.
In contrast, Education’s Office of Innovation and Improvement and Office  of Elementary and Secondary Education and DOL’s Veterans’  Employment and Training Service had written procedures only for the  review and clearance phase. Components without written procedures  said they relied on officials’ understanding of the guidance process. In  these cases, officials told us that the guidance process was well  understood by program staff or followed typical management hierarchies.
Officials from all components could describe standard review practices to  provide management the opportunity to comment and ensure that its  comments were addressed by program staff. Nonetheless, documented  procedures are an important internal control activity to help ensure that  officials understand how to adequately review guidance before issuance.
section_title: Ensure Communication during the Guidance Development and Review Process
paragraphs: Most selected components had guidance practices to ensure either intra- agency and interagency review (or both) of guidance documents before  issuance. Obtaining feedback from management, internal offices, the  public, and other interested parties is essential to ensuring guidance is  effective.
Intra-agency communications. To ensure that management  concurrence was recorded, most components we reviewed used  communication tools, such as electronic or hard-copy routing slips, to  document approval for guidance clearance or to communicate with  management and other offices about proposed or upcoming  guidance. In particular, officials at 20 components used a routing slip  to document management concurrence.
Interagency communications. Most component officials told us that  they conferred with other affected components or federal departments  to ensure consistency during the development of guidance.
External stakeholders. Officials told us that feedback from external  nonfederal stakeholders often served as the impetus for the initiation  of guidance, and more than half of the selected components cited  examples in which they conferred with external nonfederal  stakeholders during the guidance development process. At OSHA, for  example, external stakeholders were not involved in developing  directives or issuing policy, but assisted with developing educational,  non-policy guidance, such as hazard alerts.
section_title: Regularly Evaluate Whether Issued Guidance is Effective and Up to Date
paragraphs: Nearly half of the components we reviewed did not regularly evaluate  whether issued guidance was effective and up to date. Without a regular  review of issued guidance, components can miss the opportunity to revisit  whether current guidance could be improved and thereby provide better  assistance to grantees and regulated entities. DOL’s Office of Labor- Management Standards officials told us they had not evaluated the  relative success of existing guidance and therefore did not often revise  guidance.
A few selected components had initiated or established a process for  tracking and evaluating guidance to identify necessary revisions. For  example, in November 2011, officials at DOL’s Office of Federal Contract  Compliance Programs initiated a 2-year project to review their directives  system to ensure that they only posted up-to-date guidance. As a result of  the project, in 2012 and 2013 officials identified necessary updates to  guidance, clarified superseded guidance, and rescinded guidance where  appropriate. Officials told us that these actions reduced the original  number of directives by 85 percent. Officials also told us that they did this  to ensure that their guidance was more accurate and correct, and the  actions resulted in officials posting only relevant and current guidance  information on the component’s website. Officials told us they now  routinely monitor their directives about once a year and review other  guidance documents each time they issue new regulations or change a  policy to decide if they need to revise them. DOL’s Employment and  Training Administration used a checklist to review a list of active guidance  documents and identified whether to continue, cancel, or rescind the  guidance. In addition, officials indicated which documents were no longer  active on their website. Lastly, DOL’s Mine Safety and Health  Administration also ensured that program officials periodically reviewed  and updated guidance documents and canceled certain guidance.
Chairman Lankford, Ranking Member Heitkamp, and members of the  Subcommittee, this concludes my prepared remarks. I look forward to  answering any questions you may have.
section_title: GAO Contact and Staff Acknowledgments
paragraphs: For questions about this statement, please contact me at (202) 512-6806  or sagerm@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this  statement. Individuals making key contributions to this testimony were  Tim Bober, Assistant Director, Robert Gebhart, Shirley Hwang, Andrea  Levine, and Wesley Sholtes.
section_title: Appendix I: Application of Select Internal Control Standards to Agencies’ Guidance Processes
paragraphs: Component of Internal Control  Risk Assessment  Internal control should provide for an assessment of the  risks the agency faces from both external and internal  sources. Once risks have been identified, they should be  analyzed for their possible effects.
Application to Guidance Processes  Agencies should assess the level of risk associated with potential guidance  at the outset to determine  1.  the legal implications of the use of guidance based on available  criteria, and  the appropriate level of review.  2.  Some agencies have found it helpful to categorize proposed guidance at  initiation to determine different types and levels of review.
Control activities  Internal control activities help ensure that management’s  directives are executed. Control activities are the  policies, procedures, techniques, and mechanisms that  enforce management’s directives. They help ensure that  actions are taken to address risks. The control activities  should be effective and efficient in accomplishing the  agency’s control objectives.
The agency should maintain written policies, procedures, and processes to  ensure that once the appropriate level of review has been determined,  agency officials understand the process to adequately review guidance  prior to issuance. Written policies and procedures should designate:  1.  2. the appropriate level of review to maintain appropriate segregation of  duties, and   the means by which management can comment on the draft guidance  and program staff can address those comments.
Information and communication  Information should be recorded and communicated to  management and others within the entity who need it. In  addition to internal communications, management should  ensure there are adequate means of communicating  with, and obtaining information from, external  stakeholders who have a significant impact on the  agency achieving its goals.
Internal communications: Agencies should have procedures in place to get  feedback from management and other internal offices on guidance to be  issued. For example, they should have a written mechanism (such as a  routing slip) to document management review and associated comments  and suggestions.  External communications: Agencies should provide a means, via an e-mail  box or contact person, for the public and interested parties to comment on  the guidance, ask questions about the guidance, and facilitate two-way  feedback and communication.
Monitoring  Internal control should generally be designed to ensure  that ongoing monitoring occurs in the course of normal  operations.
Processes should be established to collect feedback on both the  substance and clarity of guidance, to communicate this feedback to the  appropriate officials, and to maintain applicable feedback to inform future  guidance and revisions of guidance.
section_title: Appendix II: Components Included in Our Review
paragraphs: Department  United States Department of Agriculture (USDA)
Department of Health and Human Services (HHS)
Administration for Children and Families’ Office of Child Care  Administration for Children and Families’ Office of Head Start  Bureau of International Labor Affairs  Mine Safety and Health Administration  Occupational Safety and Health Administration  Office of Disability Employment Policy  Office of Federal Contract Compliance Programs  Office of Workers’ Compensation Programs  Veterans Employment and Training Service  Women’s Bureau  This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.