Internal Controls: Corrective Actions Under Way to Address Control Deficiencies at the Morris K. Udall and Stewart L. Udall Foundation
Released: 2013-12-06T00:00:00

Letter

Scope and Methodology

To address our objective, we (1) obtained and reviewed the DOI OIG audit report and supporting workpapers; (2) interviewed Foundation management and selected staff members to determine the extent to which its actions to improve internal controls and the Federal Managers’ Financial Integrity Act (FMFIA) assessment process have been sufficiently documented (i.e., whether such changes have been issued in final form or whether draft policies of planned changes have been reviewed by senior management and the in-house General Counsel); (3) obtained and reviewed documentation related to the Foundation’s actions to improve internal controls and its FMFIA assessment process; and (4) assessed the Foundation’s actions against the criteria established under Standards for Internal Control in the Federal Government,of Management and Budget (OMB) Circular No. A-123, Management’s Responsibility for Internal Control (December 21, 2004) (OMB Circular Office No. A-123),Federal Acquisition Regulation (FAR). The scope of our work did not include performing procedures to validate the findings included in the DOI OIG audit report. We discussed with DOI OIG officials responsible for conducting the audit at the Foundation the audit procedures they performed and reviewed supporting DOI OIG workpapers. We also met with Foundation management responsible for responding to the DOI OIG audit report and developing corrective action plans. These procedures allowed us to gain an understanding of the DOI OIG’s work performed, the conclusions drawn, and management’s response to the DOI OIG audit report. other OMB guidance concerning contracting, and the We conducted this performance audit from May 2013 to December 2013 in accordance with generally accepted government auditing standards. Those standards required that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Background

The Foundation was established as an independent executive branch agency in 1992 to honor Morris K. Udall’s 30 years of service in the U.S. House of Representatives as a leader on issues related to the environment and Native Americans. In 2009, its authorizing legislation was amended to also honor Stewart L. Udall’s public service legacy. The Foundation is committed to educating a new generation of Americans to preserve and protect their national heritage through scholarship, fellowship, and internship programs focused on environmental and Native American issues. The Foundation consists of the Morris K. Udall and Stewart L. Udall Trust Fund, which is used to operate the Foundation’s education programs, and the Environmental Dispute Resolution Fund. The latter fund is available to the Foundation to operate the U.S. Institute for Environmental Conflict Resolution, which was established by the Environmental Policy and Conflict Resolution Act of 1998 to promote the principles and practices of environmental conflict resolution and to assist in resolving conflict over environmental issues involving federal agencies. The Foundation depends on federal appropriations for the majority of its operations and received no-year appropriations of roughly $6.0 million in fiscal years 2012 and 2013.

Under its authorizing legislation, the Foundation is subject to the supervision and direction of the Board, which is to consist of 13 trustees, 11 of whom are to be voting members of the Board. The authorizing legislation charges the Board with appointing the Executive Director and setting his or her compensation. Further, the Foundation’s operating procedures provide that it is the Board’s role and duty to appoint senior management staff members and set their compensation; approve the organizational structure for the staff of the Foundation; approve the Foundation’s budget and arrange for an annual financial audit; set policies, including internal controls, for the conduct and management of the agency’s finances, personnel, and programs to be implemented by its staff; and approve the strategic direction and priorities for the Foundation.

DOI OIG Audit Report

The DOI OIG’s December 2012 audit report of the Foundation concluded that—despite signed statements of assurance by the former Executive Director claiming otherwise—the Foundation had not appropriately assessed the effectiveness of its internal controls for at least 6 fiscal years from 2006 through 2011 and was thus not in compliance with FMFIA. Under FMFIA and implementing guidance, federal executive agencies must establish internal control and financial systems that provide reasonable assurance of achieving the following three objectives of internal control: effectiveness and efficiency of operations, compliance with regulations and applicable laws, and reliability of financial reporting. FMFIA also requires the agency head to provide an annual statement of assurance on whether the agency has met these requirements. OMB Circular No. A-123 defines management’s responsibility for internal control in federal executive agencies, including maintaining the appropriate level of documentation and continuously monitoring the effectiveness of internal control during the normal course of business. In relation to internal control over financial reporting, this includes documenting both the controls in place and the assessment process and methodology that management used to support its assertion as to the effectiveness of internal control, and performing monitoring activities that include direct testing of the controls as part of the assessment process.

The DOI OIG’s audit report also found that the Foundation was missing key internal controls over its personnel and contracting practices. The DOI OIG December 2012 audit report stated that the office does not have the authority to make formal recommendations to the Foundation to improve its internal controls. However, the DOI OIG audit report did include several suggestions for corrective actions for the Foundation’s consideration.

The Foundation Is Taking Actions to Improve Its Internal Controls to Comply with Internal Control Standards and Laws and Regulations

The Foundation developed a Corrective Action Plan during fiscal year 2013 to address the findings identified in the DOI OIG audit report and related financial management weaknesses to improve internal controls over its key financial management processes. Major elements of the Corrective Action Plan include performing a complete assessment of the Foundation’s current internal control structure to identify adequate, inadequate, and missing controls, and developing (or contracting to have developed) policies and procedures to implement appropriate internal controls in all areas where inadequate or missing controls are identified.The Corrective Action Plan included steps to address deficiencies in the Foundation’s (1) FMFIA internal control monitoring and assessment process, (2) internal control related to its personnel processes, and (3) internal control related to its contracting processes. For those actions that were sufficiently documented at the time of our review, we found that their design was consistent with internal control standards and applicable laws and regulations, as discussed in the following sections.

Foundation Actions to Improve FMFIA Internal Control Monitoring and the Assessment Process

Since the release of the DOI OIG audit report, the Foundation has experienced significant turnover in its senior management ranks, and new management has acknowledged that the Foundation did not (1) maintain adequate documentation of the controls in place, (2) perform monitoring activities that included direct testing of the controls as part of the internal control assessment process required under FMFIA, (3) document the assessment process and methodology that management used to support its assertion as to the effectiveness of internal control over financial reporting, and (4) include appropriate representations from officials and personnel responsible for monitoring, improving, and assessing internal controls. In addition, new management at the Foundation acknowledged that the Foundation’s failure to comply with FMFIA requirements and implementing OMB Circular No. A-123 guidance contributed to the financial management weaknesses identified in the DOI OIG audit report.

The Foundation has taken action to comprehensively assess its internal controls and plans to make changes based on the results of that assessment. Specifically, the Foundation contracted with an external consultant to perform an internal control review with an overall goal of achieving compliance with OMB Circular No. A-123 and Standards for Internal Control in the Federal Government. We determined that the design of this action to contract for the performance of a thorough internal control review is consistent with internal control standards related to monitoring operations and internal controls and with FMFIA requirements to monitor and assess the effectiveness of its internal controls.

The scope of work for this review included performing an assessment of the Foundation’s current internal control structure to identify adequate, inadequate, and missing controls; recommending improvements to controls and the control environment; recommending procedures for annual monitoring and testing of controls; recommending a format for the annual statement of assurance; and reviewing and recommending improvements for communication of control responsibilities to its staff. The Foundation exercised its option to order additional services from the external consultant to perform an assessment of the implementation of the recommendations in its report, which was issued in late September 2013. This assessment is expected to be performed from December 2013 to February 2014.

Foundation Actions to Address Internal Control Deficiencies Related to Personnel

The Foundation acknowledged that it did not have internal controls related to personnel in the areas of outside employment and termination of employees. Potential violations of applicable laws and regulations were detected by the DOI OIG as a result of these deficiencies. The Foundation’s Corrective Action Plan contained planned changes to address the two key areas that were cited in the DOI OIG’s audit report.

Outside employment. The DOI OIG concluded that the Foundation did not comply with the Dual Compensation Act when approving outside employment activities for employees. As of November 2013, the Foundation was taking steps to improve its internal controls related to employees’ outside employment. Specifically, the Foundation prepared a draft Outside Employment Policy, which requires Foundation employees to obtain management approval prior to engaging in any outside employment. As of November 2013, the draft Outside Employment Policy was in the process of being reviewed by the Foundation’s General Counsel for compliance with applicable law and implementing Office of Personnel Management (OPM) regulations and guidance. According to Foundation officials, the policy is expected to be finalized in early 2014.

Termination of employees. The DOI OIG audit report cited a lack of internal controls as the basis for questionable actions that were taken by Foundation management to encourage employees to either voluntarily, or involuntarily, leave their Foundation employment. The Foundation was taking steps to improve its internal controls relating to termination of staff members’ employment. Specifically, as of November 2013, the Foundation was updating its personnel policies to direct that all personnel actions taken must comply with applicable law and implementing OPM regulations and guidance, and that any deviation from such regulations and guidance must be documented and justified in writing. According to Foundation officials, the policy is expected to be finalized in early 2014.

Because the Foundation’s planned actions to improve its internal controls related to employees’ outside employment and termination of employment were not finalized, it was too soon for us to assess the design of these actions and whether they are consistent with internal control standards and applicable laws, regulations, and guidance. The draft Outside Employment Policy and the personnel policies relating to termination of employees will not be finalized until the Foundation’s General Counsel and Executive Director and the Board have reviewed and approved the proposed changes. Once approved, the extent to which the new personnel-related internal controls and their implementation will help the Foundation to successfully improve its internal controls and comply with applicable laws and regulations will require the continued involvement and vigorous oversight of Foundation management and the Board.

Foundation Actions to Address Internal Control Deficiencies Related to Contracting

The bona fide needs rule is based on the Time Statute (31 U.S.C. § 1502(a)).

See the Ethics in Government Act of 1978, which is codified, as amended, in 5 U.S.C. appendix §§ 401-408. The Director of the Office of Government Ethics has issued implementing regulations, which are codified, as amended, in 5 C.F.R. parts 2634-41. was not in compliance with the FAR when awarding sole source contracts. Most of the sole source contracts were justified using the Alternative Dispute Resolution (ADR) exception to full and open competition;contracted did not meet the essential elements required for an ADR exception under FAR 6.302-3 (“acquire services of an expert or neutral person for any current or anticipated litigation or dispute”). Further, not all contracts had approved sole source justifications as required by the FAR, and some justifications contained inaccurate information; inappropriately modified some contracts to add additional funding, add work outside the scope of the contract, extend the period of performance beyond the original dates, or a combination of these; and awarded what appear to be personal service contracts, which the FAR but the DOI OIG determined that the work being defines as contracts characterized by the employer-employee relationship it creates between the government and the contractor’s personnel. Obtaining personal services by contract, rather than by direct hire, circumvents the civil service laws unless Congress has specifically authorized acquisition of the services by contract.

The Foundation recognized that internal controls for contracting were deficient and had taken some action and was developing other changes to correct control deficiencies in this area. According to the Executive Director, after discussion and approval from the Chair and Vice Chair of the Board, the Foundation entered into a 5-year interagency agreement for assisted acquisitions on March 11, 2013, with the DOI Interior Business Center’s (IBC) Acquisition Services Directorate. IBC provides comprehensive acquisition services to federal agencies, managing the entire process from planning, soliciting, and evaluating offers to awarding and administering contracts through closeout. We determined that the design of this action is consistent with internal control standards and applicable guidance for federal executive agencies. Specifically, the Foundation’s interagency agreement with IBC for managing environmental conflict resolution contracts is generally consistent with OMB’s Office of Federal Procurement Policy (OFPP) 2008 policy guidance on management and use of interagency acquisitions. The formal agreement generally follows OFPP’s model agreement for an assisted acquisition, including delineating the roles and responsibilities of both the requesting (Foundation) and servicing (IBC) agencies throughout the acquisition life cycle. The agreement is an appropriate strategy for addressing the findings identified by the DOI OIG in this area and meeting internal control standards for proper implementation and oversight of agency contracting activities.

Pursuant to the terms of the interagency agreement, IBC has agreed to assist the Foundation on contracts related to environmental conflict resolution activities, including mediation, facilitation, and assessment services. An IBC official serves as the Contracting Officer for contracts that IBC awards to private service providers on the Foundation’s behalf. IBC also will provide contracting officer’s representatives (COR) until such time that Foundation Program Managers become qualified to be authorized CORs by completing existing training requirements and receiving Federal Acquisition Institute certification as CORs.agreement, IBC will help the Foundation comply with the bona fide needs rule by managing funds according to the Foundation’s guidance, recording transactions in a timely fashion, and implementing and exercising controls to ensure compliance with all applicable statutory and regulatory fiscal requirements.

Further, per the agreement, the Foundation will provide IBC with information on project objectives, deliverables, and schedule milestones, and IBC will select an appropriate award type based on the nature of the requirement and associated risk. IBC is responsible for ensuring that the environmental conflict resolution contracts comply with competition requirements, including seeking competition unless an exception is justified and approved at the appropriate level; requiring the Foundation to furnish supporting rationale and appropriate documentation to support an exception to competition; and reviewing the sufficiency of the Foundation’s justification and documentation before approving and proceeding with a noncompetitive action. The interagency agreement with IBC also defines the roles and responsibilities for evaluating proposed contract modifications. Per this agreement, the Foundation is to work with IBC to evaluate proposals for changes and, if requested by the IBC Contracting Officer, to participate in negotiation of changes, modifications, and claims. Further, the Foundation is responsible for ensuring that it is not authorizing work (making commitments or promises, issuing instructions to start or stop work, or directing changes), changing any contractual documents, modifying the scope of work (including the period of performance), authorizing accrual of costs, or otherwise providing direction to the contractor, except as expressly authorized in the COR appointment by IBC’s Contracting Officer. IBC is responsible for working with the Foundation to evaluate proposals for changes and ensuring that any modifications to the requirements or price of the award remain within the overall scope of the original award. The agreement should help in improving management and oversight on those environmental conflict resolution contracts being serviced by IBC. The total amount paid on these environmental conflict resolution contracts was approximately $2.7 million in fiscal year 2013.

The Foundation has retained responsibility for administrative contracts and leasing activities. According to the Foundation, in fiscal year 2013, it paid approximately $780,000 for administrative contracts managed by the Foundation. Most of the administrative contract costs were onetime expenditures to address DOI OIG audit findings, such as contracting for organizational development work, the internal control review, legal review and assistance, and the cost of the DOI OIG audit. Other administrative costs are recurring, such as payroll and financial services provided by the General Services Administration under memorandums of understanding, and the cost of the annual financial statement audit. The Foundation also spent $361,000 on leased space at two locations.

The Foundation plans to draft guidance on internal contracting processes that will be reviewed by the Foundation’s General Counsel and Executive Director. According to the Foundation, it intends to have a policy approved and in place by December 15, 2013. The Foundation expects the policy to state that the FAR guidance should be followed, including its contract documentation requirements and prohibitions related to personal services contracts. Because the Foundation’s planned actions to improve its internal controls related to its management of administrative contracts were not finalized, it was too soon for us to assess the design of these actions and whether they are consistent with internal control standards and applicable laws, regulations, and guidance. However, issuance of a new internal contracting policy that reinforces the requirements of the FAR for administrative contracts is a good step in emphasizing the need for following sound contracting practices.

Concluding Observations

The Foundation’s continuing implementation of its Corrective Action Plan and the efforts to make changes in internal controls appear to be moving the Foundation in the right direction to strengthen its internal controls, comply with applicable laws and regulations, and improve management’s ability to make informed decisions. Many of the Foundation’s actions to improve its internal controls will be in various stages of implementation over the next few months and possibly longer. Until implementation is complete, the extent to which these changes will help the Foundation monitor and improve the effectiveness of its internal controls and comply with applicable laws and regulations cannot be fully assessed.

Agency Comments

We provided a draft of this report to the Foundation for comment. In its written comments, which are reprinted in appendix I, the Foundation stated that it accepted the results of our audit in full. The Foundation also provided a summary of the changes it has made in its operations and structure since the DOI OIG audit report. Further, the Foundation recognized that more needs to be done and stated that it was committed to ensuring that all internal controls are adequate and being followed on a continuous basis.

We are sending copies of this report to the Executive Director of the Morris K. Udall and Stewart L. Udall Foundation, the Deputy Inspector General of the Department of the Interior, and the appropriate congressional committees. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staffs have any questions about this report, please contact me at (202) 512-9399 or malenichj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff members who made key contributions to this report are listed in appendix II.

Appendix I: Comments from the Morris K. Udall and Stewart L. Udall Foundation

Appendix II: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, William Boutboul (Assistant Director), Lauren S. Fassler, Patrick Frey, Wilfred Holloway, Gail Luna, Vivian Ly, Cynthia Ma, Mary Quinlan, and William T. Woods made significant contributions to this report.