Internal Controls: Corrective Actions Under Way to Address Control Deficiencies at the Morris K. Udall and Stewart L. Udall Foundation
Published: 2013-12-06T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Foundation was established as an executive branch agency to provide educational opportunities related to environmental policy and Native American health care and tribal policy, and also to assist in resolving environmental disputes that involve federal agencies. In December 2012, a DOI OIG audit of the Foundation identified significant issues primarily related to the Foundation's failure to appropriately monitor and assess the effectiveness of its internal controls as required by FMFIA and the absence of key internal controls over its personnel and contracting practices. GAO was asked to review whether the Foundation has sufficient internal controls to ensure that it is complying with applicable laws and regulations regarding financial management and contracting. The objective of this report is to describe the Foundation's actions to improve its internal control assessment process and its controls over personnel and contracting, and determine the extent to which the design of the Foundation's actions that have been sufficiently documented is consistent with internal control standards and applicable laws and regulations.
To address this objective, GAO reviewed relevant documents, interviewed Foundation management, and assessed the Foundation's actions against relevant standards and guidance.
In commenting on a draft of this report, the Foundation accepted GAO's results in full. The Foundation also provided a summary of the changes it has made in its operations and structure since the DOI OIG report.
section_title: What GAO Found
paragraphs: Officials at the Morris K. Udall and Stewart L. Udall Foundation (Foundation) developed a Corrective Action Plan to address the findings in the Department of the Interior (DOI) Office of Inspector General's (OIG) December 2012 audit report. The Corrective Action Plan included steps to address deficiencies in the Foundation's (1) internal control monitoring and assessment process, (2) internal control related to personnel issues, and (3) internal control related to contracting. For those actions that were sufficiently documented at the time of its review, GAO found that their design was consistent with internal control standards and applicable laws and regulations.
To address identified deficiencies in its internal control monitoring and assessment processes under 31 U.S.C. 3512(c), (d), commonly known as the Federal Managers' Financial Integrity Act (FMFIA), and implementing guidance, the Foundation contracted with an external consultant to perform an internal control review with an overall goal of achieving compliance with the Office of Management and Budget (OMB) Circular No. A-123, Management's Responsibility for Internal Control and Standards for Internal Control in the Federal Government. GAO determined that the design of this action to contract for the performance of a thorough internal control review is consistent with internal control standards related to monitoring operations and internal controls and with FMFIA requirements to monitor and assess the effectiveness of internal controls.
To address deficiencies in its internal control related to personnel issues, the Foundation developed policies and procedures to address specific DOI OIG findings in the areas of outside employment and termination of employees. The procedures were still in draft form, and it was too soon for GAO to assess the design of the changes.
To address the DOI OIG's findings related to its contracting practices, the Foundation entered into a 5-year interagency agreement with the DOI Interior Business Center (IBC), under which IBC agreed to assist the Foundation on contracts related to the Foundation's environmental conflict resolution activities, including mediation, facilitation, and assessment services. GAO determined that the design of this action is consistent with internal control standards and applicable guidance for federal executive agencies. For example, the Foundation's interagency agreement with IBC for managing environmental conflict resolution contracts is generally consistent with OMB's Office of Federal Procurement Policy guidance on management and use of interagency acquisitions. For other contracts, the Foundation planned to issue a policy and guidance on internal contracting processes, but it was not finalized at the time of GAO's review.

section_title: Letter
paragraphs: The Morris K. Udall and Stewart L. Udall Foundation (Foundation) was  established as an executive branch agency to provide educational  opportunities related to environmental policy and Native American health  care and tribal policy, and also to assist in resolving environmental  disputes that involve federal agencies. In December 2012, a  Department of the Interior (DOI) Office of Inspector General (OIG) audit of  the Foundation identified significant issues primarily related to the  Foundation’s failure to appropriately monitor and assess the effectiveness  of its internal controls as required, and the absence of key internal  controls over its personnel and contracting practices. The DOI OIG audit  was performed after the Foundation’s Board of Trustees (Board) became  aware of some questionable actions by Foundation employees relating to  these areas. Since the Foundation does not have an internal audit  function, at the suggestion of the Deputy Secretary of the Interior—who  serves as a Board trustee—the Board’s Chair and Vice Chair requested a  review by the DOI OIG under an Economy Act agreement.
Since the release of the DOI OIG audit report, the Foundation’s controls  have been in a significant state of transition and continued to be so during  the time of our audit because of new management’s efforts to develop  and implement changes to improve internal controls over financial  management, including personnel and contracting. You asked us to  review whether the Foundation has sufficient internal controls to ensure  that it is complying with applicable laws and regulations regarding  financial management and contracting. Our objective is to describe the  Foundation’s actions to improve its internal control assessment process  and its controls over personnel and contracting, and determine the extent  to which the design of the Foundation’s actions that have been sufficiently  documented is consistent with internal control standards and applicable  laws and regulations.
subsections: section_title: Scope and Methodology
paragraphs: To address our objective, we (1) obtained and reviewed the DOI OIG  audit report and supporting workpapers; (2) interviewed Foundation  management and selected staff members to determine the extent to  which its actions to improve internal controls and the Federal Managers’  Financial Integrity Act (FMFIA) assessment process have been  sufficiently documented (i.e., whether such changes have been issued in  final form or whether draft policies of planned changes have been  reviewed by senior management and the in-house General Counsel);   (3) obtained and reviewed documentation related to the Foundation’s  actions to improve internal controls and its FMFIA assessment process;  and (4) assessed the Foundation’s actions against the criteria established  under Standards for Internal Control in the Federal Government,of Management and Budget (OMB) Circular No. A-123, Management’s  Responsibility for Internal Control (December 21, 2004) (OMB Circular   Office  No. A-123),Federal Acquisition Regulation (FAR). The scope of our work did not  include performing procedures to validate the findings included in the DOI  OIG audit report. We discussed with DOI OIG officials responsible for  conducting the audit at the Foundation the audit procedures they  performed and reviewed supporting DOI OIG workpapers. We also met  with Foundation management responsible for responding to the DOI OIG  audit report and developing corrective action plans. These procedures  allowed us to gain an understanding of the DOI OIG’s work performed,  the conclusions drawn, and management’s response to the DOI OIG  audit report.   other OMB guidance concerning contracting, and the  We conducted this performance audit from May 2013 to December 2013  in accordance with generally accepted government auditing standards.  Those standards required that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Background
paragraphs: The Foundation was established as an independent executive branch  agency in 1992 to honor Morris K. Udall’s 30 years of service in the U.S.  House of Representatives as a leader on issues related to the  environment and Native Americans. In 2009, its authorizing legislation  was amended to also honor Stewart L. Udall’s public service legacy. The  Foundation is committed to educating a new generation of Americans to  preserve and protect their national heritage through scholarship,  fellowship, and internship programs focused on environmental and Native  American issues. The Foundation consists of the Morris K. Udall and  Stewart L. Udall Trust Fund, which is used to operate the Foundation’s  education programs, and the Environmental Dispute Resolution Fund.  The latter fund is available to the Foundation to operate the U.S. Institute  for Environmental Conflict Resolution, which was established by the  Environmental Policy and Conflict Resolution Act of 1998 to promote the  principles and practices of environmental conflict resolution and to assist  in resolving conflict over environmental issues involving federal agencies.  The Foundation depends on federal appropriations for the majority of its  operations and received no-year appropriations of roughly $6.0 million in  fiscal years 2012 and 2013.
Under its authorizing legislation, the Foundation is subject to the  supervision and direction of the Board, which is to consist of 13 trustees,  11 of whom are to be voting members of the Board. The authorizing  legislation charges the Board with appointing the Executive Director and  setting his or her compensation. Further, the Foundation’s operating  procedures provide that it is the Board’s role and duty to appoint senior  management staff members and set their compensation; approve the  organizational structure for the staff of the Foundation; approve the  Foundation’s budget and arrange for an annual financial audit; set  policies, including internal controls, for the conduct and management of  the agency’s finances, personnel, and programs to be implemented by its  staff; and approve the strategic direction and priorities for the Foundation.
subsections: section_title: DOI OIG Audit Report
paragraphs: The DOI OIG’s December 2012 audit report of the Foundation concluded  that—despite signed statements of assurance by the former Executive  Director claiming otherwise—the Foundation had not appropriately  assessed the effectiveness of its internal controls for at least 6 fiscal  years from 2006 through 2011 and was thus not in compliance with  FMFIA. Under FMFIA and implementing guidance, federal executive  agencies must establish internal control and financial systems that  provide reasonable assurance of achieving the following three objectives  of internal control: effectiveness and efficiency of operations, compliance  with regulations and applicable laws, and reliability of financial reporting.  FMFIA also requires the agency head to provide an annual statement of  assurance on whether the agency has met these requirements. OMB  Circular No. A-123 defines management’s responsibility for internal  control in federal executive agencies, including maintaining the  appropriate level of documentation and continuously monitoring the  effectiveness of internal control during the normal course of business. In  relation to internal control over financial reporting, this includes  documenting both the controls in place and the assessment process and  methodology that management used to support its assertion as to the  effectiveness of internal control, and performing monitoring activities that  include direct testing of the controls as part of the assessment process.
The DOI OIG’s audit report also found that the Foundation was missing  key internal controls over its personnel and contracting practices. The  DOI OIG December 2012 audit report stated that the office does not have  the authority to make formal recommendations to the Foundation to  improve its internal controls. However, the DOI OIG audit report did  include several suggestions for corrective actions for the Foundation’s  consideration.
section_title: The Foundation Is Taking Actions to Improve Its Internal Controls to Comply with Internal Control Standards and Laws and Regulations
paragraphs: The Foundation developed a Corrective Action Plan during fiscal year  2013 to address the findings identified in the DOI OIG audit report and  related financial management weaknesses to improve internal controls  over its key financial management processes. Major elements of the  Corrective Action Plan include performing a complete assessment of the  Foundation’s current internal control structure to identify adequate,  inadequate, and missing controls, and developing (or contracting to have  developed) policies and procedures to implement appropriate internal  controls in all areas where inadequate or missing controls are identified.The Corrective Action Plan included steps to address deficiencies in the  Foundation’s (1) FMFIA internal control monitoring and assessment  process, (2) internal control related to its personnel processes, and   (3) internal control related to its contracting processes. For those actions  that were sufficiently documented at the time of our review, we found that  their design was consistent with internal control standards and applicable  laws and regulations, as discussed in the following sections.
subsections: section_title: Foundation Actions to Improve FMFIA Internal Control Monitoring and the Assessment Process
paragraphs: Since the release of the DOI OIG audit report, the Foundation has  experienced significant turnover in its senior management ranks, and new  management has acknowledged that the Foundation did not (1) maintain  adequate documentation of the controls in place, (2) perform monitoring  activities that included direct testing of the controls as part of the internal  control assessment process required under FMFIA, (3) document the  assessment process and methodology that management used to support  its assertion as to the effectiveness of internal control over financial  reporting, and (4) include appropriate representations from officials and  personnel responsible for monitoring, improving, and assessing internal  controls. In addition, new management at the Foundation acknowledged  that the Foundation’s failure to comply with FMFIA requirements and  implementing OMB Circular No. A-123 guidance contributed to the  financial management weaknesses identified in the DOI OIG audit report.
The Foundation has taken action to comprehensively assess its internal  controls and plans to make changes based on the results of that  assessment. Specifically, the Foundation contracted with an external  consultant to perform an internal control review with an overall goal of  achieving compliance with OMB Circular No. A-123 and Standards for  Internal Control in the Federal Government. We determined that the  design of this action to contract for the performance of a thorough internal  control review is consistent with internal control standards related to  monitoring operations and internal controls and with FMFIA requirements  to monitor and assess the effectiveness of its internal controls.
The scope of work for this review included performing an assessment of  the Foundation’s current internal control structure to identify adequate,  inadequate, and missing controls; recommending improvements to  controls and the control environment; recommending procedures for  annual monitoring and testing of controls; recommending a format for the  annual statement of assurance; and reviewing and recommending  improvements for communication of control responsibilities to its staff.  The Foundation exercised its option to order additional services from the  external consultant to perform an assessment of the implementation of  the recommendations in its report, which was issued in late September  2013. This assessment is expected to be performed from December  2013 to February 2014.
section_title: Foundation Actions to Address Internal Control Deficiencies Related to Personnel
paragraphs: The Foundation acknowledged that it did not have internal controls  related to personnel in the areas of outside employment and termination  of employees. Potential violations of applicable laws and regulations were  detected by the DOI OIG as a result of these deficiencies. The  Foundation’s Corrective Action Plan contained planned changes to  address the two key areas that were cited in the DOI OIG’s audit report.
Outside employment. The DOI OIG concluded that the Foundation  did not comply with the Dual Compensation Act when approving  outside employment activities for employees. As of November 2013,  the Foundation was taking steps to improve its internal controls  related to employees’ outside employment. Specifically, the  Foundation prepared a draft Outside Employment Policy, which  requires Foundation employees to obtain management approval prior  to engaging in any outside employment. As of November 2013, the  draft Outside Employment Policy was in the process of being  reviewed by the Foundation’s General Counsel for compliance with  applicable law and implementing Office of Personnel Management  (OPM) regulations and guidance. According to Foundation officials,  the policy is expected to be finalized in early 2014.
Termination of employees. The DOI OIG audit report cited a lack of  internal controls as the basis for questionable actions that were taken  by Foundation management to encourage employees to either  voluntarily, or involuntarily, leave their Foundation employment. The  Foundation was taking steps to improve its internal controls relating to  termination of staff members’ employment. Specifically, as of  November 2013, the Foundation was updating its personnel policies  to direct that all personnel actions taken must comply with applicable  law and implementing OPM regulations and guidance, and that any  deviation from such regulations and guidance must be documented  and justified in writing. According to Foundation officials, the policy is  expected to be finalized in early 2014.
Because the Foundation’s planned actions to improve its internal controls  related to employees’ outside employment and termination of  employment were not finalized, it was too soon for us to assess the  design of these actions and whether they are consistent with internal  control standards and applicable laws, regulations, and guidance. The  draft Outside Employment Policy and the personnel policies relating to  termination of employees will not be finalized until the Foundation’s  General Counsel and Executive Director and the Board have reviewed  and approved the proposed changes. Once approved, the extent to which  the new personnel-related internal controls and their implementation will  help the Foundation to successfully improve its internal controls and  comply with applicable laws and regulations will require the continued  involvement and vigorous oversight of Foundation management and the  Board.
section_title: Foundation Actions to Address Internal Control Deficiencies Related to Contracting
paragraphs: The bona fide needs rule is based on the Time Statute (31 U.S.C. § 1502(a)).
See the Ethics in Government Act of 1978, which is codified, as amended, in 5 U.S.C.  appendix §§ 401-408. The Director of the Office of Government Ethics has issued  implementing regulations, which are codified, as amended, in 5 C.F.R. parts 2634-41. was not in compliance with the FAR when awarding sole source  contracts. Most of the sole source contracts were justified using the  Alternative Dispute Resolution (ADR) exception to full and open  competition;contracted did not meet the essential elements required for an ADR  exception under FAR 6.302-3 (“acquire services of an expert or  neutral person for any current or anticipated litigation or dispute”).  Further, not all contracts had approved sole source justifications as  required by the FAR, and some justifications contained inaccurate  information;  inappropriately modified some contracts to add additional funding, add  work outside the scope of the contract, extend the period of  performance beyond the original dates, or a combination of these; and awarded what appear to be personal service contracts, which the FAR   but the DOI OIG determined that the work being  defines as contracts characterized by the employer-employee  relationship it creates between the government and the contractor’s  personnel. Obtaining personal services by contract, rather than by  direct hire, circumvents the civil service laws unless Congress has  specifically authorized acquisition of the services by contract.
The Foundation recognized that internal controls for contracting were  deficient and had taken some action and was developing other changes  to correct control deficiencies in this area. According to the Executive  Director, after discussion and approval from the Chair and Vice Chair of  the Board, the Foundation entered into a 5-year interagency agreement  for assisted acquisitions on March 11, 2013, with the DOI Interior  Business Center’s (IBC) Acquisition Services Directorate. IBC provides  comprehensive acquisition services to federal agencies, managing the  entire process from planning, soliciting, and evaluating offers to awarding  and administering contracts through closeout. We determined that the  design of this action is consistent with internal control standards and  applicable guidance for federal executive agencies. Specifically, the  Foundation’s interagency agreement with IBC for managing  environmental conflict resolution contracts is generally consistent with  OMB’s Office of Federal Procurement Policy (OFPP) 2008 policy  guidance on management and use of interagency acquisitions. The  formal agreement generally follows OFPP’s model agreement for an  assisted acquisition, including delineating the roles and responsibilities of  both the requesting (Foundation) and servicing (IBC) agencies throughout  the acquisition life cycle. The agreement is an appropriate strategy for  addressing the findings identified by the DOI OIG in this area and meeting  internal control standards for proper implementation and oversight of  agency contracting activities.
Pursuant to the terms of the interagency agreement, IBC has agreed to  assist the Foundation on contracts related to environmental conflict  resolution activities, including mediation, facilitation, and assessment  services. An IBC official serves as the Contracting Officer for contracts    that IBC awards to private service providers on the Foundation’s behalf. IBC also will provide contracting officer’s representatives (COR) until such  time that Foundation Program Managers become qualified to be  authorized CORs by completing existing training requirements and  receiving Federal Acquisition Institute certification as CORs.agreement, IBC will help the Foundation comply with the bona fide needs  rule by managing funds according to the Foundation’s guidance,  recording transactions in a timely fashion, and implementing and  exercising controls to ensure compliance with all applicable statutory and  regulatory fiscal requirements.
Further, per the agreement, the Foundation will provide IBC with  information on project objectives, deliverables, and schedule milestones,  and IBC will select an appropriate award type based on the nature of the  requirement and associated risk. IBC is responsible for ensuring that the  environmental conflict resolution contracts comply with competition  requirements, including seeking competition unless an exception is  justified and approved at the appropriate level; requiring the Foundation  to furnish supporting rationale and appropriate documentation to support  an exception to competition; and reviewing the sufficiency of the  Foundation’s justification and documentation before approving and  proceeding with a noncompetitive action. The interagency agreement with  IBC also defines the roles and responsibilities for evaluating proposed  contract modifications. Per this agreement, the Foundation is to work with  IBC to evaluate proposals for changes and, if requested by the IBC  Contracting Officer, to participate in negotiation of changes, modifications,  and claims. Further, the Foundation is responsible for ensuring that it is  not authorizing work (making commitments or promises, issuing  instructions to start or stop work, or directing changes), changing any  contractual documents, modifying the scope of work (including the period  of performance), authorizing accrual of costs, or otherwise providing  direction to the contractor, except as expressly authorized in the COR  appointment by IBC’s Contracting Officer. IBC is responsible for working  with the Foundation to evaluate proposals for changes and ensuring that  any modifications to the requirements or price of the award remain within  the overall scope of the original award. The agreement should help in  improving management and oversight on those environmental conflict  resolution contracts being serviced by IBC. The total amount paid on  these environmental conflict resolution contracts was approximately   $2.7 million in fiscal year 2013.
The Foundation has retained responsibility for administrative contracts  and leasing activities. According to the Foundation, in fiscal year 2013, it  paid approximately $780,000 for administrative contracts managed by the  Foundation. Most of the administrative contract costs were onetime  expenditures to address DOI OIG audit findings, such as contracting for  organizational development work, the internal control review, legal review  and assistance, and the cost of the DOI OIG audit. Other administrative  costs are recurring, such as payroll and financial services provided by the  General Services Administration under memorandums of understanding,  and the cost of the annual financial statement audit. The Foundation also  spent $361,000 on leased space at two locations.
The Foundation plans to draft guidance on internal contracting processes  that will be reviewed by the Foundation’s General Counsel and Executive  Director. According to the Foundation, it intends to have a policy  approved and in place by December 15, 2013. The Foundation expects  the policy to state that the FAR guidance should be followed, including its  contract documentation requirements and prohibitions related to personal  services contracts. Because the Foundation’s planned actions to improve  its internal controls related to its management of administrative contracts  were not finalized, it was too soon for us to assess the design of these  actions and whether they are consistent with internal control standards  and applicable laws, regulations, and guidance. However, issuance of a  new internal contracting policy that reinforces the requirements of the  FAR for administrative contracts is a good step in emphasizing the need  for following sound contracting practices.
section_title: Concluding Observations
paragraphs: The Foundation’s continuing implementation of its Corrective Action Plan  and the efforts to make changes in internal controls appear to be moving  the Foundation in the right direction to strengthen its internal controls,  comply with applicable laws and regulations, and improve management’s  ability to make informed decisions. Many of the Foundation’s actions to  improve its internal controls will be in various stages of implementation  over the next few months and possibly longer. Until implementation is  complete, the extent to which these changes will help the Foundation  monitor and improve the effectiveness of its internal controls and comply  with applicable laws and regulations cannot be fully assessed.
section_title: Agency Comments
paragraphs: We provided a draft of this report to the Foundation for comment. In its  written comments, which are reprinted in appendix I, the Foundation  stated that it accepted the results of our audit in full. The Foundation also  provided a summary of the changes it has made in its operations and  structure since the DOI OIG audit report. Further, the Foundation  recognized that more needs to be done and stated that it was committed  to ensuring that all internal controls are adequate and being followed on a  continuous basis.
We are sending copies of this report to the Executive Director of the  Morris K. Udall and Stewart L. Udall Foundation, the Deputy Inspector  General of the Department of the Interior, and the appropriate  congressional committees. In addition, the report is available at no charge  on the GAO website at http://www.gao.gov.
If you or your staffs have any questions about this report, please contact  me at (202) 512-9399 or malenichj@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff members who made key  contributions to this report are listed in appendix II.
section_title: Appendix I: Comments from the Morris K. Udall and Stewart L. Udall Foundation
section_title: Appendix II: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, William Boutboul (Assistant  Director), Lauren S. Fassler, Patrick Frey, Wilfred Holloway, Gail Luna,  Vivian Ly, Cynthia Ma, Mary Quinlan, and William T. Woods made  significant contributions to this report.