Internal Controls: The Morris K. Udall and Stewart L. Udall Foundation Has Made Significant Progress but Needs to Fully Document Certain Policies and Procedures
Released: 2015-11-06T00:00:00

Letter

Background

The Foundation was established as an independent executive branch agency in 1992 to honor Morris K. Udall’s 30 years of service in the House of Representatives as a leader on issues related to the environment and Native Americans. In 2009, its authorizing legislation was amended to also honor Stewart L. Udall’s public service legacy. The Foundation is committed to educating a new generation of Americans to preserve and protect their national heritage through scholarship, fellowship, and internship programs focused on environmental and Native American issues. The Foundation consists of the Morris K. Udall and Stewart L. Udall Trust Fund, which is used to operate the Foundation’s education programs (Education Trust Fund), and the Environmental Dispute Resolution Fund. The latter fund is available to the Foundation to operate the U.S. Institute for Environmental Conflict Resolution (U.S. Institute), which was established by the Environmental Policy and Conflict Resolution Act of 1998 to promote the principles and practices of environmental conflict resolution and to assist in resolving conflict over environmental issues involving federal agencies. The Foundation had 22 full-time employees as of March 31, 2015. The Foundation depends on federal appropriations for the majority of its operations and received no- year appropriations of roughly $5.5 million and $5.4 million in fiscal years 2014 and 2015, respectively.

Under its authorizing legislation, the Foundation is subject to the supervision and direction of the Board of Trustees (Board), which consists of 13 trustees, 11 of whom are voting members of the Board. The authorizing legislation charges the Board with appointing the Executive Director and setting his or her compensation. Further, the Foundation’s operating procedures provide that the Board appoints senior management staff members and sets their compensation; approves the organizational structure for the Foundation’s staff; approves the Foundation’s budget and arranges for an annual financial audit; sets policies, including internal controls, for the conduct and management of the agency’s finances, personnel, and programs to be implemented by its staff; and approves the strategic direction and priorities for the Foundation. Over the past 3 years, the Foundation has undergone several external reviews of its internal control policies and procedures, as shown in figure 1.

The Foundation developed a Corrective Action Plan during fiscal year 2013 to address the findings identified in the DOI OIG December 2012 audit report and related financial management weaknesses the Foundation identified and to improve internal controls over its key financial management processes. Major elements of the fiscal year 2013 Corrective Action Plan included (1) performing a complete assessment of the Foundation’s current internal control structure to identify adequate, inadequate, and missing controls and (2) developing (or contracting to have developed) policies and procedures to implement appropriate internal controls in all areas where inadequate or missing controls were identified.

In 2013, the Foundation contracted with an external consultant to perform an internal control review with an overall goal of achieving compliance with OMB Circular No. A-123 and Standards for Internal Control in the Federal Government. The external consultant’s September 2013 report assessed the Foundation’s implementation of 34 control activities and found no significant deficiencies. Specifically, the external consultant reported that 25 control activities were adequate, 7 control activities had operational deficiencies, and 2 had design deficiencies. The Foundation exercised its option to order additional services from the external consultant to perform a follow-up report assessing the implementation of the recommendations included in its September 2013 report. In February 2014, the external consultant issued its follow-up report, which reported that all seven operational deficiencies and one of the design deficiencies had been corrected. Although the other design deficiency, which was related to controls over the delegation of authority, had not been corrected, the external consultant reported that the Foundation had implemented compensating controls in this area.

In January 2014, the Foundation’s fiscal year 2014 appropriation assigned the DOI OIG responsibility for providing oversight for the Foundation and provided funding to the DOI OIG to conduct investigations and audits of the Foundation.

In September 2014, the DOI OIG issued an inspection report on the Foundation’s internal controls. The DOI OIG’s report objectives were to determine whether the Foundation’s internal controls were consistent with accepted internal control standards and applicable laws and regulations in the areas of (1) personnel actions, (2) contracting actions, and (3) internal control monitoring and assessment processes under FMFIA. Its review was limited to the design of the internal controls at the Foundation and did not include a determination as to whether the internal controls were operating effectively. The DOI OIG concluded that in the areas reviewed, the Foundation’s internal controls appeared consistent with accepted standards and applicable regulations. However, the DOI OIG (consistent with GAO’s December 2013 report) noted that the extent to which the new internal controls help the Foundation successfully comply with applicable laws and regulations will depend on the continued involvement and rigorous oversight of the Board.

In December 2014, the Foundation renewed its 5-year interagency agreement for assisted acquisitions with the DOI Interior Business Center’s (IBC) Acquisition Services Directorate. With the exception of contracts below the micropurchase threshold of $3,000, the agreement specifies that IBC will perform technical evaluations of contract proposals and award contracts on the Foundation’s behalf, based on best value and within Federal Acquisition Regulation (FAR) guidelines. IBC provides comprehensive acquisition services to federal agencies, managing the entire process from planning, soliciting, and evaluating offers to awarding and administering contracts through closeout. Pursuant to the terms of the interagency agreement, IBC has agreed to assist the Foundation on contracts related to environmental conflict resolution activities, including mediation, facilitation, and assessment services. An IBC official serves as the Contracting Officer for contracts that IBC awards to private service providers on the Foundation’s behalf.

The Foundation Has Made Significant Progress in Improving Its Internal Control Environment and Performed Risk Assessment and Monitoring Activities

The Foundation has made significant progress in improving its internal control environment by hiring experienced senior-level management officials, establishing a senior leadership team, and providing internal control and ethics training. The Foundation has also made significant progress in improving its risk assessment activities by conducting a risk assessment survey and developing written internal control policies and procedures. Foundation management gains knowledge about the daily operation of internal controls from the direct involvement it has with the operations of the Foundation’s programs and activities. Such knowledge serves as an important part of the Foundation’s monitoring activities and provides the primary basis for management’s annual internal control assessment.

Significant Progress Made in Improving Internal Control Environment

The Foundation has made significant progress in developing and implementing changes to improve its internal control environment, including the following.

Hiring of experienced senior-level management. In July 2013, the Foundation hired a General Counsel with extensive experience in providing legal advice in the areas of contracts, personnel, ethics, fiscal, bankruptcy, and administrative law. The General Counsel has been involved in updating and developing several of the Foundation’s personnel and ethics policies for compliance with applicable federal service and government ethics laws and implementing regulations. In June 2014, the Foundation hired a new Director of Finance and Operations with extensive experience in implementing and improving internal controls at other federal government agencies, and who has been involved in conducting risk assessments and improving internal controls at the Foundation.

Establishing a senior leadership team. The Foundation established the Foundation Leadership Team (FLT) consisting of six senior executives including the Executive Director, General Counsel, Director of Finance and Operations, Director of the U.S. Institute, Director of Education Programs, and Director of the Washington, D.C., office. The FLT, with authority from the Executive Director, is responsible for, among other things, assessing internal control over financial reporting. This includes clearly communicating the objectives of the risk assessment survey.

Providing internal control and ethics training. The Director of Finance and Operations has conducted training on internal control with Foundation staff, which covered the definition of internal control, common internal controls, why internal control is required, and the five elements of internal control included in Standards for Internal Control in the Federal Government, among other internal control-related matters. In addition, the General Counsel has conducted ethics training with Foundation staff, which covered ethical principles, laws governing federal employee conduct, the Office of Government Ethics’ regulations entitled Standards of Ethical Conduct for Employees of the Executive Branch, conflicts of interest, outside activities, and postemployment restrictions. The General Counsel has also provided ethics training to the Board, which covered many ethical principles applicable to members of the Board.

Significant Progress Made in Improving Risk Assessment Activities

The Foundation has also made significant progress in developing and implementing changes to improve its risk assessment activities, including the following.

Conducting a risk assessment survey. The FLT surveyed all of the Foundation’s employees regarding the impacts and likelihood of the most significant risks to the Foundation and asked the employees to indicate the elements in their work that they considered most vulnerable. The Executive Director, the Director of Finance and Operations, the General Counsel, and the Director of Education Programs used the results of the employee risk assessment survey, which included the identification of over 130 different risks, to prioritize the most significant risks to the Foundation.

Based on this prioritization, the most significant risks identified by the FLT included documentation and communication of the contract procurement process, purchase card use, the travel process, and travel card use. According to documents from the October 16, 2014, Board meeting, the Director of Finance and Operations stated that the Foundation’s short-term vision for internal controls is to continuously evaluate the Foundation’s work and improve internal controls, along the way eliminating the most significant risks identified in the employee risk assessment survey, over time ensuring that the items being resolved will be of lower risk. In addition, the FLT plans to use the results of the employee risk assessment survey, and other assessment activities, to assess internal control over financial reporting and to develop further internal control policies and procedures in the most significant risk areas. Foundation management indicated that continuous risk assessment and monitoring will be performed and improved upon each year. The Foundation also communicated the results of the employee risk assessment survey to Foundation staff, including the most significant risks identified by the FLT. The Foundation has developed, or is in the process of developing, formal written policies related to those risks, which included documentation and communication of the contract procurement process, purchase card use, the travel process, and travel card use.

Developing written internal control policies and procedures. The Foundation has developed, or is in the process of developing, written internal control policies and procedures. For example, since July 1, 2014, the Foundation updated or implemented the following changes to its documented internal control policies and procedures.

Travel. Implemented mandatory annual training requirement for travelers; required staff arranging lodging and meetings for large groups to use the process to request quotes from outside vendors or contractors to increase competition; required the Foundation to negotiate a lower per diem rate for staff in travel status over 30 days; implemented the Director of Finance and Operations review of all travel vouchers prior to their being approved for payment; and required all staff to fly to destinations using federal city-pair fares when available.

Purchase cards. Implemented mandatory annual training requirements for purchase card holders; reduced the number of purchase card holders to three (two in Tucson, one in Washington, D.C.); and required purchases over the micropurchase threshold to be procured with a purchase order rather than a purchase card.

Procurement process. Issued a draft of a new internal contracting policy that reinforces adherence to the requirements of the FAR by entering into an interagency agreement with the IBC for both assisted acquisition contracts and administrative service contracts.

Other. Completed the creation of position descriptions for all Foundation staff, including the review of the position descriptions by the General Services Administration (GSA); created a Foundation pay schedule; created a standardized form for performance plans; and implemented the requirement for maintaining an inventory of sensitive property.

According to Foundation officials, the FLT plans to use the results of the risk assessment survey, and other assessment activities, to continue developing internal control policies and procedures for those areas in which formal written internal control policies and procedures have not been developed, including areas in which internal control activities have been implemented but not documented in the Foundation’s internal control policies and procedures.

Management Performed Monitoring Activities to Provide the Primary Basis for Its Required Internal Control Assessment and Considered Appropriate Sources of Information

In its fiscal year 2014 AFR, Foundation management provided an unqualified statement of assurance that internal controls in effect, from October 1, 2013, through September 30, 2014, provided reasonable assurance that the Foundation met the objectives of FMFIA. The Executive Director and the Director of Finance and Operations are integrally involved in substantially all of the Foundation’s financial transactions and activities. For example, the Executive Director and the Director of Finance and Operations review and approve contracts related to environmental conflict resolution activities, receipt of invoices, invoices for payment, credit card authorizations, employees’ biweekly payroll, and the monthly reconciliations of cash receipts and disbursements. As such, Foundation management gains knowledge about the daily operation of internal controls from the direct involvement it has with the operations of the Foundation’s programs and activities. Such knowledge serves as an important part of the Foundation’s monitoring activities and provides the primary basis for management’s annual internal control assessment. In addition to management’s knowledge gained from its integral and substantial involvement in the daily operations of the Foundation, management also considered the following sources of information, as suggested in the FMFIA implementing guidance in OMB Circular No. A-123, that contributed to the basis and support for the annual internal control assessment:

External consultant’s assessments of internal control. As reported in our December 2013 report, the Foundation took action to comprehensively assess its internal controls and planned to make changes based on the results of that assessment. Specifically, the Foundation contracted with an external consultant to perform an internal control review with an overall goal of achieving compliance with OMB Circular No. A-123 and Standards for Internal Control in the Federal Government. In our December 2013 report, we determined that the design of this action was consistent with internal control standards related to monitoring operations and internal controls and with FMFIA requirements to assess the effectiveness of internal controls.

The scope of work for the external consultant’s review included performing an assessment of the Foundation’s internal control structure at the time of the review to identify adequate, inadequate, and missing controls; recommending improvements to controls and the control environment; recommending procedures for annual monitoring and testing of controls; recommending a format for the annual statement of assurance; and reviewing and recommending improvements for communication of control responsibilities to the Foundation’s staff. The external consultant’s September 2013 report assessed the Foundation’s implementation of 34 control activities and identified no significant deficiencies. Of these, the external consultant determined that 25 control activities were adequate, 7 control activities had operational deficiencies, and 2 had design deficiencies. The seven operational deficiencies were related to contracting, charge card purchasing, records administration, data integrity, overtime and compensatory time policy, safety procedures, and food and refreshment policy for meetings. The two design deficiencies related to delegation of authority and property disposition. The Foundation exercised its option to order additional services from the external consultant to perform a follow-up report assessing the implementation of the recommendations included in its September 2013 report.

The external consultant issued its follow-up report in February 2014 assessing the Foundation’s implementation of the recommendations included in the external consultant’s September 2013 report, which found that all seven operational deficiencies and the property disposition design deficiency identified in its September 2013 report had been corrected. The delegation of authority design deficiency had not been corrected, but compensating controls were put in place that the external consultant determined adequately compensated for any weakness caused by the control deficiency. The external consultant’s follow-up report concluded as follows: “Risk assessment has been strengthened by establishing the Director of Finance and Operations position and including risk assessment as part of the Director of Finance and Operations position description. Many improvements have been made to strengthen internal controls over the past year. A majority of the recommendations contained in the first report have already been implemented. The Foundation has made a concerted effort, and continues to take actions to ensure compliance with the requirements of OMB Circular No. A-123 and associated laws.”

DOI OIG’s assessments of internal control. In September 2014, the DOI OIG performed a review of the Foundation to determine whether the Foundation’s internal controls were consistent with accepted internal control standards and applicable laws and regulations in the areas of (1) personnel actions, (2) contracting actions, and (3) internal control monitoring and assessment processes under FMFIA. The DOI OIG review was limited to the design of the internal controls at the Foundation and did not include a determination as to whether the internal controls were operating effectively. The DOI OIG concluded that the Foundation’s internal controls in the areas reviewed appeared consistent with accepted standards and applicable regulations.

Audit of the Foundation’s fiscal year 2014 financial statements. During its audit of the Foundation’s financial statements for the year ended September 30, 2014, the Foundation’s independent auditor identified no deficiencies in internal controls that were considered a material weakness or a significant deficiency in financial reporting.

Reviews of financial management systems. GSA performs payroll and financial services for the Foundation. These services include furnishing all necessary payroll support functions, receipt and disbursement of funds, financial reporting and related accounting functions, and execution of all investments in Department of the Treasury obligations. GSA is considered to be part of the Foundation’s financial management; however, Foundation management is responsible for the integrity and objectivity of the financial information presented in the financial statements.

To support management’s annual assurance statement in its fiscal year 2014 AFR for the financial and payroll services provided by GSA, the Foundation relied on the independent service auditor’s Statement on Standards for Attestation Engagements (SSAE) No. 16 reports on GSA’s (1) Pegasys Financial Management System and (2) Payroll Accounting and Reporting (PAR) System. The SSAE No. 16 reports on the Pegasys Financial Management System and the PAR System covered the period of July 1, 2013, to June 30, 2014, and both were unqualified opinions. In addition, the Foundation also relied on the letters from GSA that notified the Foundation that from July 1, 2014, through September 30, 2014, there were no significant changes to the system controls for the Pegasys Financial Management System and the PAR System.

Significant Progress Has Been Made in Designing and Implementing Effective Internal Control over Certain Personnel and Contracting Practices, but Related Policies Were Not Yet Fully Documented

The Foundation has made significant progress in designing and implementing internal control activities and improving internal control over certain of its personnel and contracting practices, which were highlighted in our December 2013 report. For example, the Foundation has developed a formal written Disciplinary Policy and an Outside Employment Policy and is in the process of drafting guidance for its contracting practices. In addition, the Foundation has implemented internal control activities over certain of its personnel and contracting practices. For example, we found that management reviewed and approved an employee’s completed outside employment application and the Contracting Officer’s Representative coordinated with the Program Managers to determine that all contracted work that has been billed is complete. However, the Foundation has not developed formal written internal control policies related to the hiring and separation of employees.

Design and Implementation of Internal Control over Certain Personnel Practices

Most of the payroll activities, including processing employee time cards and issuing payments, are outsourced to GSA through an interagency agreement that specifies that GSA serves as the principal advisor on matters related to human resource management. However, the Foundation maintains responsibility for all other personnel functions. The Foundation’s General Counsel has issued certain personnel policies, such as the Disciplinary Policy and the Outside Employment Policy, to help ensure that the Foundation’s policies comply with applicable federal civil service and government ethics laws and implementing regulations. However, the Foundation did not have formal written policies related to the hiring and separation of employees. Despite this, we found that controls over employee hiring, separation, and outside employment had been implemented effectively during our period of review.

Design of internal controls over employee hiring and separations. The Foundation acknowledged that it did not have formal written internal control policies and procedures related to the hiring of employees and did not have complete formal written internal control policies related to the separation of employees, including those who separate voluntarily (such as through retirement or a change in employment) or involuntarily. The General Counsel has developed the formal written Disciplinary Policy for an employee’s removal pursuant to disciplinary action and poor performance, which relates to involuntary separations.

Foundation officials stated that they had not yet documented these internal control policies and procedures because they focused their efforts during fiscal year 2015 on (1) developing formal written internal control policies and procedures that were identified by the FLT’s risk assessment survey and (2) implementing control activities in areas in which the Foundation has not yet had the opportunity to develop formal written internal control policies and procedures. During our previous audit, Foundation officials informed us that they planned to develop and complete formal written internal control policies and procedures over certain personnel practices by early 2014, such as the Disciplinary Policy and Outside Employment Policy. However, such plans did not include developing formal written internal control policies and procedures for hiring of employees and certain other separation processes, and the Foundation’s Corrective Action Plan did not include plans to do so.

Federal standards for internal control require that internal control and all transactions and other significant events need to be clearly documented, and the documentation should be readily available for examination. The documentation should appear in management directives, administrative policies, or operating manuals and may be in paper or electronic form. All documentation and records should be properly managed and maintained. A lack of formal written internal control policies and procedures related to the hiring and separation of employees increases the risk that (1) procedures related to hiring and separations, such as management’s review and approval of an employee’s qualifications and proposed salary before hire and ensuring that separated employees are properly removed from the payroll, may not be properly or consistently carried out and (2) applicable laws and implementing regulations may not be consistently followed.

Implementation of internal controls over employee hiring. Although the internal control policies and procedures were not fully documented, we found that the Foundation had sufficiently implemented key internal control activities related to the hiring of employees. We interviewed Foundation officials and conducted walkthroughs of specific new hire transactions and determined that the Foundation performed certain key internal control activities relating to the hiring of employees during the test period of our audit. Such key internal control activities included management’s review of GSA position descriptions and noting that each new employee’s salary was within the range of pay in the GSA position description, management’s review and approval of the new employee’s Office of Personnel Management (OPM) request for personnel action, management’s review of monthly detailed spreadsheets attesting to the addition of the new employee, and management’s review of monthly reports attesting to the addition of the new employee’s salary. We assessed the design of these key internal control activities and found them to be consistent with criteria in Standards for Internal Control in the Federal Government. We tested these key internal control activities for all five employees who were newly hired during the test period of our audit, and found that they had been implemented effectively.

Implementation of internal controls over employee separations. Similar to hiring, we found that although the separation policies and procedures were not fully documented, the Foundation had sufficiently implemented key internal control activities related to the separation of employees. We interviewed Foundation officials and conducted walkthroughs of specific employee separation transactions and determined that the Foundation performed certain key internal control activities related to the separation of employees during the test period of our audit. Such key internal control activities included management’s review and approval of the separated employee’s OPM request for personnel action, management’s review of monthly detailed spreadsheets attesting to the removal of the employee, and management’s review of monthly reports attesting to the removal of the employee’s salary. We assessed the design of these key internal control activities and found them to be consistent with criteria in Standards for Internal Control in the Federal Government. We tested these key internal control activities for all eight employees who voluntarily separated during the test period of our audit, and found that they had been implemented effectively. There were no involuntary separations during the period of our review.

Design and implementation of internal controls over outside employment. The Foundation has a formal written Outside Employment Policy, which requires employees to obtain management approval prior to engaging in any outside employment, whether that employment is compensated or voluntary. Based on our review of the Outside Employment Policy, interviews of Foundation officials, and walkthroughs of specific outside employment transactions during the test period of our audit, we identified the Foundation’s key internal control activities for employees engaging in outside employment. Such key internal control activities included each employee’s completed outside employment application; management’s review and approval of the employee’s completed outside employment application; and a legal opinion prepared by the General Counsel, which included a review of applicable statutory and regulatory provisions to ensure that the employee was in compliance with applicable laws and regulations. We assessed the design of these key internal control activities and found them to be consistent with criteria in Standards for Internal Control in the Federal Government. We tested these key internal control activities for all four employees who applied for outside employment during the test period of our audit, and found that the Foundation’s key internal control activities for outside employment were implemented effectively in accordance with the Foundation’s Outside Employment Policy.

Design and Implementation of Internal Control over Contracting Practices

The Foundation’s interagency agreement with IBC helps improve management and oversight of the environmental conflict resolution contracts that IBC services. The total amount paid on the environmental conflict resolution contracts was approximately $2.0 million for the 9- month period July 1, 2014, through March 31, 2015. In December 2014, the Foundation modified its agreement with IBC to include administrative contracts, which effectively removed the Foundation completely from the awarding and administration of contracts. As IBC is much more experienced in acquisition matters, this modification assists the Foundation in implementing sound contracting practices.

Accordingly, the Foundation’s draft guidance over its contracting practices focuses on (1) the steps leading up to the submission of contracting transactions and information to IBC and (2) the reconciliation of the output of contracting activity to the reports received from IBC. The draft guidance details certain key internal control activities that the Foundation has implemented in this area. However, we noted that not all key internal control activities were included in the Foundation’s draft guidance. For example, the key control activity to document evidence of management’s receipt and review of contractors’ invoices, including a comparison of the scope and nature of services provided and labor hours billed, was not included in the draft guidance. Federal standards for internal control require that internal control and all transactions and other significant events be clearly documented and that the documentation be readily available for examination. Foundation officials stated that they had not yet fully documented and finalized internal control policies and procedures related to contracting because, as noted previously, they focused their efforts on implementing control activities in areas in which the Foundation had not yet developed formal written policies and procedures. As documented in its Corrective Action Plan, Foundation management planned to update and finalize its formal written internal control policies and procedures over its contracting practices. However, the Corrective Action Plan did not establish a date by which the Foundation planned to complete the action to fully update and finalize its formal written internal control policies and procedures over its contracting practices. A lack of fully developed and finalized written internal control policies and procedures related to the Foundation’s contracting practices increases the risk that procedures related to its contracting practices may not be consistently carried out, which in turn increases the risk that the Foundation may, for example, pay for erroneous amounts billed.

Based on our review of the Foundation’s draft guidance on its contracting practices, interviews of Foundation officials, and walkthroughs of specific contracting transactions during the test period of our audit, we identified the Foundation’s key internal control activities. Such key internal control activities included management approval of checklists attesting that no conflicts of interest exist; evidence of management review and approval of contracts; and evidence of management receipt and review of contractor invoices, including a comparison of the scope and nature of services provided and labor hours billed. We assessed the design of these key internal control activities by comparing them to the criteria in Standards for Internal Control in the Federal Government and found them to be consistent with federal internal control standards. As discussed in the section below, we performed testing on a randomly selected statistical sample of contracting disbursements during the test period of our audit, and found that the Foundation’s key internal control activities over its contracting practices were implemented effectively in accordance with the Foundation’s draft guidance and other key internal control activities not yet documented.

The Foundation Effectively Designed and Implemented Internal Control over Receipts and Disbursements Activity

The Foundation has designed formal written internal control policies and procedures for processing receipts activity and disbursements activity (consisting of payroll, contracting, and other expense transactions). Based on our review of these internal control policies and procedures, we identified the key internal control activities related to the processing of receipts and disbursements, compared them to the criteria in Standards for Internal Control in the Federal Government, and found them to be consistent with federal internal control standards. We selected and tested random statistical samples of receipt and disbursement transactions for the test period of our audit and determined that the Foundation’s key internal control activities over the processing of its receipts and disbursements activity were implemented effectively in accordance with its formal written internal control policies and procedures.

Design and Implementation of Internal Control over Receipts

The Foundation has formal written internal control policies and procedures for processing its receipts activity. Based on our review of these internal control policies and procedures, interviews of Foundation officials, and walkthroughs of specific receipt transactions during the test period of our audit, we identified the Foundation’s key internal control activities for processing its receipts activity. Such key internal control activities included supervisory review of project data in the Foundation’s Program Management Database (PMD); management review and approval of all invoices, such as invoices for training services provided to external parties in PMD; and management review of the invoices spreadsheet attesting to the total amount of invoices. We assessed the design of these key internal control activities by comparing them to the criteria in Standards for Internal Control in the Federal Government and found them to be consistent with federal internal control standards. We selected and tested a random statistical sample of 36 receipt transactions made during the test period of our audit, and found that the Foundation’s key internal control activities over the processing of its receipts activity were implemented effectively in accordance with the Foundation’s formal written internal control policies and procedures.

Design and Implementation of Internal Control over Disbursements

The Foundation’s disbursements activity consists of payroll, contracting, and other expense transactions. For services for which IBC pays the contractor and seeks reimbursement from the Foundation through GSA, GSA asks the Foundation which fund should be used to pay IBC. GSA charges the amount against the Foundation’s obligation balance and transfers the funds to IBC from the Foundation’s Fund Balance with Treasury account. For other expense transactions, such as rent and supplies, the Foundation receives vendor invoices and bills, which it then submits to GSA for payment to the vendor.

Payroll disbursements. The Foundation has formal written internal control policies and procedures for processing its payroll disbursements activity. Based on our review of these internal control policies and procedures, interviews of Foundation officials, and walkthroughs of specific payroll disbursement transactions during the test period of our audit, we identified the Foundation’s key internal control activities for processing employee payroll. Such key internal control activities included management’s review and approval of requests for personnel actions, management’s review of monthly detailed spreadsheets attesting to the correct salary for employees, supervisory review of employees’ time cards and amendments, and management review and electronic sign-off on employees’ time cards and amendments. We assessed the design of these key internal control activities by comparing them to the criteria in Standards for Internal Control in the Federal Government and found them to be consistent with federal internal control standards. We randomly selected 10 biweekly pay periods from the 9-month period of our audit and then randomly selected five transactions from each pay period, which resulted in 50 payroll disbursement transactions during the test period of our audit. Based on our selection and testing of these payroll disbursement transactions, we found that the Foundation’s key internal control activities over the processing of its payroll disbursements activity were implemented effectively in accordance with the Foundation’s formal written internal control policies and procedures.

Contracting disbursements. The Foundation has formal written internal control policies and procedures for processing its contracting disbursements activity. Based on our review of these internal control policies and procedures, interviews of Foundation officials, and walkthroughs of specific contracting disbursements transactions during the test period of our audit, we identified the Foundation’s key internal control activities for processing its contracting disbursement activity. Such key internal control activities included management approval of checklists attesting that no conflicts of interest exist; evidence of management review and approval of contracts; and evidence of management receipt and review of contractor invoices, including a comparison of the scope and nature of services provided and labor hours billed. We assessed the design of these key internal control activities by comparing them to the criteria in Standards for Internal Control in the Federal Government and found them to be consistent with federal internal control standards. We selected and tested a random statistical sample of 37 contracting disbursement transactions made during the test period of our audit, and found that the Foundation’s key internal control activities over the processing of its contracting disbursements activity were implemented effectively in accordance with the Foundation’s formal written internal control policies and procedures.

Other expense disbursements. The Foundation has formal written internal control policies and procedures for processing its other expense disbursements activity, such as rent and utilities. Based on our review of these internal control policies and procedures, interviews of Foundation officials, and walkthroughs of specific other expense disbursement transactions during the test period of our audit, we identified the Foundation’s key internal control activities for processing other expense disbursements. Such key internal control activities included supervisory review of invoices; evidence of management receipt of invoices; management’s review and approval of all credit card authorization forms; and management’s review and approval of all invoices, which included evidence of receipt of services. We assessed the design of these key internal control activities by comparing them to the criteria in Standards for Internal Control in the Federal Government and found them to be consistent with federal internal control standards. We selected and tested a random statistical sample of 50 other expense transactions made during the test period of our audit, and found that the Foundation’s key internal control activities over the processing of its other expense disbursements activity were implemented effectively in accordance with the Foundation’s formal written internal control policies and procedures.

Conclusions

Since the release of GAO’s report in December 2013, the Foundation has made significant progress in improving its internal control environment, risk assessment, and monitoring activities; designing and implementing internal control activities over certain of its personnel and contracting practices; and designing and implementing internal control activities over its receipts and disbursements activity. However, we found that the Foundation had not documented formal written internal control policies and procedures for its hiring of employees and certain other separation processes and did not include plans to do so in its Corrective Action Plan. In addition, the Foundation had not fully updated and finalized formal written internal control policies and procedures for its contracting practices, including all key internal control activities, such as evidence of management’s receipt and review of contractors’ invoices, and had not established a date by which it planned to complete the action to finalize its policies and procedures for its contracting practices. Until the Foundation fully documents its internal control policies and procedures for certain of its personnel practices, and updates and finalizes its draft guidance for its contracting practices, there is an increased risk that procedures in these areas may not be consistently carried out, which in turn increases the risk that (1) employees could be hired or separated improperly and applicable laws and implementing regulations may not be consistently followed and (2) the Foundation may pay for erroneous amounts billed.

Recommendations for Executive Action

We recommend that the Foundation’s Executive Director take the following two actions:

Fully document the Foundation’s internal control policies and procedures related to the hiring and separation of employees.

Update the Foundation’s draft written policies and procedures over its contracting practices to include all key internal control activities, issue them in final form, and establish a date by which these actions will be completed.

Agency Comments

We provided a draft of this report to the Foundation for comment. In its written comments, which are reprinted in appendix II, the Foundation concurred with our recommendations and stated that it will implement the recommended actions. In addition, the Foundation stated that our recommendations will be incorporated in the Foundation’s risk assessment documentation, established as a priority, and included in the Foundation’s fiscal year 2016 Corrective Action Plan.

We are sending copies of this report to the Executive Director of the Morris K. Udall and Stewart L. Udall Foundation, the Deputy Inspector General of the Department of the Interior, and interested congressional committees. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-9399 or malenichj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine the extent to which the Morris K. Udall and Stewart L. Udall Foundation (Foundation) has (1) made progress in improving its internal control environment, risk assessment, and monitoring activities; (2) designed and implemented effective internal control over certain of its personnel and contracting practices; and (3) designed and implemented effective internal control over its receipts and disbursements activity (consisting of payroll, contracting, and other expense transactions).

The scope of our audit was the 9-month period July 1, 2014, through March 31, 2015. The Foundation was in the process of making significant changes to its internal control policies and procedures during the first 6 months of calendar year 2014. Therefore, we selected the 9-month period July 1, 2014, through March 31, 2015, as the period of our audit because the transactions in this time period would have been processed under more of the Foundation’s newly developed internal control policies and procedures.

Internal Control Environment, Risk Assessment, and Monitoring Activities

To determine the extent to which the Foundation has improved its internal control environment, risk assessment, and monitoring activities, we considered the criteria in the Federal Managers’ Financial Integrity Act (FMFIA); Standards for Internal Control in the Federal Government; and the implementing guidance in the Office of Management and Budget’s (OMB) Circular No. A-123, Management’s Responsibility for Internal Control, which defines management’s responsibility for internal control in federal agencies. We interviewed Foundation officials regarding the formal written internal control policies and procedures that management has developed and implemented and other actions management has taken to improve its internal control environment. We also interviewed Foundation officials about internal risk assessment and monitoring activities that management performed. In addition, we reviewed the agency financial report for fiscal year 2014 to determine management’s conclusions on the Foundation’s internal controls. Further, we interviewed Foundation officials and reviewed documentation regarding how they developed internal control assurance statements and the sources of information that provided the basis for the Foundation’s annual assessment of and report on internal control under FMFIA.

Internal Control over Certain Personnel and Contracting Practices

To determine the extent to which the Foundation designed effective internal control over certain of its personnel and contracting practices, we interviewed Foundation officials, reviewed written internal control policies and procedures, and performed walkthroughs of specific transactions to inform our understanding of the internal control environment. We also obtained, analyzed, and summarized the Foundation’s written internal control policies and procedures related to certain of its personnel and contracting practices for the 9-month period July 1, 2014, through March 31, 2015, and compared them to the criteria in Standards for Internal Control in the Federal Government.

To test the implementation of internal controls over certain of the Foundation’s personnel practices, we tested key internal control activities for all new hires, separations of employees, and outside employment transactions.

Personnel Practices

1. Hiring. For the 9-month period July 1, 2014, through March 31, 2015, we tested the key control activities for all five newly hired employees. We assessed the design of these key internal control activities by comparing them to the criteria in Standards for Internal Control in the Federal Government to determine whether these key internal control activities were consistent with federal internal control standards. We tested these key control activities by inspecting the following: management’s review of General Service Administration (GSA) position descriptions and noting that each new employee’s salary was within the range of pay in the GSA position description, management’s review and approval of the new employee’s Office of Personnel Management (OPM) request for personnel action, management’s review of monthly detailed spreadsheets attesting to the addition of the new employee, and management’s review of monthly reports attesting to the addition of the new employee’s salary. 2. Separations. For the 9-month period July 1, 2014, through March 31, 2015, we tested the key control activities for all eight separated employees. We assessed the design of these key internal control activities by comparing them to the criteria in Standards for Internal Control in the Federal Government to determine whether these key internal control activities were consistent with federal internal control standards. We tested these key control activities by inspecting the following: management’s review and approval of the separated employee’s OPM request for personnel action, management’s review of monthly detailed spreadsheets attesting to the removal of the employee, and management’s review of monthly reports attesting to the removal of the employee’s salary. 3. Outside employment. For the 9-month period July 1, 2014, through March 31, 2015, we tested the key control activities for all four employees who applied for outside employment. We assessed the design of these key internal control activities by comparing them to the criteria in Standards for Internal Control in the Federal Government to determine whether these internal control activities were consistent with federal internal control standards. We tested these key control activities by inspecting the following: the employee’s completed outside employment application; management’s review and approval of the employee’s completed outside employment application; and a legal opinion prepared by the General Counsel, which included a review of applicable statutory and regulatory provisions to ensure that the employee was in compliance with applicable laws and regulations.

Contracting Practices

To test the implementation of internal controls over contracting practices, we conducted tests of key internal control activities on a randomly selected statistical sample of 37 contracting disbursement transactions, as described in the section below.

Random Statistical Sampling of Receipts and Disbursements Activity

To determine the extent to which the Foundation designed effective internal control over its receipts and disbursements activity (consisting of payroll, contracting, and other expense transactions), we interviewed Foundation officials, reviewed written internal control policies and procedures, and performed walkthroughs of specific transactions. We also obtained, analyzed, and summarized the Foundation’s written internal control policies and procedures related to receipts and disbursements activity for the 9-month period July 1, 2014, through March 31, 2015, and compared them to the criteria in Standards for Internal Control in the Federal Government to determine whether these key control activities were consistent with federal internal control standards.

Table 1 summarizes the receipts and disbursements activity for the 9- month period July 1, 2014, to March 31, 2015, and randomly selected statistical sample sizes for each area. As noted above, we conducted internal control-related walkthroughs and interviews, all of which indicated that the designed internal controls were implemented. We incorporated assurances gained from these additional audit steps into sample size determinations to improve efficiency while maintaining effectiveness. We planned our testing of each area to be 95 percent confident that the actual error rate associated with sampling error inherent in these statistical samples is less than or equal to 6.9 percent.

To test the implementation and effectiveness of internal controls over receipts and disbursements activity (consisting of payroll, contracting, and other expense transactions), we conducted transaction tests of key internal control activities as described below.

Receipts Activity

1. For the 9-month period July 1, 2014, through March 31, 2015, we selected and tested a random statistical sample of 36 receipt transactions to determine whether the Foundation’s key internal control activities over the processing of its receipts activity were implemented effectively in accordance with the Foundation’s formal written internal control policies and procedures. We tested these key control activities over the processing of receipt transactions by inspecting the following: supervisory review of project data in the Project Management Database (PMD), management review and approval of all invoices, such as invoices for training services provided to external parties in PMD, and management review of the invoices spreadsheet attesting to the total amount of invoices.

Disbursements Activity

1. Payroll disbursements. For the 9-month period July 1, 2014, through March 31, 2015, we randomly selected 10 biweekly pay periods from the 9-month period of our audit and then randomly selected five transactions from each pay period, which resulted in 50 payroll disbursement transactions. We then determined whether the Foundation’s key internal control activities over the processing of its payroll disbursements activity were implemented effectively in accordance with the Foundation’s formal written internal control policies and procedures. We tested the key control activities over the processing of payroll disbursement transactions by inspecting the following: management’s review and approval of requests for personnel actions, management’s review of monthly detailed spreadsheets attesting to the correct salary for employees, supervisory review of employees’ time cards and amendments, and management review and electronic sign-off on employees’ time cards and amendments. 2. Contracting disbursements. For the 9-month period July 1, 2014, through March 31, 2015, we selected and tested a random statistical sample of 37 contracting disbursement transactions to determine whether the Foundation’s key internal control activities over the processing of its contracting disbursements activity were implemented effectively in accordance with the Foundation’s formal written internal control policies and procedures. We tested the key control activities over the processing of contracting disbursement transactions by inspecting the following: management approval of checklists attesting that no conflicts of interest exist; evidence of management review and approval of contracts; and evidence of management receipt and review of contractor invoices, including a comparison of the scope and nature of services provided and labor hours billed. 3. Other expense disbursements. For the 9-month period July 1, 2014, through March 31, 2015, we selected and tested a random statistical sample of 50 other expense transactions to determine whether the Foundation’s key internal control activities over the processing of its other expense disbursements activity were implemented effectively in accordance with the Foundation’s formal written internal control policies and procedures. We tested the key control activities over the processing of other expense disbursement transactions by inspecting the following: supervisory review of invoices; evidence of management receipt of invoices; management’s review and approval of all credit card authorization forms; and management’s review and approval of all invoices, which included evidence of receipt of services.

We conducted this performance audit from April 2015 to November 2015 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Morris K. Udall and Stewart L. Udall Foundation

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, William Boutboul (Assistant Director), Sharon Byrd, Francine DelVecchio, Lauren S. Fassler, Wilfred Holloway, Gail Luna, Cynthia Ma, Kevin McAloon, and Diana Vu made significant contributions to this report.