Single Audits: Improvements Needed in Selected Agencies' Oversight of Federal Awards
Published: 2017-02-16T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In fiscal year 2015, federal agencies outlaid over $600 billion in federal awards to state and local governments, according to OMB. The Single Audit Act of 1984, as amended, requires that federal agencies oversee their awards to nonfederal entities. OMB Circular No. A-133 provided guidance for implementing the act during GAO's audit.
GAO was asked to examine federal agency oversight of single audits. This report examines whether selected agencies effectively designed policies and procedures to reasonably assure that (1) recipients submit timely single audit reports and (2) award recipients take action on single audit findings by issuing timely management decisions. GAO also examined whether selected agencies had policies and procedures for managing high-risk and recurring audit findings. GAO selected the five agencies with the largest dollar amounts of reported outlays for grants to state and local governments in fiscal year 2013. For each agency, GAO reviewed its two subagencies accounting for over 80 percent of outlays, reviewed written policies and procedures, and interviewed the respective officials.
section_title: What GAO Found
paragraphs: Federal agencies have oversight responsibilities for the funds that they award to nonfederal entities and can assign these responsibilities to their subagencies (i.e., operating units or divisions). Nonfederal entities are required to undergo a single audit if their expenditures of federal awards in a fiscal year exceed a certain threshold. A single audit is an audit of the award recipient's expenditure of federal awards and of its financial statements and can identify deficiencies in the award recipient's compliance with the provisions of laws, regulations, contracts, or grant agreements and in its financial management and internal control systems. Correcting such deficiencies can help reasonably assure the effective use of federal funds and reduce federal improper payments.
Of the five agencies in GAO's study—the Departments of Agriculture, Education, Health and Human Services (HHS), Housing and Urban Development (HUD), and Transportation—some of the agencies' subagencies that GAO reviewed did not effectively design policies and procedures to reasonably assure the timely submission of single audit reports by award recipients. The Office of Management and Budget's (OMB) guidance requires that federal awarding agencies ensure that award recipients submit single audit reports within certain time frames. This can help assure that single audit findings are timely corrected.
Most of the selected subagencies in GAO's review did not effectively design policies and procedures to reasonably assure that they issued timely management decisions containing the information required by OMB guidance. This guidance requires agencies to evaluate each award recipient's audit findings and corrective action plans and issue a management decision within 6 months of receipt of the single audit report as to the actions award recipients must take to correct each single audit finding. Such decisions may add clarity about the agency's position on the single audit finding and the corrective action.
Only the two selected subagencies in Education had policies and procedures for using risk-based approaches to manage high-risk and recurring single audit findings. High-risk single audit findings may be seriously detrimental to federal programs and could result in improper payments. Recurring single audit findings have persisted for more than one audit period and may need more attention or resources to correct. With over 30,000 single audit reports submitted for fiscal year 2015 and constraints in resources for conducting federal oversight, managing single audit findings using a risk-based approach can assist in identifying and prioritizing problem areas.
section_title: What GAO Recommends
paragraphs: GAO is making 21 recommendations. One Agriculture subagency agreed with the recommendations and the other did not comment. HHS and Transportation concurred. HUD commented that one subagency had taken actions to address the recommendations, while the other subagency disagreed with the recommendations directed to it. GAO believes that the recommendations are valid as discussed in the report.

section_title: Letter
paragraphs: Federal awards, which include grants, are important tools used by the  federal government to provide program funding to nonfederal entities,  including state and local governments, nonprofit organizations, and Indian  tribal organizations. Federal awards fund a wide range of programs and  activities across state and local governments, including those related to  social services, housing, education, transportation, health care, and man- made and natural disasters. According to the Office of Management and  Budget (OMB), outlays for federal awards to state and local governments  totaled over $600 billion in fiscal year 2015. Federal agencies have  oversight responsibilities under the Single Audit Act of 1984, as amended  (Single Audit Act), for the funds that they award to nonfederal entities.  Federal award recipients that expend $750,000 or more in federal awards  in a fiscal year are required to undergo a single audit, which is an audit of  an entity’s financial statements and federal awards, or a program-specific  audit, for the fiscal year.
The audits required by the Single Audit Act are critical to the federal  government’s ability to reasonably assure that federal funds are  safeguarded and used effectively. According to the U.S. Census Bureau,  as of July 2016, over 30,000 single audit reports were submitted for fiscal  year 2015. Single audits can identify deficiencies (audit findings) in the  award recipients’ material compliance with the provision of laws,  regulations, contracts, or grant agreements and in their financial  management and internal control systems. For example, some single  audits have found that materials used for roads and bridges were not  tested appropriately, doctors were paid billions of dollars for medical  services without adequate procedures to verify whether the services had  been performed, and unauthorized users had access to Medicaid  payment systems. Federal agencies are responsible for following up on  audit findings to provide reasonable assurance that award recipients take  timely and appropriate action to correct deficiencies identified through the  single audit process. Correcting such deficiencies can help reduce  federal improper payments.
The Single Audit Act directs OMB to prescribe guidance to implement the  act. Previously this guidance was in eight individual OMB circulars. In  December 2013, OMB superseded and streamlined this guidance to  federal agencies and award recipients by issuing the Uniform  Administrative Requirements, Cost Principles, and Audit Requirements  for Federal Awards (Uniform Guidance) in the Code of Federal  Regulations. OMB stated that the Uniform Guidance would improve the  integrity of the financial management and operation of federal programs  and strengthen accountability for federal dollars.
You asked us to review several aspects of federal agency oversight  related to the single audit process. This report addresses the extent to  which selected federal agencies (1) effectively designed policies and  procedures for reasonably assuring that award recipients submit single  audit reports in a timely manner, (2) effectively designed policies and  procedures for reviewing award recipients’ plans to correct single audit  findings and issuing written management decisions on those plans in a  timely manner, and (3) had policies and procedures for managing high- risk and recurring single audit findings with a risk-based approach.
This audit covers single audit reports and selected agencies’ and  subagencies’ policies and procedures related to single audits during the  award recipients’ fiscal year 2013. Fiscal year 2013 was selected to  allow time for award recipients to have submitted their single audit reports  and other required information to the Federal Audit Clearinghouse  (FAC)—the federal repository for single audit reporting packages—and  for federal awarding agencies to have conducted oversight of those single  audit reports.
Because grants proportionally represent one of the largest amounts of  federal awards, we used grant data from OMB’s Outlays for Grants to  State and Local Governments in fiscal year 2013 to select the agencies  and subagencies for our audit. We selected for our audit the five  agencies that had the largest dollar amount of reported outlays for grants  to state and local governments in fiscal year 2013. These five agencies— the Departments of Agriculture (Agriculture), Education (Education),  Housing and Urban Development (HUD), Transportation (Transportation),  and Health and Human Services (HHS)—collectively accounted for 93  percent of reported outlays of federal grants to state and local  governments in fiscal year 2013. For Agriculture, Education, HUD, and  Transportation, we selected subagencies that collectively outlaid over 90  percent of their respective agencies’ fiscal year 2013 total reported  outlays for grants to state and local governments. For HHS, we selected  the single largest subagency within HHS, which outlaid over 83 percent of  HHS’s fiscal year 2013 total reported outlays for grants to state and local  governments. We also selected HHS’s Audit Resolution Division, a  division within HHS’s Assistant Secretary of Financial Resources, which  has a key role in HHS’s single audit oversight process.
To accomplish our objectives, we used criteria from the Single Audit Act;  OMB Circular No. A-133, Audits of States, Local Governments, and Non- Profit Organizations; and Standards for Internal Control in the Federal  Government. To address our first objective, we reviewed the selected  agencies’ and subagencies’ written policies and procedures for those  areas and interviewed selected agency and subagency officials to clarify  our understanding of those policies and procedures. To address our  second objective, we reviewed the selected agencies’ and subagencies’  written policies and procedures for those areas and interviewed selected  agency and subagency officials to clarify our understanding of those  policies and procedures. We also randomly selected nongeneralizable  samples of single audit findings applicable to each selected subagency  that outlaid grants to state and local governments in fiscal year 2013. For  each sampled item, we requested and reviewed documentation, including  written management decisions. To address our third objective, we  reviewed the selected agencies’ and subagencies’ written policies and  procedures for those areas and interviewed selected agency and  subagency officials to clarify our understanding of those policies and  procedures. Further information on our scope and methodology is  provided in appendix I.
We conducted this performance audit from May 2015 to February 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient and appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: The Single Audit Act
paragraphs: The purposes of the Single Audit Act are to promote sound financial management, including effective internal  controls, with respect to federal awards administered by nonfederal  entities; promote the efficient and effective use of audit resources; and ensure that federal departments and agencies, to the maximum extent  practicable, rely upon and use single audit work.
For the audit period of this report, the Single Audit Act, as implemented  by OMB Circular No. A-133, requires nonfederal entities that expend  $500,000 or more in federal awards in a fiscal year to have either a single  audit or program-specific audit conducted. Federal awards include  grants, loans, loan guarantees, property, cooperative agreements,  interest subsidies, insurance, food commodities, direct appropriations,  other assistance, and federal cost-reimbursement contracts. A single  audit is an audit of both the entity’s financial statements and expenditures  of federal awards. The Single Audit Act mandates that federal agencies  assume oversight responsibility for the funds that they award to  nonfederal entities. OMB Circular No. A-133 requires that federal  awarding agencies ensure that award recipients complete and submit  single audit reports within the earlier of 30 days after the receipt of the  auditor’s report or 9 months of the award recipient’s fiscal year-end,  unless a longer period for audit is agreed to in advance by the cognizant  or oversight agency for audit. Moreover, OMB Circular No. A-133 directs  federal agencies to take appropriate action using sanctions in cases  where an award recipient is unable or unwilling to have an audit  conducted in accordance with the circular’s requirements. The sanctions  may include withholding a percentage of federal awards until the audit is  completed satisfactorily, withholding or disallowing overhead costs,  suspending federal awards until the audit is conducted, or terminating the  federal award.
OMB Circular No. A-133 also requires each award recipient to submit an  audit reporting package to the FAC for distribution to each federal agency  responsible for programs for which the audit report identifies a single  audit finding and for archival purposes. The reporting package is to  include (1) the award recipient’s financial statements and schedule of  expenditures of federal awards; (2) a summary schedule of prior audit findings, including the status of all single audit findings included in the  prior audit’s schedule of findings and questioned costs for federal  awards; (3) the auditor’s report (including an opinion on the award  recipient’s financial statements and schedule of expenditures of federal  awards, reports on internal control and compliance with laws, regulations,  and provisions of contracts or grant agreements, and a schedule of  findings and questioned costs); and (4) a corrective action plan.
In addition, OMB Circular No. A-133 requires federal awarding agencies  to review award recipients’ plans to correct single audit report findings  and issue a written management decision on those plans within 6 months  of receipt of the single audit report for each single audit finding. A  management decision entails the federal awarding agency or pass- through entity evaluating the single audit report findings and the award  recipient’s corrective action plan and issuing a written decision on  whether the federal awarding agency is satisfied with the corrective action  plan and, if not, what corrective action is necessary.
section_title: Example of the Time Frames for Single Audit Reports with Single Audit Findings
paragraphs: Federal award recipients are required to submit their single audit  reporting packages to the FAC within the shorter of 30 days after receipt  of the single audit report from the auditor or nine months after the end of  the award recipient’s fiscal year. Federal awarding agencies are to  ensure that each award recipient submits its single audit reporting  package to the FAC in accordance with these requirements. Under the  time frames provided by the Single Audit Act and OMB Circular No. A- 133, it may take up to 15 months for the award recipient to initiate  corrective action for single audit findings. For example, if the auditor’s  single audit report identifies a single audit finding for an entity that has a  June 30, 2013 fiscal year-end, the award recipient must submit the single  audit report along with its corrective action plan to the FAC, at the latest,  within 9 months of the fiscal year-end or no later than March 31, 2014.  The federal awarding agency would then have 6 months or until  September 30, 2014, from receipt of the single audit report to  communicate a written management decision to the award recipient, and  the award recipient is to initiate corrective action. Issuance of a timely  management decision is critical because OMB Circular No. A-133 allows  award recipients to consider a single audit finding as no longer valid and  to take no further action if all the following have occurred: a management decision was not issued,
2 years have passed since the audit report that contained the single  audit finding was submitted to the FAC, and  the federal agency or pass-through entity is not currently following up  with the award recipient on the single audit finding.
In some cases, action to correct the single audit finding is not started until  the award recipient receives the management decision. As a result, it may  take up to 15 months after the end of the fiscal year in which the single  audit finding was initially identified before corrective action has begun.  Award recipients report their progress in a schedule of prior single audit  findings where the status of the single audit finding is reported as either  corrected (closed), partially corrected, or not corrected (open). The  auditor then reviews this schedule and includes it in the next single audit  report. When the awarding agency delays issuing a management  decision to the award recipient, initiation of corrective action may also be  delayed. As a result, the single audit finding may remain open. Figure 1  provides an illustrative timeline for single audit reports with single audit  findings.
section_title: Uniform Guidance
paragraphs: In December 2013, OMB issued the Uniform Guidance to supersede and  streamline existing requirements for federal awards. The Uniform  Guidance required federal agencies to update their regulations and  policies for federal awards. Portions of the Uniform Guidance are aimed  at strengthening federal agency oversight of single audits. The Uniform  Guidance required that federal agencies implement the policies and  procedures applicable to federal awards by issuing a regulation to be  effective by December 26, 2014, unless different provisions are required  by statute or approved by OMB. On December 19, 2014, OMB and all  federal award-making agencies issued a joint interim final rule to  implement the Uniform Guidance, fulfilling the requirement contained in  the Uniform Guidance. We previously reported that all federal grant- awarding agencies issued regulations implementing this guidance.
section_title: Five Selected Subagencies Did Not Effectively Design Policies and Procedures to Reasonably Assure That Award Recipients Submit Timely Single Audit Reports
paragraphs: Both selected subagencies in Agriculture and HHS and a selected  subagency in Transportation (the Federal Transit Administration) did not  effectively design policies and procedures to reasonably assure that  award recipients submitted their single audit reports within the time  frames required by OMB Circular No. A-133. In addition, both selected  subagencies in Education and HUD and the other selected subagency in  Transportation (the Federal Highway Administration) effectively designed  policies and procedures to reflect that requirement. OMB Circular No. A- 133 requires that federal awarding agencies ensure that award recipients  submit single audit reports within the shorter of 30 days after receipt of  the report from the auditor or 9 months of the award recipient’s fiscal  year-end unless a longer period is agreed to in advance by the cognizant  or oversight agency for audit.
Standards for Internal Control in the Federal Government provides the  overall framework for establishing and maintaining internal control and  states that control activities should be effective and efficient in  accomplishing the agency’s control objectives. The standards further  state that management should clearly document internal control in a  manner that allows the documentation to be readily available for  examination. The five components of internal control are as follows:
Control Environment: Management and employees should establish  and maintain an environment throughout the organization that sets a  positive and supportive attitude toward internal control and  conscientious management.
Risk Assessment: Internal control should provide for an assessment  of the risks the agency faces from both external and internal sources.
Control Activities: Internal control activities help ensure that  management’s directives are carried out. The control activities should  be effective and efficient in accomplishing the agency’s control  objectives.
Information and Communications: Information should be recorded and  communicated to management and others within the entity who need  it and in a form and within a time frame that enables them to carry out  their internal control and other responsibilities.
Monitoring: Internal control monitoring should assess the quality of  performance over time and ensure that the findings of audits and  other reviews are promptly resolved.
To implement the internal control standards, each agency and subagency  is to develop detailed policies and procedures (control activities) to  execute its responsibilities under OMB Circular No. A-133. Without  effectively designed policies and procedures for determining whether  single audit reports have been submitted timely by award recipients,  agencies are hampered in their ability to take timely and effective action  to reasonably assure that award recipients correct all single audit  findings. Effective federal agency oversight would help to reasonably  assure effective program operations and minimize improper payments.
We identified four key steps relating to the design of single audit policies  and procedures that would assist federal awarding agencies in fulfilling  their responsibilities under OMB Circular No. A-133 for reasonably  assuring that award recipients submit single audit reports timely. To that  end, designing policies, procedures, and mechanisms that include the  following steps would help provide reasonable assurance that agencies  can fulfill these responsibilities:  identify award recipients that should have submitted single audit  reports,  verify that the award recipients submitted single audit reports, determine whether the single audit reports were submitted within the  required time frames, and  take action to obtain the single audit reports when award recipients  did not submit the reports within the required time frames.
Figure 2 provides an overview of our assessment of the selected  subagencies’ design of policies and procedures relating to the award  recipients’ timeliness of single audit report submission for fiscal year  2013.
subsections: section_title: Department of Agriculture
paragraphs: Agriculture’s two selected subagencies, Food and Nutrition Service (FNS)  and Rural Development (RD), did not effectively design policies and  procedures to reasonably assure that award recipients submitted their  single audit reports timely. Agriculture’s approach for single audit  oversight is decentralized, and the Office of the Chief Financial Officer  (OCFO) is responsible for providing departmental policy to the  subagencies. Agriculture’s subagencies, such as FNS, are responsible for  obtaining single audit reports and resolving single audit findings.
subsections: section_title: Food and Nutrition Service
paragraphs: FNS did not effectively design policies and procedures to reasonably  assure that award recipients submitted single audit reports timely. FNS  had policies and procedures that reference OMB Circular No. A-133  single audit guidance, but these policies and procedures were not  effectively designed to  identify award recipients that should have submitted single audit  reports,  verify that the award recipients that were required to submit single  audit reports actually submitted the reports, determine whether the single audit reports were submitted within the  required time frames, and  take action to obtain the single audit reports when award recipients  did not submit the reports within the required time frames.
According to FNS’s policies and procedures included in the FNS Audit  Manual, the Agriculture OCFO receives a copy of single audit reports with  findings related to Agriculture’s programs. If the OCFO determines that  the single audit reports include award recipients that have received  awards from FNS, the OCFO forwards those single audit reports to FNS.  In addition, FNS’s policies and procedures state that the regional offices  should periodically check the FAC database to determine if single audit  reports have been submitted. Specifically, according to FNS officials, the  single audit liaison checks the FAC for single audit reports and notifies  the regional offices that single audits are available for download from the  FAC. While these policies and procedures allow FNS to identify the  award recipients that have submitted single audit reports, including the  date when each single audit report was submitted, the policies and  procedures do not allow FNS to reasonably assure that award recipients  that have not submitted their single audit reports do so by the required  due dates. An FNS official stated that the agency does not maintain a list  of award recipients that should have submitted single audit reports to the  FAC but did not. In addition, the FNS official stated that its award  recipients are primarily state agencies and that FNS receives a statewide  single audit report once annual statewide audits are completed. As a  result, according to an FNS official, FNS would be aware when a state  has not submitted its single audit report. FNS also makes awards to  Indian tribal organizations. We reviewed data in the FAC database and  found that 110 Indian tribal organizations received over $500,000 in  federal awards from FNS and that all of them had submitted single audit  reports for their 2013 fiscal year-end. With award recipients from up to 50  states and numerous Indian tribal organizations, it is unclear how FNS  officials would reasonably assure that award recipients have submitted  each single audit report in the time frame required without a tracking  system or list that identifies the award recipients, the fiscal year-end for  each, and required due dates for single audit report submission. Thus,  FNS’s policies and procedures were not effectively designed to identify  award recipients that should have submitted single audit reports, verify  that the award recipients that were required to submit single audit report  actually submitted them, determine whether the award recipients that  were required to submit single audit reports did so within the required  time frames, and take action to obtain single audit reports when award  recipients did not submit the single audit reports within the required time  frames.
A FNS official stated that it is the award recipient’s responsibility to  ensure that it files a single audit report not FNS’s responsibility. However,  OMB Circular No. A-133 requires award recipients to ensure that the  audits are performed and submitted when due and federal awarding  agencies to ensure that single audit reports are received timely. An  Agriculture official acknowledged that independently verifying if single  audit reports are missing from the FAC database would be a major  challenge for the subagencies because of their reliance on award  recipients to self-report. Nonetheless, OMB Circular No. A-133 requires  that federal awarding agencies ensure that award recipients complete  and submit single audit reports within the required time frames.
section_title: Rural Development
paragraphs: RD did not effectively design policies and procedures to reasonably  assure that award recipients submitted single audit reports timely. RD had  policies and procedures that made reference to OMB Circular No. A-133;  however, we found that RD’s policies and procedures were not effectively  designed to  identify award recipients that should have submitted single audit  reports,  verify that the award recipients that were required to submit single  audit reports actually submitted the reports, determine whether the award recipients that were required to submit  single audit reports submitted the reports within the required time  frames, and  take action to obtain single audit reports when award recipients did  not submit the reports within the required time frames.
RD’s policies and procedures included in its Financial Management OMB  Circular A-133 Standard Operating Procedures call for RD to run queries  on information stored in the FAC database to determine which single  audit reports have been submitted; however, it did not contain policies  and procedures for identifying the award recipients that met the threshold  and were required to submit single audit reports. An RD official stated that  RD is aware of the dollar amount of funds that it provides to award  recipients and whether those funds met the threshold. Officials in RD’s  Financial Management Division reported that one of RD’s program  divisions relies on award recipients to undergo single audits and submit  the single audit reports to the FAC when total expenditures of federal  awards exceed the threshold. However, similar to FNS, while these  policies and procedures allow RD to identify award recipients that have  submitted single audit reports, they do not reasonably assure that RD  identifies award recipients that should have submitted single audit reports  by the required due dates but did not. An Agriculture official  acknowledged that independently verifying that single audit reports are  missing from the FAC would be a major challenge for the subagencies  because they rely on the award recipients to self-report. Nonetheless,  OMB Circular No. A-133 requires that federal awarding agencies ensure  that award recipients complete and submit single audit reports within the  required time frames.
section_title: Department of Education
paragraphs: Education effectively designed policies and procedures to reasonably  assure that award recipients completed and submitted single audit reports  timely. Education has a centralized organizational structure for  overseeing single audits. As a result, the policies and procedures  designed to reasonably assure that award recipients submitted single  audit reports on time at the two selected subagencies—the Office of  Elementary and Secondary Education (OESE) and the Office of Special  Education and Rehabilitative Services (OSERS)—are the same.
Education’s Post Audit Group (PAG) under the OCFO has department- wide policies and procedures for single audit oversight and audit  resolution. PAG has effectively designed policies and procedures to  identify and follow up on single audit reports that have not been submitted  to the FAC within the required time frames. PAG also processes and  distributes single audit reports to Education’s principal offices for  resolution.
Education’s Office of the Chief Financial Officer Guidance Memorandum  calls for PAG to take steps to help program offices identify award  recipients that have not submitted their single audit reports in a timely  manner. The guidance memorandum requires that in September of each  fiscal year, Education’s Risk Management Service prepares a list of all of  Education’s award recipients that have expended funds over the  threshold dollar amount in a prior year. The guidance memorandum  requires the Risk Management Service to compare the list of award  recipients against the FAC database to determine if audit reports were  completed and submitted to the FAC in 9 months. According to its policies  and procedures, the Risk Management Service is to then create a list of  award recipients that did not submit the required single audit reports and  send the list to PAG to identify the award recipients that are to be notified.
PAG’s procedures then call for PAG to send a notification letter  requesting that the award recipient submit the required single audit report  or provide information as to why it did not submit the report or is not  required to do so. If there is no response or no single audit report is  provided within 30 business days, in accordance with PAG’s procedures,  PAG is to send a second letter to the award recipient. If the award  recipient still fails to respond by submitting the single audit report or  explaining why it is not required to do so, PAG’s procedures call for  program offices to make decisions about follow-up action. These actions  may include  imposing special conditions that direct the award recipient to submit a  single audit report by a certain date or its plan to obtain an audit by a  certain date, declaring an award recipient as “high risk” and imposing special  conditions that place the recipient on a cost-reimbursement payment  basis until it submits a single audit report or provides a plan for  obtaining an audit, or withholding funds from the award recipient.
In addition, audit follow-up reflects a key component of Education’s risk  management strategy in the U.S. Department of Education Strategic Plan  for Fiscal Years 2014 – 2018. According to Education’s OCFO officials,  Education performed these procedures annually in fiscal year 2013 but  began performing them quarterly at the time of our audit.
section_title: Department of Health and Human Services
paragraphs: HHS’s two selected subagencies, Audit Resolution Division (ARD) and  the Centers for Medicare and Medicaid Services (CMS), did not  effectively design policies and procedures to reasonably assure that  award recipients submitted single audit reports timely. HHS has a  decentralized approach in which the Office of the Assistant Secretary for  Financial Resources sets policy for single audit oversight, which is carried  out by ARD, HHS’s operating divisions (such as CMS), and the Office of  Inspector General (OIG). While ARD has a key role in HHS’s single  audit oversight process, it does not award federal funds to nonfederal  entities.
subsections: section_title: Audit Resolution Division
paragraphs: ARD did not effectively design policies and procedures to reasonably  assure that award recipients submitted single audit reports timely. ARD  had detailed policies and procedures for conducting single audit  oversight; however, ARD’s policies and procedures were not effectively  designed to  identify award recipients that should have submitted single audit  reports,  verify that the award recipients that were required to submit single  audit reports actually submitted the reports, and determine whether the award recipients that were required to submit  single audit reports submitted the reports within the required time  frames.
Based on a review of ARD’s policies and procedures, we determined that  ARD is not responsible for taking action to obtain single audit reports  when award recipients did not submit the single audit reports within the  required time frames, as shown in figure 2. ARD is to provide each HHS  operating division with a list of the award recipients that are potentially  delinquent in submitting single audit reports to the FAC. Each operating  division is responsible for following up with its award recipients and  updating ARD quarterly on the status of the potentially delinquent single  audit reports.
ARD did not effectively design policies and procedures to identify award  recipients that should have submitted single audit reports. ARD’s policies  and procedures include the Audit Resolution Division Manual (ARD  Manual) and the 2011 Annual Delinquent Audit Process Detailed  Instructions. These documents outline ARD’s responsibility for annually  performing a delinquent audit review to identify award recipients that  should have submitted single audit reports as required by OMB Circular  No. A-133 but did not. However, these policies and procedures do not  reasonably assure that the delinquent audit review is performed annually.  We found that as of May 2016, ARD had not performed the fiscal year  2013 delinquent audit review. In addition, ARD had not updated the 2011  Annual Delinquent Audit Process Detailed Instructions for the fiscal year  2013 delinquent audit review.
In May 2016, an ARD official stated that the reason the delinquent audit  review for fiscal year 2013 had not been completed was that ARD found  errors with the information for identifying award recipients that received  over $500,000 in federal awards during fiscal year 2013.The ARD Manual  states the Program Support Center is to query the Payment Management  System to identify award recipients who received $500,000 or more in  federal awards and compare the results of the query against the FAC to  verify whether award recipients submitted single audit reports. However,  the ARD Manual did not contain a requirement to ensure that the query  was complete and accurate. As a result, when the query was run, the list  that identified award recipients for fiscal year 2013 that received $500,000  or more in federal awards did not include CMS award recipients— because the query contained CMS’s prior name, the Health Care  Financing Administration, according to an ARD official. CMS awarded the  largest dollar amount of HHS’s reported grant outlays to states and local  governments for fiscal year 2013. Once ARD noticed that the data were  inaccurate, ARD worked with the Program Support Center to change the  query to include CMS’s name in future queries. An HHS official stated  that the policies and procedures to incorporate changes related to the  query had not been updated as of May 2016 and that HHS was working  on revising the policies and procedures in this area. However, it is unclear  whether the revised policies and procedures relating to single audits  would be effectively designed to address our audit finding. In addition, the  ARD Manual did not contain policies and procedures for determining  whether the award recipients that were required to submit single audit  reports submitted the reports within the required time frames. Thus,  ARD’s policies and procedures were not effectively designed to identify  award recipients that should have submitted single audit reports, verify  that the award recipients that were required to submit single audit reports  actually submitted the reports, and determine whether the award  recipients that were required to submit single audit reports did so within  the required time frames.
section_title: Centers for Medicare and Medicaid Services
paragraphs: CMS did not effectively design policies and procedures to reasonably  assure that it takes action when award recipients did not submit single  audit reports within the required time frames. We found that ARD is  responsible for identifying award recipients for each HHS operating  division that should have submitted single audit reports, verifying that the  award recipients that were required to submit single audit reports actually  submitted the reports, and determining whether the award recipients that  were required to submit single audit reports did so in a timely manner. As  a result, we did not assess the design of CMS’s policies and procedures  for those activities, as shown in figure 2.
We found that CMS’s policies and procedures for single audit oversight  consisted of older manuals. Specifically, the policies and procedures that  CMS officials provided consisted of documents such as the Grants  Administration Manual and the 1982 Health Care Financing  Administration Audit Resolution Manual—both of which were issued  before the 1984 enactment of the Single Audit Act. Accordingly, the  manuals do not reflect requirements related to the Single Audit Act, OMB  Circular No. A-133, or HHS’s Grants Policy Directive 4.01. CMS officials  acknowledged that their policies and procedures in this area were old. In  addition, HHS officials acknowledged that one of the most significant  challenges with single audit oversight has been the lack of  standardization among the operating divisions’ policies and procedures.  In May 2016, during our audit, HHS officials stated that they were working  on updating single audit policies and procedures. However, it is unclear  whether the updated single audit policies and procedures would address  the specific findings related to CMS’s policies and procedures that we  identified during our audit.
section_title: Department of Housing and Urban Development
paragraphs: HUD’s two selected subagencies, the Office of Community Development  and Planning (CPD) and the Office of Public and Indian Housing (PIH),  effectively designed policies and procedures to reasonably assure that  award recipients completed and submitted single audit reports timely.  HUD’s single audit oversight process is decentralized and HUD’s OCFO  provides general departmental policies and procedures to the  department’s program offices, such as CPD and PIH. HUD has policies  and procedures that describe responsibilities of and processes for  program offices in reviewing single audit reports. Each HUD program  office is responsible for ensuring that award recipients submit single audit  reports according to the time frames outlined in OMB Circular No. A-133.
subsections: section_title: Office of Community Planning and Development
paragraphs: CPD effectively designed policies and procedures to reasonably assure  that award recipients completed and submitted single audit reports timely.  According to CPD’s Clarifying Guidance to CPD Field Offices on Single  Audit Act Requirements, field offices are expected to maintain a list of  award recipients. CPD’s policies and procedures call for each field office  to use its list to identify award recipients that are required to submit single  audit reports based on the $500,000 expenditure threshold and to  compare the list to the FAC database to determine if single audit reports  have been completed and submitted within the required time frame.  According to CPD’s guidance, if an audit has not been submitted, the field  office is required to follow up in writing with the award recipient to  determine the date of anticipated audit completion and submission of the  needed information to the FAC database. CPD provided an example of a  tracking log from fiscal year 2013 that it used to document missing audit  reports, including the dates that it contacted award recipients of missing  reports.
section_title: Office of Public and Indian Housing
paragraphs: PIH effectively designed policies and procedures to reasonably assure  that award recipients completed and submitted single audit reports timely.  PIH developed standard operating procedures for the field offices to help  ensure that single audit reports are submitted. These procedures  include (1) monitoring the PIH Real Estate Assessment Center’s (REAC)  website, which is designed to allow award recipients to provide their  financial statements to PIH prior to submission deadlines, and  determining if the expenditures exceeded the single audit threshold;   (2) contacting the award recipients to help ensure that single audit reports  are submitted; and (3) checking the FAC to determine whether the  required reports have been submitted. The REAC established a system  wherein award recipients electronically submit information such as  financial statements, audit reports, and audit findings into a data  warehouse. In addition, PIH’s IPA Assessment Review states that PIH is  to perform on-site reviews of the field offices’ internal controls over single  audits and provide a checklist for these on-site reviews. PIH’s IPA  Assessment Review included steps for reviewing the field offices’ internal  controls (tracking logs) for ensuring submission of single audit reports.
section_title: Department of Transportation
paragraphs: One of Transportation’s two selected subagencies, the Federal Highway  Administration (FHWA), effectively designed policies and procedures to  reasonably assure that award recipients completed and submitted single  audit reports timely. However, the other selected subagency at  Transportation, the Federal Transit Administration (FTA), did not  effectively design policies and procedures to reasonably assure that  award recipients completed and submitted single audit reports timely.  Transportation’s single audit oversight process is decentralized, with  oversight responsibilities divided between the Assistant Secretary for  Administration; the OIG; and each operating authority, such as FHWA  and FTA. Transportation’s Assistant Secretary for Administration is  responsible for issuing guidance, including guidance related to single  audits. Each operating authority is responsible for ensuring that award  recipients submit single audit reports according to the time frames  outlined in OMB Circular No. A-133 and Transportation’s department- wide guidance.
subsections: section_title: Federal Highway Administration
paragraphs: FHWA effectively designed policies and procedures to reasonably assure  that award recipients completed and submitted single audit reports timely.  Transportation’s Office of the Senior Procurement Executive’s Financial  Assistance Guidance Manual states that each operating authority, such  as FHWA, is responsible for ensuring that award recipients undergo  single audits and distribute the audit reports timely. The guidance manual  also requires each operating authority to maintain tracking mechanisms  for recording the receipt of audit reports. In addition, FHWA’s Financial  Integrity Review and Evaluation (FIRE) Program Tool Kit (FIRE Tool Kit)  states that FHWA officials are to determine when an audit report is due  and use the FAC to ensure that the audit has been submitted. The FIRE  Tool Kit includes a list of the states and their respective single audit  reporting due dates. If an award recipient does not submit its single audit  report by the due date, the guidance manual outlines the sanctions that  can be taken until the report is received.
section_title: Federal Transit Administration
paragraphs: FTA did not effectively design policies and procedures to reasonably  assure that award recipients submitted single audit reports timely. FTA  had policies and procedures that reference OMB Circular No. A-133  single audit guidance, but these policies and procedures were not  effectively designed to  identify award recipients that should have submitted single audit  reports,  verify that the award recipients that were required to submit single  audit reports actually submitted the reports, determine whether the award recipients that were required to submit  single audit reports submitted the reports within the required time  frame, and  take action to obtain single audit reports when award recipients did  not submit the reports within the required time frame.
FTA’s Grants A to Z Standard Operating Procedures states that each  FTA regional office is responsible for ensuring that single audit reports  are submitted timely and for identifying award recipients that are required  to submit single audit reports, either through the review of the FAC  database or by requesting report copies directly from award recipients.  FTA regional offices are also required to follow up in writing with award  recipients that have not provided single audit reports as required. While  FTA’s policies and procedures allow it to ascertain which award recipients  have submitted single audit reports and the dates of submission, the  standard operating procedures document does not provide procedures on  how regional offices should identify and track award recipients that should  have submitted single audit reports by the required due dates but did not.  According to an FTA official, FTA provides (1) additional guidance to its  regional offices by holding bimonthly single audit training and guidance  teleconferences and (2) customer support on a one-on-one basis when  requested. Transportation officials acknowledged that single audits are  important and that there are a number of opportunities to improve the  department’s oversight.
section_title: Most of the Selected Subagencies Did Not Effectively Design Policies and Procedures to Reasonably Assure Timely Issuance of Written Management Decisions with the Required Content
paragraphs: The selected subagencies in Agriculture, HHS, HUD, and Transportation  did not effectively design policies and procedures to reasonably assure  that management decisions were prepared with the required content and  issued within 6 months of receipt of the single audit report for each single  audit finding, as required by OMB Circular No. A-133. Both of the  selected subagencies in Education effectively designed policies and  procedures to reasonably assure that management decisions were  prepared with the required content and issued within 6 months of receipt  of the single audit report for each single audit finding.
OMB Circular No. A-133 requires federal agencies to issue written  management decisions on each of the single audit findings that clearly  state whether the agency sustains the audit finding,  the reasons for the decision,  the expected award recipient action to repay disallowed costs and  make financial adjustments or take other action, a timetable for follow-up if the award recipient has not completed  corrective action,  the appeals process available to the award recipient on the federal  awarding agency’s management decision, and  the reference numbers the auditor assigned to each single audit  finding.
OMB Circular No. A-133 also requires the management decision to be  issued within 6 months of receipt of a recipient’s single audit report. To  reasonably ensure that award recipients take action to correct single audit  findings, management decisions are to describe the corrective actions  that federal agencies consider necessary based on their evaluation of the  single audit findings and the award recipient’s plan to correct the single  audit findings, according to OMB Circular No. A-133. Since federal  agencies are responsible for ensuring that the award recipients take  appropriate and timely corrective action, it is important for agency  management to clearly communicate the agency’s expectations and time  frames for action through management decisions. Management decision  letters provide award recipients with written notification of the agency’s  position. Without timely notification that contains all of the OMB  requirements for written management decisions, award recipients may be  unclear about the agency’s position on the single audit findings and what  corrective actions, if any, they need to take to address the single audit  findings. In turn, single audit findings may not be corrected, thus  hampering oversight of federal awards.
Figure 3 provides an overview of our assessment of the design of  selected subagencies’ policies and procedures to reasonably assure that  management decisions met the requirements in OMB Circular No. A-133  and were issued timely.
subsections: section_title: Department of Agriculture
paragraphs: Agriculture’s two selected subagencies, FNS and RD, did not effectively  design policies and procedures to reasonably assure that they prepared  management decisions with the required content for each single audit  finding and issued such management decisions within 6 months of receipt  of the single audit reports, as required by OMB Circular No. A-133.  Agriculture’s single audit oversight is decentralized, and the OCFO is  responsible for providing departmental policy to the subagencies. Each  subagency is responsible for issuing management decisions.
subsections: section_title: Food and Nutrition Service
paragraphs: FNS did not effectively design policies and procedures to reasonably  assure that it prepared management decisions with the required content  for each single audit finding and issued such management decisions  within 6 months of receipt of the single audit reports, as required by OMB  Circular No. A-133. The FNS Audit Manual requires regional offices to   (1) evaluate single audit findings and the award recipients’ plans to  correct single audit findings, (2) develop and communicate written  management decisions on award recipients’ corrective action plans, and  (3) issue management decisions within 6 months of receipt of the single  audit reports. However, the audit manual does not require management  decisions to include all of the criteria for the content of written  management decisions identified in OMB Circular No. A-133, such as  clearly stating whether a single audit finding is sustained, the reason for  the management decision, and a description of the appeals process  available to the award recipient on the federal agency’s decision.
FNS has policies and procedures for issuing a management decision  within 6 months after a single audit report is received; however, the  policies and procedures were not effectively designed to reasonably  assure that the management decisions are issued as required.  Specifically, FNS’s policies and procedures describe its Automated  Tracking System, where FNS personnel enter single audit report tracking  information, such as open and closed audits, disallowed costs, and the  dates management decisions were issued. The Automated Tracking  System generates a report that identifies audit reports for which  management decisions have not been issued more than 120 days (about  4 months) after issuance of the audit report. However, the FNS Audit  Manual does not require policies and procedures to reasonably assure  that action is taken on the information in the Automated Tracking System  so that management decisions are issued within 6 months of receipt of  the audit reports.
An FNS official stated that other than its audit manual, FNS has not  provided the regional offices with additional guidance about management  decisions. The official also stated that single audit reports are not very  helpful to FNS because while some of these reports are very  comprehensive, the single audit findings are typically general in nature  and very rarely specifically address FNS programs. According to an FNS  official, the regional offices are expected to resolve FNS-specific single  audit findings. However, according to FNS officials, there is no standard  procedure for how the regional offices are to contact the states to resolve  the issues.
An FNS official stated that the regional offices conduct Management  Evaluations and Financial Management Reviews of award recipients.  These reviews provide periodic assessments to help ensure that award  recipients operate audit management programs that ensure compliance  with applicable federal requirements. The FNS official further stated that  FNS finds these assessment tools to be more useful to them for oversight  purposes than single audit reports because they help FNS to identify  specific programs that may need additional oversight. FNS officials also  stated that single audits have not been the top priority for FNS because  the quality and usefulness of the single audit reports are inconsistent, and  therefore these reports are not beneficial oversight tools. However, the  Single Audit Act requires federal awarding agencies to use single audits  to conduct oversight of the federal funds that they award and provides for  single audits to play a key role in achieving federal accountability  objectives and ensuring that funds are used for authorized purposes and  that risks of fraud, waste, and abuse are mitigated.
Without effectively designed policies and procedures for issuing  management decisions related to single audit findings, FNS cannot  reasonably assure the management decisions are issued timely and  contain all of the required elements. For example, we reviewed a  nongeneralizable sample of 16 FNS single audit findings and found that  FNS issued management decision letters for 3 of the 16 single audit  findings and that none of the letters contained all of the required elements  listed in OMB Circular No. A-133 or were issued within 6 months of  receipt of the single audit reports. The 3 management decisions were  issued within 8 to 11 months of receipt of the single audit reports.
section_title: Rural Development
paragraphs: RD did not effectively design policies and procedures to reasonably  assure that it prepared management decisions with the required content  for each single audit finding and issued such management decisions  within 6 months of receipt of the single audit reports, as required by OMB  Circular No. A-133. RD had policies and procedures in its Instruction A- 2012 Manual that call for its regional offices to (1) evaluate single audit  findings and the award recipients’ plans to correct single audit findings  and (2) develop and communicate written management decisions on the  award recipients’ corrective action plans. In addition, RD’s Financial  Management OMB A-133 Standard Operating Procedures also describe  its Automated Reports Tracking System, where RD personnel enter  single audit report information for tracking, such as the single audit report  number, audit finding code, action the auditee will take to correct the  single audit findings, and the management decision date as defined by  RD. However, its policies and procedures did not require all of the content  listed in OMB Circular No. A-133 for management decisions, including  whether the single audit finding was sustained, the reasons for the  decision, a description of the appeals process available to the award  recipient on the federal agency’s decision, and the reference numbers the  auditor assigns to each single audit finding. In addition, the policies and  procedures do not include a requirement that management decisions are  to be issued within 6 months after the single audit reports are received.
Officials in RD’s Financial Management Division said that the state offices  are in contact with the award recipients periodically, but do not usually  send management decision letters to award recipients. In addition, RD’s  policies and procedures use a different definition for management  decisions than stated in OMB Circular No. A-133. RD’s policies and  procedures state that RD provides a transmittal letter to the responsible  party and that the responsible party is to provide all necessary  documentation that verifies that corrective actions have been taken to  address the auditor’s findings. RD’s policies and procedures describe the  management decision date as the date that the award recipient responds  to RD’s transmittal letter. OMB Circular No. A-133, however, provides that  a management decision is the evaluation by the federal awarding agency  of the single audit finding and corrective action plan and the issuance of a  written decision as to what corrective action is necessary, and also states  that the entity responsible for issuing a management decision shall do so within 6 months of receipt of the single audit report. We reviewed  supporting documentation for a nongeneralizable sample of 12 single  audit findings and found that RD issued transmittal letters for all 12 of the  single audit findings. However, these transmittal letters did not provide  evaluations of the single audit findings and corrective action plans and  written decisions as to what corrective actions are necessary, as required  by OMB Circular No. A-133. Without effectively designed policies and  procedures for issuing management decisions related to single audit  findings, RD cannot reasonably assure that the management decisions  are issued timely and contain all required elements.
section_title: Department of Education
paragraphs: Education effectively designed policies and procedures to reasonably  assure that it prepared management decisions with the required content  for each single audit finding and issued such management decisions  within 6 months of receipt of the single audit reports, as required by OMB  Circular No. A-133. Education’s action officials are responsible for  determining the action to be taken in issuing management decision letters  within the 6-month time frame required by OMB Circular No. A-133. The  policies and procedures related to management decisions on the award  recipients’ plans to correct single audit findings at the two selected  subagencies—OESE and OSERS—are the same.
Education’s Handbook for the Post Audit Process provides elements for  the management decision letters that met the OMB Circular No. A-133  content requirements. These elements include (1) whether Education  agrees with the audit finding; (2) the reasons for the decision; and (3) the  expected auditee action to repay disallowed costs, make financial  adjustments, or take other action. In addition, Education’s policies and  procedures require its Audit Accountability and Resolution Tracking  System to mark as overdue any management decision letter not issued  within 6 months. According to the handbook, tracking reports generated  from the database that identify overdue or potentially overdue audit reports are sent to the action officials at the end of any quarter following  the end of the 6-month resolution period. According to Education officials,  at the time of our audit PAG was responsible for completing and updating  the audit dashboards each month that include a metric related to the  percentage of audits that are resolved timely. The dashboards include a  variety of metrics for single audits reports and are to be distributed to all  of Education’s program offices and reviewed by Education’s senior  management.
Despite these policies and procedures, Education officials stated that for  fiscal year 2013 single audit reports, some management decisions for  OSERS and OESE were not issued timely. We reviewed a  nongeneralizable sample of 42 Education single audit findings from fiscal  year 2013 and found that all of the written management decisions  included the content required by OMB Circular No. A-133. However, we  found that most of the letters were issued from 7 to 18 months after  receipt of the single audit reports. According to an Education official, in  fiscal year 2013, Education did not have mechanisms to hold the program  offices accountable for not issuing management decisions timely, but  subsequently Education developed an organizational performance review  that includes timely audit resolution in its metrics, which has served to  increase accountability. In addition, Education’s fiscal year 2015 agency  financial report stated that Education has strengthened controls over audit  follow-up to ensure more timely resolution, correction, and closure of  audit findings and continues to show significant improvements in timely  audit resolution, and remains focused on working cooperatively with  award recipients to address the most complex and repeat findings. In  addition, audit follow-up reflects a key component of Education’s risk  management strategy in the U.S. Department of Education Strategic Plan  for Fiscal Years 2014 – 2018.
section_title: Department of Health and Human Services
paragraphs: HHS’s two selected subagencies, ARD and CMS, did not effectively  design policies and procedures to reasonably assure that they prepare  management decisions with the required content for each single audit  finding and issue such management decisions within 6 months of receipt  of the single audit reports, as required by OMB Circular No. A-133.  According to an official from the HHS OIG, the OIG reviews single audit  reports and assigns single audit findings to operating divisions, such as  CMS, for resolution. Operating divisions are responsible for issuing  management decisions for single audit findings assigned by the OIG. The  OIG also assigns single audit findings that affect more than one operating  division—crosscutting findings—to ARD for resolution, and ARD is to  work with applicable operating divisions to issue management decisions.
An HHS official acknowledged that one of the most significant challenges  with single audit oversight has been the lack of standardization and  interpretation of the policies and procedures. An HHS official further  stated that some operating divisions were interpreting the management  decision guidance differently. Specifically, the official said that some  operating divisions thought that the management decision was only sent  when the audit resolution official determined that the corrective action  was complete and acceptable, while others sent management decision  letters as soon as they had evaluated the nature of the finding and  decided what the corrective action would be, with the goal of  accomplishing this within 6 months. In other cases, the award recipient  had already provided evidence that the single audit finding was resolved.  HHS officials stated that the operating divisions have the same  understanding now and that it was agreed that the decisions would be  based on the initial opinion of the single audit finding and planned  corrective action, and that these decisions would need to be issued within  6 months. In addition, an HHS official stated that HHS’s Single Audit  Resolution work group recently developed guidance for issuing and  handling management decisions for single audit findings that will apply to  the entire department. At the time of our audit, the Deputy Assistant  Secretary and the Deputy Chief Financial Officer were reviewing this  guidance. In addition, ARD officials told us that HHS plans to transition  single audit finding activities from the OIG to ARD. They also stated that  ARD has established an overall plan to streamline processes that will  enhance its audit resolution processes and reporting and that the  implementation of an enterprise-wide audit resolution system that will  automate audit resolution processes will be a major process  enhancement. However, it is unclear whether the updated single audit  guidance or processes will address our audit finding, ensuring that  policies and procedures are effectively designed to reasonably assure  that management decisions with the required content for each single audit  finding are prepared and issued within 6 months of receipt of the single  audit reports, as required by OMB guidance.
subsections: section_title: Audit Resolution Division
paragraphs: ARD did not effectively design policies and procedures to reasonably  assure that it prepared management decisions with the required content  for each single audit finding and issued such management decisions  within 6 months of receipt of the single audit reports, as required by OMB  Circular No. A-133. The ARD Manual contains ARD’s policies and  procedures for issuing management decisions and states that staff should  issue management decisions after they have completed their review of  single audit reports and the award recipients’ corrective action plans. In  addition, the manual provides an example of a management decision that  staff should use when communicating the results of ARD’s review of the  single audit finding and the corrective action plan to the award recipient.  However, neither the ARD Manual nor the management decision example  contains all of the required OMB Circular No. A-133 elements, such as  the reason for the decision, a timetable for follow-up that should be  performed if the award recipient has not completed corrective action, and  a description of any appeal process available to the award recipient. In  addition, the manual does not specifically state that the management  decision letter should be issued within six months of receipt of the single  audit report as required. According to an HHS official, ARD issues  management decisions after the HHS OIG sends ARD a letter of single  audit findings for resolution. OMB Circular No. A-133 states that the  awarding agency shall issue a management decision on single audit  findings within 6 months after the receipt of the audit report.
Without effectively designed policies and procedures for issuing  management decisions, ARD cannot reasonably assure that the  management decisions are issued timely and contain all required  elements. For example, we reviewed a nongeneralizable sample of 10  ARD single audit findings from fiscal year 2013 and found that ARD  issued management decisions for all 10 single audit findings but they did  not contain the required elements listed in OMB Circular No. A-133 . We  also found that ARD issued 6 of the 10 management decisions within the  required 6 months of the single audit report being available in the FAC.  ARD issued the other 4 management decisions from 7 to 9 months after  the reports were available in the FAC. According to an HHS official, there  can be delays between the time the OIG obtains the reports from the FAC  and assigns the single audit findings to ARD and other operating  divisions. For the 4 management decisions, we reviewed the time period  between the date that the OIG assigned the single audit finding to ARD  and the date ARD issued the management decision. ARD issued the  management decisions from 3 to 5 months after the OIG assigned the  single audit findings to ARD. ARD officials stated that ARD was currently  in a transition period, as it is taking on some of the activities that were  performed by the OIG and is revising its audit resolution policies and  procedures to accommodate the transition.
section_title: Centers for Medicare and Medicaid Services
paragraphs: CMS did not effectively design policies and procedures to reasonably  assure that it prepared management decisions with the required content  for each single audit finding and issued such management decisions  within 6 months of receipt of the single audit reports, as required by OMB  Circular No. A-133. According to a CMS official, CMS’s policies and  procedures relating to single audit oversight include its 1982 Health Care  Financing Administration Manual. This manual contains the policies and  procedures for resolving CMS single audit findings on grants, contracts,  and cooperative agreements, and for controlling the audit resolution  process and CMS’s departmental audit resolution policies and  requirements. According to a CMS official, CMS issued its policies and  procedures for the resolution of audit findings, which contained elements  found in OMB Circular No. A-73, Audit of Federal Operations and  Programs. However, OMB Circular No. A-73 was rescinded in 1995. CMS  had not updated its policies and procedures for management decisions as  of May 2016.
Without effectively designed policies and procedures for issuing  management decisions, CMS cannot reasonably assure that the  management decisions are issued timely and contain all required  elements. For example, we reviewed a nongeneralizable sample of 18  CMS single audit findings from fiscal year 2013, and found that CMS  issued only one management decision for 1 of the 18 single audit findings  that we reviewed. This management decision contained the content  required by OMB Circular No. A-133 and was issued within 6 months of  receipt of the single audit report. CMS officials told us that in the past,  CMS has communicated management decisions through telephone  conversations or via e-mail to the award recipients. CMS provided us with  e-mail correspondence between CMS and the award recipients for 13 of  the 18 single audit findings. However, the e-mails related to requesting  additional information from the award recipients and did not contain the  content elements required by OMB Circular No. A-133 for management  decisions and accordingly do not constitute a management decision..  According to CMS officials, at the time of our audit CMS was collaborating  with the other HHS operating divisions to update their policies and  procedures. However, it is unclear whether the updated single audit  guidance would address our audit finding, ensuring that policies and  procedures are effectively designed to reasonably assure that  management decisions with the required content for each single audit  finding are prepared and issued within 6 months of receipt of the single  audit reports, as required by OMB guidance.
section_title: Department of Housing and Urban Development
paragraphs: HUD’s two selected subagencies, CPD and PIH, did not effectively design  policies and procedures to reasonably assure that they prepared  management decisions with the required content for each single audit  finding and issued such management decisions within 6 months of receipt  of the single audit reports, as required by OMB Circular No. A-133. HUD’s  OCFO provides general departmental policies and procedures to its  program offices, such as CPD and PIH. HUD’s OCFO developed the  Audits Management System Handbook that describes procedures and  responsibilities for HUD’s program offices to review single audit reports  and issue management decisions. Each HUD program office is  responsible for ensuring single audit findings are resolved and  management decisions are issued as set forth in OMB Circular No. A- 133. HUD’s senior accountable official for single audits stated that the  decentralized approach for single audit oversight that HUD currently uses  is a consequence of the HUD OIG transferring audit resolution activities  to HUD program offices. The official further stated that the program  offices did not have the processes and procedures or experience needed  to take on responsibility for audit resolution. The official also stated that  HUD is working on a proposal to move to a centralized approach for  single audit oversight to better manage HUD’s compliance with OMB  Circular No. A-133 but will need additional staffing to implement the  proposed approach.
subsections: section_title: Office of Community Planning and Development
paragraphs: CPD did not effectively design policies and procedures to reasonably  assure that it prepared management decisions with the required elements  for each single audit finding and issued such management decisions  within 6 months of receipt of the single audit reports, as required by OMB  Circular No. A-133. HUD/CPD’s Clarifying Guidance to CPD Field Offices  on Single Audit Act Requirements requires that written management  decisions on all CPD-specific single audit findings be communicated to  the award recipients within 6 months of receipt of the single audit. It also  listed all the management decision content requirements of OMB Circular  No. A-133. However, CPD’s and HUD’s policies and procedures were not  effectively designed to reasonably assure that management decisions are  actually prepared with the required content and were issued timely as  they did not include steps to help to ensure that the policies and  procedures were actually carried out. For example, neither CPD’s nor  HUD’s policies or procedures identify the steps such as reviews by  management at the functional or activity levels to help reasonably assure  that management decisions are issued timely. We reviewed a  nongeneralizable sample of 18 CPD single audit findings from fiscal year  2013 and found that CPD issued management decisions for all 18 single  audit findings, but only 4 of the management decisions contained all of  the required content elements of OMB Circular No. A-133. Furthermore,  management decisions for 10 of the 18 single audit findings were not  issued within 6 months of receipt of the single audit reports. The 10  management decisions were issued from 7 to 19 months after receipt of  the single audit reports. Without effectively designed policies and  procedures for issuing management decisions, CPD cannot reasonably  assure that the decisions are issued timely and contain all required  elements.
section_title: Office of Public and Indian Housing
paragraphs: PIH did not effectively design policies and procedures to reasonably  assure that it prepared management decisions with the required content  for each single audit finding and issued such management decisions  within 6 months of receipt of the single audit reports, as required by OMB  Circular No. A-133. PIH’s Memorandum for PIH Hub Directors and  Program Coordinators (Field Guidance on Single Audit Act  Requirements) did not include all of the management decision letter  content required by OMB Circular No. A-133, such as the requirement  that the management decision describe the appeals process available to  the recipient or include the auditor’s assigned reference number for the  single audit finding. In addition, while PIH’s policies and procedures call  for management decisions to be issued within 6 months of receipt of the  single audit report, such policies and procedures did not include steps to  help ensure that the policies and procedures are actually carried out. For  example, the policies and procedures do not identify steps such as  reviews by management at the functional or activity levels to help  reasonably assure that management decisions are issued timely.
We reviewed a nongeneralizable sample of 19 PIH single audit findings  from fiscal year 2013 and found that PIH issued management decision  letters for 14 of the 19 single audit findings, but none of them contained  all of the content required for management decisions, as specified in  OMB Circular No. A-133. For 4 of the 14 single audit findings, the  management decisions were not issued within 6 months of the single  audit report but were issued about 11 months after receipt of the single  audit reports. Without effectively designed policies and procedures for  issuing management decisions, PIH cannot reasonably assure the  management decisions are issued timely and contain all required  elements.
section_title: Department of Transportation
paragraphs: Transportation’s two selected subagencies, FHWA and FTA, did not  effectively design policies and procedures to reasonably assure that they  prepared management decisions with the required content for each single  audit finding and issued such management decisions within 6 months of  receipt of the single audit reports, as required by OMB Circular No. A- 133. Each operating authority is responsible for issuing management  decisions and ensuring that award recipients take action to correct single  audit findings. Accordingly, each operating authority may have different  policies and procedures related to issuing management decisions than  those included in Transportation’s Financial Assistance Guidance  Manual, which provides procedural guidance to be followed in the  department’s award and monitoring of financial assistance. The Office of  the Deputy Secretary for Administration recognized the need to  strengthen Transportation’s actions relating to single audit  recommendations. However, as discussed below, we found deficiencies  relating to the management decision requirements in OMB Circular No. A- 133 at the two selected subagencies—FHWA and FTA.
subsections: section_title: Federal Highway Administration
paragraphs: FHWA did not effectively design policies and procedures to reasonably  assure that it prepared management decisions with the required elements  for each single audit finding and issued such management decisions  within 6 months of receipt of the single audit reports, as required by OMB  Circular No. A-133. Transportation had policies and procedures relating to  single audit findings, and FHWA had policies and procedures requiring  the issuance of a management decision within 6 months of receipt of the  single audit report, as required by OMB Circular No. A-133. While  FHWA’s policies and procedures include an example of a management  decision, they did not specifically require the elements of management  decisions specified in OMB Circular No. A-133. FHWA’s FIRE Tool Kit  states that division offices are responsible for developing and issuing  management decision letters and contains an example of a management  decision. This example includes information related to the single audit  report, a reference to the single audit finding, and FHWA’s assessment of  the corrective action proposed by the award recipient. However, neither  the Fire Tool Kit nor the example of the management decision describes  the elements OMB Circular No. A-133 requires be included in the  management decision, such as a statement indicating whether FHWA  agrees with the single audit finding, the reasons for its decision, and a  timetable for actions if the award recipient has not completed corrective  action.
In addition, FHWA’s policies and procedures listed in the FIRE Tool Kit  were not effectively designed to reasonably assure that management  decisions are actually prepared with the required content and are issued  timely because such policies and procedures did not include steps that  help to ensure that the policies and procedures are actually carried out.  For example, the policies and procedures did not include steps such as  reviews by management to reasonably assure that management  decisions contain the required content and are issued within 6 months of  the date the single audit report is received.
We reviewed a nongeneralizable sample of 22 FHWA single audit  findings from fiscal year 2013 and found that FHWA issued management  decisions for 9 of the 22 single audit findings. Of these nine management  decisions, three contained the elements required by OMB Circular No. A- 133 and were issued within 6 months of receipt of the single audit reports.  FHWA officials stated that the management decisions that were not  issued were inadvertently missed and the FHWA division offices  responsible for issuing the management decisions did not adhere to  FHWA’s single audit procedures. FHWA officials further stated that the  responsible division offices worked with the award recipients to resolve  these single audit findings. However, FHWA’s policies and procedures  were not effectively designed to reasonably assure that management  decisions are actually prepared with the required content and are issued  timely, as they did not include steps to help to ensure that the policies and  procedures were actually carried out.
section_title: Federal Transit Administration
paragraphs: FTA did not effectively design policies and procedures to reasonably  assure that it prepared management decisions with the required content  for each single audit finding and issued such management decisions  within 6 months of receipt of the single audit reports, as required by OMB  Circular No. A-133. Transportation had policies and procedures relating to  single audit findings. In addition, FTA’s Grants A to Z Standard Operating  Procedures states that FTA’s staff is responsible for issuing management  decisions, staying up-to-date on OMB Circular No. A-133 requirements,  and ensuring that management decisions are issued on FTA single audit  findings within 6 months of receiving the award recipients’ single audit  reports. However, FTA’s Grants A to Z Standard Operating Procedures  does not state the OMB Circular No. A-133 content requirements that  should be included in the management decisions or describe how the  agency will reasonably assure that management decisions are issued  timely. FTA officials stated that they issued management decisions via e- mail. However, we reviewed the e-mails provided to us by FTA officials  and found that none of them contained all of the elements required in  OMB Circular No. A-133. FTA officials also stated that they are working  on updating the standard operating procedures to reflect the changes  they are implementing for issuing management decisions and have  started a review of their management decision process.
Without effectively designed policies and procedures over management  decisions, FTA cannot reasonably assure the management decisions  contain the required elements and are issued timely. We reviewed a  nongeneralizable sample of 15 FTA single audit findings from fiscal year  2013 and found that FTA issued management decision letters for 3 of the  15 single audit findings. In addition, none of the three management  decisions contained all of the required elements or were issued within 6  months, as required by OMB Circular No. A-133. For the remaining 12  single audit findings, FTA provided us with e-mail correspondence;  however, the e-mails primarily related to requesting additional information  from the award recipients and did not contain the management decision  content elements required by OMB Circular No. A-133. FTA officials  stated that they ensured that the award recipients took steps to complete  the appropriate corrective actions.
section_title: Only Two of the Selected Subagencies Had Policies and Procedures for Identifying and Managing Both High- Risk and Recurring Single Audit Findings Using a Risk-Based Approach
paragraphs: Two of the selected subagencies, OESE and OSERS in Education, had  policies and procedures designed to use a risk-based approach to identify  and manage both high-risk and recurring single audit findings. Education  uses a centralized approach to identify and manage high-risk and  recurring single audit findings for these subagencies. None of the  selected subagencies in Agriculture, HHS, and HUD had policies and  procedures for using a risk-based approach to identify and manage high- risk and recurring single audit findings. Two of the selected subagencies  in Transportation had policies and procedures for using a risk-based  approach to identify and manage high-risk but not recurring single audit  findings.
We previously reported that federal agencies do not systematically use  audit findings to identify and understand emerging and persistent issues  related to grant programs and award recipients’ use of funds. Identifying  and categorizing certain single audit findings as high risk—that is, those  that if they are not corrected in a timely manner, may be seriously  detrimental to federal programs—can assist federal agencies in  understanding emerging and persistent issues related to award recipients’  use of funds and allow federal agencies to prioritize their resources to  help ensure that the award recipients timely address these findings.  Among other things, high-risk single audit findings could result in program failure; abuse; mismanagement; misuse of federal funds; improper  payments; significantly impaired service; significantly reduced program  efficiencies and effectiveness; unreliable data for decision making; and  unauthorized disclosure, manipulation, or misuse of sensitive  information. Recurring single audit findings are also of concern because  they indicate deficiencies that have persisted and may need more  resources or attention from the agency to address them. Consequently,  both high-risk and recurring single audit findings pose increased risks to  federal programs and improper payments.
Risk management is a strategy for helping program managers and  stakeholders make decisions about assessing risk, allocating resources,  and taking actions under conditions of uncertainty. Risk management can  be applied to an entire organization; to different levels of the organization;  or to specific functions, projects, and activities. Leading risk  management practices include that an organization develop, implement,  and continuously improve a process for managing risk and integrate it into  the organization’s overall governance, strategy, policies, planning,  management, and reporting processes. While risk management does  not provide absolute assurance of achieving an organization’s objectives,  an effective risk management strategy over high-risk and recurring single  audit findings can be particularly useful to help management identify  potential problems and reasonably allocate resources to address them. In  addition, Standards for Internal Control in the Federal Government states  that internal control should provide for an assessment of the risk the  agency faces from both external and internal sources.
FAC officials stated that award recipients submitted over 40,000 single  audit reports to the FAC for fiscal year 2013. Given the numbers of single  audit reports and single audit findings as well as constraints in federal  resources for conducting oversight of single audits, identifying and  managing high-risk and recurring single audit findings using a risk-based  approach can assist in identifying problem areas and addressing  priorities.
Figure 4 provides an overview of our assessment of the selected  subagencies’ policies and procedures for using a risk-based approach for  identifying and managing high-risk and recurring single audit findings.
subsections: section_title: Department of Agriculture
paragraphs: Agriculture’s two subagencies, FNS and RD, did not have policies and  procedures for using a risk-based approach to identify and manage high- risk and recurring single audit findings.
subsections: section_title: Food and Nutrition Service
paragraphs: FNS did not have policies and procedures for using a risk-based  approach to identify and manage high-risk and recurring single audit  findings. Instead, FNS officials stated that regional offices conduct a  Management Evaluation and Financial Management Review of each  award recipient every 3 to 5 years. This review focuses on program  compliance issues as well as financial management issues to assist  FNS’s oversight of award recipients. According to FNS officials, these  reviews are used to identify award recipients that are not in compliance  with award requirements, including requirements for resolving single audit  findings. While these reviews may be useful in evaluating award  recipients’ use of federal funds, performing the reviews every 3 to 5 years  limits FNS’s ability to timely identify problem areas and set priorities for  addressing them.
section_title: Rural Development
paragraphs: RD did not have policies and procedures for using a risk-based approach  to identify and manage high-risk and recurring single audit findings.  According to RD officials, all single audit findings were given the utmost  attention to ensure that corrective actions were taken for all findings,  regardless of their substance. However, using a risk-based approach may  help to reasonably assure that the single audit findings that pose the  greatest risk to a program’s objectives or of fraud, waste, or abuse of  federal funds are identified and addressed in a timely manner.
RD’s standard operating procedures state that the Financial Management  Division program analyst downloads single audit reports from the FAC,  reviews the information contained in the single audit reports, and  determines which RD agency or program area is to respond to the single  audit findings. In addition, the standard operating procedures state that  the program analyst tracks the single audit findings in the Automated  Reports Tracking System until the single audit finding is closed.  Although RD does not separately identify and track recurring single audit  findings, officials noted that single audit reports are checked against  previous single audit reports to see if there are recurring single audit  findings. According to RD officials, they notify the state office or program  area via transmittal letter that a single audit finding is recurring from a  prior year (citing the previously processed single audit finding) and that  the award recipient has not addressed the single audit finding through  corrective actions. While this procedure is indicated in RD’s standard  operating procedures, RD’s standard operating procedures do not include  a risk-based approach so that state offices or program areas can identify  and manage the single audit findings that could pose a greater risk to the  program’s objectives or increase the risk of fraud, waste, or abuse of  federal funds.
section_title: Department of Education
paragraphs: Education had policies and procedures for using a risk-based approach to  identify and manage high-risk and recurring single audit findings and such  procedures include assigning a category to single audit reports and  findings based upon an assessment of risks. The Post Audit Group (PAG)  of Education’s Office of the Chief Financial Officer (OCFO) developed  department-wide policies and procedures for single audit oversight and  audit resolution. In addition PAG plays a central role in single audit  oversight and in coordination of audit resolution by processing and  distributing single audit reports, working with the principal offices and  other stakeholders for the award recipients to address single audit  findings, and tracking audit reports and single audit findings in the Audit  Accountability and Resolution Tracking System (AARTS). Education’s  PAG Director stated that the department began categorizing single audit  reports as high, medium, or low risk, based on a variety of factors,  through the AARTS system in 2012. As new single audit reports are  uploaded into AARTS, they are assessed electronically using  predetermined criteria based on risk factors and each audit is assigned  an overall risk rating. As such, all single audit findings contained in an  audit carry the same level of risk. According to the Director, these risk  ratings enable the staff assigned to the audit report to prioritize their  workloads according to the assessed risk.
Education’s program offices and PAG then use a “triage” process at the  program and department levels to assess the seriousness of each single  audit finding and determine the amount of attention needed for resolution.  According to the policies and procedures in Education’s Handbook for the  Post Audit Process, each program office holds a monthly meeting to  discuss and reach agreement on the actions needed to resolve each  single audit finding at the program level. In addition, Education holds a  monthly “triage meeting” at the department level where the program  offices, PAG, OIG, and the Office of the General Counsel review the program office-level triage recommendations on whether the resolution  approach should be full resolution, abbreviated resolution, informal  resolution, or an appropriate combination of these approaches.  Education’s Handbook for the Post Audit Process also states that a full  resolution approach should be used for a recurring finding. In addition,  Education was able to provide us with a list of single audit findings that  were recurring from prior years.
section_title: Department of Health and Human Services
paragraphs: HHS’s two selected subagencies, ARD and CMS, did not have policies  and procedures for using a risk-based approach to identify and manage  high-risk and recurring single audit findings. HHS’s Office of the Assistant  Secretary sets the policies that outline the roles and responsibilities of the  offices and operating divisions involved in the single audit process, but  had not issued guidance requiring the department to identify and manage  high-risk and recurring single audit findings using a risk-based approach.  HHS officials stated that operating divisions are responsible for ensuring  that single audit findings are identified and resolved. Operating divisions  are responsible for issuing management decisions for single audit  findings assigned to them by the OIG. The OIG also assigns single audit  findings that affect more than one operating division—known as  crosscutting findings—to ARD for resolution, and ARD is to work with the  affected operating divisions to issue management decisions. ARD and  CMS officials stated that they do not assess the risk of the single audit  findings.
subsections: section_title: Audit Resolution Division
paragraphs: ARD did not have policies and procedures for using a risk-based  approach to identify and manage high-risk and recurring single audit  findings. According to ARD officials, they do not prioritize single audit  findings based on risk or recurrence, and as a result, they have not  developed policies and procedures to identify, monitor, or track high-risk  and recurring single audit findings. ARD officials stated that if they determine that a crosscutting finding is recurring from a prior year, they  will indicate that it is a prior year finding in the management decision to  the award recipient, but they do not otherwise assign a risk to recurring  single audit findings.
section_title: Centers for Medicare and Medicaid Services
paragraphs: CMS did not have policies and procedures for using a risk-based  approach to identify and manage high-risk and recurring single audit  findings. CMS officials stated that they resolve each single audit finding  and ensure that corrective actions have been achieved. CMS’s policies  and procedures did not contain requirements to identify and manage  single audit findings based on risk and recurrence. However, CMS  officials stated that CMS has been participating in a Single Audit Metrics  Initiative pilot project since fiscal year 2012. The project focuses on  eliminating repeated material noncompliance single audit findings in  CMS’s highest-risk program, Medicaid. They also stated that the number  of repeated material noncompliance single audit findings for fiscal year  2014 audits decreased by 29 percent compared to the number in fiscal  year 2010. CMS officials stated that this level of success was achieved by  focusing on training audit analysts in audit resolution principles and  processes; requiring that implementation of corrective action plans is  verified; and holding regular meetings with CMS’s single audit work group  to discuss best practices, new techniques, and other topics. The CMS  pilot illustrates the effectiveness of using a risk-based approach to  manage risks.
section_title: Department of Housing and Urban Development
paragraphs: HUD’s two subagencies, CPD and PIH, did not have policies and  procedures for using a risk-based approach to identify and manage high- risk and recurring single audit findings. The OCFO provides general  departmental policies and procedures to HUD’s program offices for single  audit oversight. HUD’s policies and procedures state that the program  offices (such as CPD and PIH) are responsible for ensuring that single  audits are submitted, monitored, and tracked.
subsections: section_title: Office of Community Planning and Development
paragraphs: CPD did not have policies and procedures for using a risk-based  approach to identify and manage high-risk and recurring single audit  findings. CPD’s Risk Analyses for Monitoring Community Planning and  Development Grant Programs guidance provides a methodology for  conducting risk analyses of award recipients and establishes monitoring  priorities. Each CPD field office is responsible for developing an office  work plan with monitoring strategies to address how it will monitor CPD  award recipients and programs during the fiscal year. The risk analyses  include evaluating risk factors related to grant management and financial  management and looking at specific elements, such as findings contained  in the single audit reports. Based on this evaluation, CPD assigns award  recipients to one of three risk categories: low, medium, and high. CPD’s  policies and procedures call for it to rank award recipients based on risks  in order to develop a work plan and strategies for monitoring individual  award recipients.
According to CPD’s guidance, recurring findings are included in CPD’s  risk analysis process and can affect the risk score and risk rating  assigned to a grantee. The guidance also requires CPD staff to maintain  a log to track all CPD findings and recurring findings. However, CPD  policies and procedures do not specifically require staff to indicate if a  finding is repeated from a prior year. While the review of single audit  findings is included as one of the elements used to determine award  recipient risk, this process is not designed to assess individual audit  findings based on risks and thus, CPD does not use a risk-based  approach for recurring single audit findings. Single audit findings of a  higher risk, if not identified and managed, could increase the risk of fraud,  waste, or abuse of federal resources.
section_title: Office of Public and Indian Housing
paragraphs: PIH did not have policies and procedures for using a risk-based approach  to identify and manage high-risk and recurring single audit findings.  According to PIH officials, PIH conducts a national risk assessment on a  quarterly basis to assess the risks presented by each of PIH’s award  recipients. PIH officials informed us that each award recipient is rated  on four categories—physical risks, financial risks, management risks, and  governance risks—using a basic statistical formula to identify outliers and  other key risk indicators. According to PIH officials, the National Risk  Assessment includes a survey of the quality of the audits and whether the  award recipient is responsive to single audit findings, including whether  the award recipient has past due responses or repeat single audit  findings. The staff survey includes a question on whether the award  recipient understands HUD requirements, policies, regulations, and laws  in the event that there were serious single audit findings. However, the  National Risk Assessment does not include identifying or tracking single  audit findings and is not used to identify high-risk single audit findings.  According to PIH officials, the data on specific single audit findings are  not in a usable format that would allow the risk assessment to include that  level of data.
According to PIH officials, single audit findings are identified and tracked  either through the Next Generation Management System/Portfolio and  Risk Management Tool or through the intra-office tracking log located on  PIH’s Office of Field Operation’s SharePoint website. However, PIH did  not have policies and procedures for using a risk-based approach to  identify and manage high-risk and recurring single audit findings.
section_title: Department of Transportation
paragraphs: Transportation had policies and procedures for using a risk-based  approach to identify and manage high-risk single audit findings. In  addition, FHWA and FTA had policies and procedures for identifying  recurring single audit findings, but neither of them had policies and  procedures to use a risk-based approach to manage recurring single  audit findings. The responsibilities of identifying, monitoring, and resolving  high-risk and recurring single audit findings were divided between the  OIG and the operating administrations. The OIG reviews single audit  reports and categorizes single audit findings as part of its oversight role,  and the operating authorities are responsible for ensuring that single audit  findings are resolved. The OIG had policies and procedures detailing its  single audit oversight for reviewing single audit reports from the FAC and  using a risk-based approach for categorizing single audit findings for both  FHWA and FTA.
subsections: section_title: Federal Highway Administration
paragraphs: The Transportation OIG is responsible for and had policies and  procedures for reviewing single audit findings for FHWA and categorizing  them based on risk; however, FHWA did not have policies and  procedures for using a risk-based approach to manage recurring single  audit findings. FHWA’s FIRE Tool Kit states that high-risk single audit  findings identified by the OIG are tracked using a SharePoint tracking  website. FHWA has 30 days to prepare a plan to address the single audit  findings, establish target action dates to correct the findings, and provide  an e-mail to the OIG stating (1) that the single audit report has been  reviewed, (2) that the award recipient is in tentative agreement with the  single audit finding, and (3) the action dates. If FHWA does not submit  this information to the OIG within 30 days, it is considered late. According  to an OIG official, in such instances, officials within the Office of the  Secretary contact the departments to determine why the single audit  findings are still open.
FHWA’s FIRE Tool Kit also states that its regional offices are responsible  for conducting repeat finding analyses to determine if there are systemic  deficiencies or internal control gaps in the award recipients’ processes.  However, the policies and procedures do not state what is done with this  report or how it is used to monitor recurring single audit findings. FHWA  uses the Review Response Tracker and SharePoint system to track the  resolution of single audit findings. According to FHWA officials, the  Review Response Tracker can generate a report or list of all the single  audit findings that are repeated from a prior year; however, the FIRE Tool  Kit does not require that this report be generated regularly or that the  report to be used to monitor recurring single audit findings. In addition, the  FIRE Tool Kit does not state what is done with this report or how it is used  to monitor recurring single audit findings.
section_title: Federal Transit Administration
paragraphs: The Transportation OIG is responsible for and has policies and  procedures for reviewing single audit findings and categorizing them  based on risk; however, FTA did not have policies and procedures for  using a risk-based approach to identify and manage recurring single audit  findings. FTA’s Grants A to Z Standard Operating Procedures requires  FTA regional offices to track all single audit findings using the FTA  Oversight Tracking System. In addition, FTA regional offices work with  award recipients to ensure that the single audit findings identified by the  OIG are adequately addressed. Once action has been taken, an FTA  regional office is responsible for completing the Report to Close OIG  Single Audit Recommendation document and sending it to the OIG for  review and closeout. Once the OIG approves the closure of the finding,  the finding will be closed in the Oversight Tracking System.
According to FTA officials, those responsible for resolving single audit  findings can indicate in the Oversight Tracking System whether a single  audit finding is a “repeat” finding from a prior year, and the system can  generate a report of all the single audit findings that have been identified  as repeat findings. However, FTA’s guidance does not require staff to  indicate if the finding is repeated from a prior year. As a result, FTA lacks  policies and procedures to reasonably assure that recurring single audit  findings are consistently identified within the Oversight Tracking System,  or track the progress award recipients have made to address such  findings.
section_title: Conclusions
paragraphs: Single audits are considered to be a critical element of the government’s  oversight of more than an estimated $600 billion in annual federal awards  and help reasonably assure that federal funds are properly used. The  selected subagencies of the five federal agencies that we reviewed had  policies and procedures that included elements of OMB’s guidance on  single audit oversight. However, most of these subagencies did not  always effectively design policies and procedures to reasonably assure  that award recipients submitted single audit reports in a timely manner  and that federal awarding agencies issued written management decisions  on single audit findings with the required content in a timely manner.  Without the effective design of these policies and procedures, agencies  and subagencies cannot reasonably assure that they are conducting the  required effective oversight of the federal funds they have awarded. In  addition, most of the subagencies in our study did not have policies and  procedures for using a risk-based approach to identify and manage high- risk and recurring single audit findings. Such findings, if not addressed  timely, may be seriously detrimental to federal programs. Identifying and  managing single audit findings using a risk-based approach could also  assist federal agencies and subagencies in understanding emerging and  persistent issues related to award recipients’ use of funds identified by  single audit findings and allow federal agencies and subagencies to  prioritize their resources to help ensure that these findings are timely  addressed by the award recipients. Of the five agencies in our audit, only  one agency’s (Education) two selected subagencies had effectively  designed policies and procedures in the three areas addressed in our  audit. The results in our report point to a need for more effective design of  policies and procedures relating to single audits to help improve oversight  of federal awards and reduce improper payments.
section_title: Recommendations for Executive Action
paragraphs: We recommend that the Secretary of Agriculture direct the Under  Secretary for Food, Nutrition, and Consumer Services to take the  following three actions:
Design policies and procedures to reasonably assure that all award  recipients required to submit single audit reports do so in accordance  with OMB guidance.
Revise policies and procedures to reasonably assure that  management decisions contain the required elements and are issued  timely in accordance with OMB guidance.
Design and implement policies and procedures for identifying and  managing high-risk and recurring single audit findings using a risk- based approach.
We recommend that the Secretary of Agriculture direct the Under  Secretary for Rural Development to take the following three actions:
Design policies and procedures to reasonably assure that all award  recipients required to submit single audit reports do so in accordance  with OMB guidance.
Revise policies and procedures to reasonably assure that  management decisions contain the required elements and are issued  timely in accordance with OMB guidance.
Design and implement policies and procedures for identifying and  managing high-risk and recurring single audit findings using a risk- based approach.
We recommend that the Secretary of Health and Human Services direct  the Assistant Secretary for Financial Resources to take the following  three actions:
Design policies and procedures to reasonably assure that all award  recipients required to submit single audit reports do so in accordance  with OMB guidance.
Revise policies and procedures to reasonably assure that  management decisions contain the required elements and are issued  timely in accordance with OMB guidance.
Design and implement policies and procedures for identifying and  managing high-risk and recurring single audit findings using a risk- based approach.
We recommend that the Secretary of Health and Human Services direct  the Administrator of the Centers for Medicare and Medicaid Services to  take the following three actions:
Revise its policies and procedures to take action to obtain single audit  reports when award recipients did not submit reports within the  required time frames.
Revise its policies and procedures to reasonably assure that  management decisions contain the required elements and are issued  timely in accordance with OMB guidance.
Design and implement policies and procedures for identifying and  managing high-risk and recurring single audit findings using a risk- based approach.
We recommend that the Secretary of Housing and Urban Development  direct the Principal Deputy Assistant Secretary for the Office of  Community Planning and Development to take the following two actions:
Revise policies and procedures to reasonably assure that  management decisions contain the required elements and are issued  timely in accordance with OMB guidance.
Design and implement policies and procedures for identifying and  managing high-risk and recurring single audit findings using a risk- based approach.
We recommend that the Secretary of Housing and Urban Development  direct the Principal Deputy Assistant Secretary for the Office of Public and  Indian Housing to take the following two actions:
Revise policies to reasonably assure that management decisions  contain the required elements and are issued timely in accordance  with OMB guidance.
Design and implement policies and procedures for identifying and  managing high-risk and recurring single audit findings using a risk- based approach.
We recommend that the Secretary of Transportation direct the  Administrator of the Federal Highway Administration to take the following  two actions:
Revise policies and procedures to reasonably assure that  management decisions contain the required elements and are issued  timely in accordance with OMB guidance.
Design and implement policies and procedures for identifying and  managing recurring single audit findings using a risk-based approach.
We recommend that the Secretary of Transportation direct the  Administrator of the Federal Transit Administration to take the following  three actions:
Design policies and procedures to reasonably assure that all award  recipients required to submit single audit reports do so in accordance  with OMB guidance.
Revise policies and procedures to reasonably assure that  management decisions contain the required elements and are issued  timely in accordance with OMB guidance.
Design and implement policies and procedures for identifying and  managing recurring single audit findings using a risk-based approach.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to Agriculture, Education, HHS, HUD,  and Transportation for comment.
One of Agriculture’s subagencies, RD, provided comments, in an e- mail submitted on behalf of the Acting Deputy Under Secretary for  Rural Development, stating that it agreed with our recommendations.  The e-mail did not address our recommendations to the other  subagency, FNS.
Education provided a technical comment, in an e-mail from the  Executive Secretariat in the Office of the Secretary, which we  incorporated as appropriate.
In its written comments, reprinted in appendix II, HHS concurred with  our recommendations.
HUD provided comments related to its two subagencies, PIH and  CPD, in an e-mail submitted on behalf of the Principal Deputy  Assistant Secretary for PIH and the Principal Deputy Assistant  Secretary for CPD. PIH indicated that it had taken actions that  addressed our recommendations, while CPD disagreed with the two  recommendations directed to it.
In its written comments, reprinted in appendix III, Transportation  concurred with our recommendations.
Agriculture, HHS, HUD, and Transportation also provided technical  comments, which we incorporated as appropriate.
subsections: section_title: Department of Agriculture
paragraphs: In an e-mail submitted on behalf of the Acting Deputy Under Secretary for  Rural Development, RD stated that it agreed with our recommendations  and stated that it will work with Agriculture’s OCFO and the program  areas to develop policies and procedures to ensure that its award  recipients are in compliance with OMB guidance. RD stated that it will  meet with each program area and discuss how single audits are  processed and resolved. RD plans to develop policies and procedures for  identifying all award recipients that should file single audit reports;  determining if all required single audit reports are filed, received, and  processed each year; and assuring that transmittal letters and  management decisions contain the required elements and are issued  timely in accordance with current OMB guidance. RD also stated that it  will develop new policies and procedures for identifying and managing  high-risk and recurring single audit findings using a risk-based approach.
section_title: Department of Health and Human Services
paragraphs: In its letter reprinted in appendix II, HHS concurred with our  recommendations to the Assistant Secretary for Financial Resources  (ASFR) and to the Administrator of CMS related to monitoring the  submission of single audit reports, issuing management decisions, and  identifying and managing high-risk and recurring single audit findings.
Overall, HHS stated that it is committed to ensuring that grantees submit  single audits in a timely and complete manner and that its subagencies  utilize the findings to ensure proper management of its grantees. HHS  stated that ASFR is taking over the single audit assignment and tracking  function from the OIG and that this realignment will allow HHS to better  meet the requirements of the Uniform Guidance. HHS also stated that it  updated its Grants Policy Manual on December 31, 2015  With regard to the recommendations directed to ASFR, HHS stated that  ASFR had issued several policies and procedures related to the grantees’  timely submission of single audits. HHS stated that it would continue to  evaluate its policies and procedures to ensure compliance with its  regulations, particularly as ASFR takes over the single audit findings  assignment and tracking function from the OIG. In addition, HHS stated  that ASFR will work to develop policies and procedures that utilize a risk- based approach for high-risk and recurring single audit findings.
With regard to the recommendations directed to CMS, HHS stated that it  is working to incorporate the Grants Policy Manual into CMS’s policies  and procedures for actions related to the timely submission of single audit  reports and for reasonably assuring that management decisions contain  the required elements and are issued timely in accordance with OMB  guidance. CMS plans to update the 1982 Health Care Financing  Administration Audit Resolution Manual and work collaboratively to  develop policies and procedures that utilize a risk-based approach for  high-risk and recurring single audit findings. If implemented as planned,  these actions could address the intent of the recommendation.
section_title: Department of Housing and Urban Development
paragraphs: In an e-mail submitted on behalf of the Principal Deputy Assistant  Secretary, CPD disagreed with our recommendation to revise policies  and procedures to reasonably assure that management decisions contain  the required elements and are issued timely in accordance with OMB  guidance. CPD stated that it was not a prudent investment of resources to  implement recommendations based upon a review of single audits under  OMB Circular No. A-133, which was superseded by the Uniform  Guidance. As stated in our report, the Uniform Guidance is effective for  audits for fiscal years beginning on or after December 26, 2014. However,  Uniform Guidance, Section 200.521, Management Decisions, carried  forward the requirements in OMB Circular No. A-133 for management  decisions relating to the content requirements and the time frames for  issuing management decisions. Therefore, we continue to believe that  actions to revise CPD’s policies and procedures related to management  decisions are warranted and will help CPD comply with the Uniform  Guidance.
In its e-mail, CPD also disagreed with our recommendation to design and  implement policies and procedures for identifying and managing high-risk  and recurring single audit findings using a risk-based approach. CPD  stated that neither OMB Circular No. A-133 nor the Uniform Guidance  makes reference to high-risk or recurring single audit findings. However,  as stated in our report, leading risk management practices include that an  organization develop, implement, and continuously improve a process for  managing risk and integrate it into the organization’s overall governance,  strategy, policies, planning, management, and reporting processes.  Further, our report also notes that in July 2016, OMB released OMB  Circular No. A-123, Management’s Responsibility for Enterprise Risk  Management and Internal Control, effective beginning fiscal year 2016,  which requires federal agencies to consider risk management in their  operations.
Also, in its e-mail, CPD stated that our definition of high-risk findings was  too broad. Our definition states that high-risk single audit findings are  findings that may be seriously detrimental to federal programs. Among  other things, high-risk single audit findings could result in program failure;  abuse; mismanagement; misuse of federal funds; improper payments;  significantly impaired service; significantly reduced program efficiencies  and effectiveness; unreliable data for decision making; and unauthorized  disclosure, manipulation, or misuse of sensitive information. This  definition provides agencies with the flexibility to analyze the types of  risks pertinent to their operating environments and to develop definitions  of high-risk single audit findings that they deem appropriate.
CPD also stated that our definition of high-risk findings does not lend itself  to uniform and consistent interpretation across all CPD programs or within  HUD and is unlikely to be consistently interpreted across all federal  agencies, undermining the basis upon which the Uniform Guidance was  developed. However, CPD and HUD can develop a definition of high-risk  single audit findings that is pertinent to their operating environment and  applied consistently within their organization. As stated in our report, an  effective risk management strategy over high-risk and recurring single  audit findings can be particularly useful to help management identify  potential problems and reasonably allocate resources to address them,  which can help improve program performance and outcomes. In addition,  OMB Circular No. A-123 states that risks are analyzed in relation to  achievement of the objectives established in an agency’s strategic plan  and are to be reexamined regularly to identify new risks or changes to  existing risks. Thus, risks can be agency specific. To that end, the  definition for high-risk single audit findings need not be uniform across the  federal government.
We continue to believe that CPD needs to take action to implement this  recommendation to design and implement policies and procedures for  identifying and managing high-risk and recurring single audit findings  using a risk-based approach.
In an e-mail on behalf of the Principal Deputy Assistant Secretary, PIH  stated that it has been in the process of revising its policies and  procedures for reviewing and taking action on single audit report findings  for public housing agencies. PIH stated that our recommendations were  substantially addressed through new procedures. Where the report  identified new areas that had not been addressed, PIH stated that it has  incorporated those areas into its audit finding review process and risk  assessment updates to address the recommendations in our report. If  fully implemented, these actions should address the intent of the  recommendations.
section_title: Department of Transportation
paragraphs: In its letter reprinted in appendix III, Transportation concurred with our  recommendations. Transportation stated that it employs stringent  monitoring and oversight to ensure that grantees meet the terms of award  agreements and conduct activities in accordance with federal laws and  regulations. It stated that Transportation is committed to using single  audits as a valuable tool to help monitor performance, reduce improper  payments, and strengthen accountability and oversight of these funds. In  addition, Transportation indicated that it will revise, design, and  implement policies and procedures to (1) reasonably assure that all  required award recipients submit single audit reports and management  decisions contain required elements and are issued timely, in accordance  with OMB guidance, and (2) identify and manage recurring single audit  findings using a risk-based approach. If fully implemented, these actions  should address the intent of the recommendations.
We are sending copies of this report to the appropriate congressional  committees; the Secretaries of Agriculture, Education, Health and Human  Services, Housing and Urban Development, and Transportation; and  other interested parties. This report is also available at no charge on the  GAO website at http://www.gao.gov.
If you or your staff members have any questions about this report, please  contact me at (202) 512-2623 or davisbh@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff members who made key  contributions to this report are listed in appendix IV.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to determine the extent to which selected federal  agencies (1) effectively designed policies and procedures for reasonably  assuring that award recipients submit single audit reports in a timely  manner, (2) effectively designed policies and procedures for reviewing  award recipients’ plans to correct single audit report findings and issuing  written management decisions on those plans, and (3) had policies and  procedures for managing high-risk and recurring single audit findings  through a risk-based approach.
Because grant awards proportionally represent one of the largest  amounts of federal awards, we used grant data from the Office of  Management and Budget’s (OMB) Outlays for Grants to State and Local  Governments in fiscal year 2013 to select the agencies and subagencies  for our audit. We selected for our audit the five agencies that had the  largest dollar amount of total reported outlays for grants to state and local  governments in fiscal year 2013. These five agencies—the Departments  of Agriculture (Agriculture), Education (Education), Housing and Urban  Development (HUD), Transportation (Transportation), and Health and  Human Services (HHS)—collectively accounted for 93 percent of total  reported outlays for federal grants to state and local governments in fiscal  year 2013. For Agriculture, Education, HUD, and Transportation, we  selected subagencies that collectively outlaid over 90 percent of their  respective agencies’ fiscal year 2013 total reported outlays for grants to  state and local governments. For HHS, we selected the single largest  subagency within HHS, which outlaid over 83 percent of HHS’s fiscal year  2013 total reported outlays for grants to state and local governments. We  also reviewed HHS’s Audit Resolution Division, which has a key role in  HHS’s single audit oversight process but does not provide federal  awards. (See table 1.)
For our first objective, we reviewed the Single Audit Act of 1984, as  amended (Single Audit Act); OMB Circular No. A-133; and Standards for  Internal Control in the Federal Government to identify agency  responsibilities. In addition, we reviewed the selected agencies’ and  subagencies’ written policies and procedures for those areas and  interviewed selected agency and subagency officials with responsibility  for single audit oversight. We also identified four key steps relating to the  design of single audit policies and procedures that would assist federal  awarding agencies in fulfilling their responsibilities under OMB Circular  No. A-133 for reasonably assuring that award recipients submit single  audit reports timely. To that end, designing policies, procedures, and  mechanisms to include the following steps would help provide reasonable  assurance that agencies can fulfill these responsibilities:  identify award recipients that should have submitted single audit  reports,  verify that the award recipients submitted single audit reports, determine whether the reports were submitted within the required time  take action to obtain single audit reports when award recipients did  not submit the reports within the required time frames.
For purposes of our audit, we reviewed the agencies’ and subagencies’  policies and procedures to assess whether they reasonably assure that  award recipients completed and submitted their single audit reports within  the required time frames, using 9 months after each award recipient’s  fiscal year-end as the applicable time period. Nine months after the fiscal  year-end is in most cases the later date compared to 30 days after receipt  of the single audit report; we used this time period because it generally  represents the maximum amount of time award recipients would have to  submit single audit reports, and measuring the length of time after receipt  as the applicable time period would have been unduly burdensome for  our audit.
We requested from each subagency a list of award recipients that  expended in excess of $500,000 in federal awards during fiscal year 2013  and were therefore required to submit single audit reports for fiscal year  2013. We then queried the Federal Audit Clearinghouse (FAC) to  determine whether selected award recipients submitted their single audit  reports timely. While we do not present data directly from the FAC in this  report, because the FAC database is integral to the Single Audit Act  reporting requirements, we undertook data reliability procedures to  ascertain whether award recipients were submitting their single audit  reports to the FAC. Specifically, we randomly selected 15 award  recipients from each of the six subagencies that provided lists—Food and Nutrition Service, Office of Elementary and Secondary Education, Office  of Special Education and Rehabilitative Services, Office of Public and  Indian Housing, Federal Highway Administration, and Federal Transit  Administration—for a total of 90 sampled cases. We received a listing of  award recipients from the remaining three subagencies: Centers for  Medicare and Medicaid Services, Rural Development, and Office of  Community Planning and Development.
We were unable to use the lists for our testing because lists from the  Centers for Medicare and Medicaid Services and Rural Development  were not generated independently of the FAC. In addition, the Office of  Community Planning and Development did not provide us with a list that  facilitated searching in the FAC. Two of the six responding subagencies  provided us with a list that included 8 award recipients that expended less  than $500,000. For the remaining 82 cases, we undertook searches in the  FAC to ascertain whether those award recipients had single audit reports  in the FAC database. In 72 of the 82 cases, we were able to find the  applicable fiscal year 2013 single audit report. In the remaining 10 cases,  we could not readily locate an applicable 2013 single audit report using  our multistep search procedures. Our random sample, which examined a  limited number of single audit reports for the selected subagencies, was  not designed to be generalizable. As a result, we do not make a  generalizable statement about the completeness of the single audit  reports in the FAC database.
For our second objective, we reviewed selected policies and procedures  and interviewed agency and subagency officials to clarify our  understanding of those policies and procedures. We also randomly  selected nongeneralizable samples of single audit findings applicable to  each subagency. For each sample item, we requested and reviewed  documentation relating to written management decisions.
To address our third objective, we reviewed the selected agencies’ and  subagencies’ written policies and procedures for those areas and  interviewed selected agency and subagency officials to clarify our  understanding of those policies and procedures.
We conducted this performance audit from May 2015 to February 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Department of Health and Human Services
section_title: Appendix III: Comments from the Department of Transportation
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Phyllis Anderson (Assistant  Director), Sharon Byrd, Bruce David, Francine DelVecchio, Benjamin  Durfee, Doreen Eng, Maxine Hattery, Bradley Johnson, Jason Kelly,  Jennifer Leone, Kevin McAloon, Jared Minsk, Lisa Motley, Mai Nguyen,  Anna Maria Ortiz, Amber Sinclair, and Walter Vance made key  contributions to this report.