Single Audits: Improvements Needed in Selected Agencies' Oversight of Federal Awards
Released: 2017-02-16T00:00:00

Letter

Background

The Single Audit Act

The purposes of the Single Audit Act are to promote sound financial management, including effective internal controls, with respect to federal awards administered by nonfederal entities; promote the efficient and effective use of audit resources; and ensure that federal departments and agencies, to the maximum extent practicable, rely upon and use single audit work.

For the audit period of this report, the Single Audit Act, as implemented by OMB Circular No. A-133, requires nonfederal entities that expend $500,000 or more in federal awards in a fiscal year to have either a single audit or program-specific audit conducted. Federal awards include grants, loans, loan guarantees, property, cooperative agreements, interest subsidies, insurance, food commodities, direct appropriations, other assistance, and federal cost-reimbursement contracts. A single audit is an audit of both the entity’s financial statements and expenditures of federal awards. The Single Audit Act mandates that federal agencies assume oversight responsibility for the funds that they award to nonfederal entities. OMB Circular No. A-133 requires that federal awarding agencies ensure that award recipients complete and submit single audit reports within the earlier of 30 days after the receipt of the auditor’s report or 9 months of the award recipient’s fiscal year-end, unless a longer period for audit is agreed to in advance by the cognizant or oversight agency for audit. Moreover, OMB Circular No. A-133 directs federal agencies to take appropriate action using sanctions in cases where an award recipient is unable or unwilling to have an audit conducted in accordance with the circular’s requirements. The sanctions may include withholding a percentage of federal awards until the audit is completed satisfactorily, withholding or disallowing overhead costs, suspending federal awards until the audit is conducted, or terminating the federal award.

OMB Circular No. A-133 also requires each award recipient to submit an audit reporting package to the FAC for distribution to each federal agency responsible for programs for which the audit report identifies a single audit finding and for archival purposes. The reporting package is to include (1) the award recipient’s financial statements and schedule of expenditures of federal awards; (2) a summary schedule of prior audit findings, including the status of all single audit findings included in the prior audit’s schedule of findings and questioned costs for federal awards; (3) the auditor’s report (including an opinion on the award recipient’s financial statements and schedule of expenditures of federal awards, reports on internal control and compliance with laws, regulations, and provisions of contracts or grant agreements, and a schedule of findings and questioned costs); and (4) a corrective action plan.

In addition, OMB Circular No. A-133 requires federal awarding agencies to review award recipients’ plans to correct single audit report findings and issue a written management decision on those plans within 6 months of receipt of the single audit report for each single audit finding. A management decision entails the federal awarding agency or pass- through entity evaluating the single audit report findings and the award recipient’s corrective action plan and issuing a written decision on whether the federal awarding agency is satisfied with the corrective action plan and, if not, what corrective action is necessary.

Example of the Time Frames for Single Audit Reports with Single Audit Findings

Federal award recipients are required to submit their single audit reporting packages to the FAC within the shorter of 30 days after receipt of the single audit report from the auditor or nine months after the end of the award recipient’s fiscal year. Federal awarding agencies are to ensure that each award recipient submits its single audit reporting package to the FAC in accordance with these requirements. Under the time frames provided by the Single Audit Act and OMB Circular No. A- 133, it may take up to 15 months for the award recipient to initiate corrective action for single audit findings. For example, if the auditor’s single audit report identifies a single audit finding for an entity that has a June 30, 2013 fiscal year-end, the award recipient must submit the single audit report along with its corrective action plan to the FAC, at the latest, within 9 months of the fiscal year-end or no later than March 31, 2014. The federal awarding agency would then have 6 months or until September 30, 2014, from receipt of the single audit report to communicate a written management decision to the award recipient, and the award recipient is to initiate corrective action. Issuance of a timely management decision is critical because OMB Circular No. A-133 allows award recipients to consider a single audit finding as no longer valid and to take no further action if all the following have occurred: a management decision was not issued,

2 years have passed since the audit report that contained the single audit finding was submitted to the FAC, and the federal agency or pass-through entity is not currently following up with the award recipient on the single audit finding.

In some cases, action to correct the single audit finding is not started until the award recipient receives the management decision. As a result, it may take up to 15 months after the end of the fiscal year in which the single audit finding was initially identified before corrective action has begun. Award recipients report their progress in a schedule of prior single audit findings where the status of the single audit finding is reported as either corrected (closed), partially corrected, or not corrected (open). The auditor then reviews this schedule and includes it in the next single audit report. When the awarding agency delays issuing a management decision to the award recipient, initiation of corrective action may also be delayed. As a result, the single audit finding may remain open. Figure 1 provides an illustrative timeline for single audit reports with single audit findings.

Uniform Guidance

In December 2013, OMB issued the Uniform Guidance to supersede and streamline existing requirements for federal awards. The Uniform Guidance required federal agencies to update their regulations and policies for federal awards. Portions of the Uniform Guidance are aimed at strengthening federal agency oversight of single audits. The Uniform Guidance required that federal agencies implement the policies and procedures applicable to federal awards by issuing a regulation to be effective by December 26, 2014, unless different provisions are required by statute or approved by OMB. On December 19, 2014, OMB and all federal award-making agencies issued a joint interim final rule to implement the Uniform Guidance, fulfilling the requirement contained in the Uniform Guidance. We previously reported that all federal grant- awarding agencies issued regulations implementing this guidance.

Five Selected Subagencies Did Not Effectively Design Policies and Procedures to Reasonably Assure That Award Recipients Submit Timely Single Audit Reports

Both selected subagencies in Agriculture and HHS and a selected subagency in Transportation (the Federal Transit Administration) did not effectively design policies and procedures to reasonably assure that award recipients submitted their single audit reports within the time frames required by OMB Circular No. A-133. In addition, both selected subagencies in Education and HUD and the other selected subagency in Transportation (the Federal Highway Administration) effectively designed policies and procedures to reflect that requirement. OMB Circular No. A- 133 requires that federal awarding agencies ensure that award recipients submit single audit reports within the shorter of 30 days after receipt of the report from the auditor or 9 months of the award recipient’s fiscal year-end unless a longer period is agreed to in advance by the cognizant or oversight agency for audit.

Standards for Internal Control in the Federal Government provides the overall framework for establishing and maintaining internal control and states that control activities should be effective and efficient in accomplishing the agency’s control objectives. The standards further state that management should clearly document internal control in a manner that allows the documentation to be readily available for examination. The five components of internal control are as follows:

Control Environment: Management and employees should establish and maintain an environment throughout the organization that sets a positive and supportive attitude toward internal control and conscientious management.

Risk Assessment: Internal control should provide for an assessment of the risks the agency faces from both external and internal sources.

Control Activities: Internal control activities help ensure that management’s directives are carried out. The control activities should be effective and efficient in accomplishing the agency’s control objectives.

Information and Communications: Information should be recorded and communicated to management and others within the entity who need it and in a form and within a time frame that enables them to carry out their internal control and other responsibilities.

Monitoring: Internal control monitoring should assess the quality of performance over time and ensure that the findings of audits and other reviews are promptly resolved.

To implement the internal control standards, each agency and subagency is to develop detailed policies and procedures (control activities) to execute its responsibilities under OMB Circular No. A-133. Without effectively designed policies and procedures for determining whether single audit reports have been submitted timely by award recipients, agencies are hampered in their ability to take timely and effective action to reasonably assure that award recipients correct all single audit findings. Effective federal agency oversight would help to reasonably assure effective program operations and minimize improper payments.

We identified four key steps relating to the design of single audit policies and procedures that would assist federal awarding agencies in fulfilling their responsibilities under OMB Circular No. A-133 for reasonably assuring that award recipients submit single audit reports timely. To that end, designing policies, procedures, and mechanisms that include the following steps would help provide reasonable assurance that agencies can fulfill these responsibilities: identify award recipients that should have submitted single audit reports, verify that the award recipients submitted single audit reports, determine whether the single audit reports were submitted within the required time frames, and take action to obtain the single audit reports when award recipients did not submit the reports within the required time frames.

Figure 2 provides an overview of our assessment of the selected subagencies’ design of policies and procedures relating to the award recipients’ timeliness of single audit report submission for fiscal year 2013.

Department of Agriculture

Agriculture’s two selected subagencies, Food and Nutrition Service (FNS) and Rural Development (RD), did not effectively design policies and procedures to reasonably assure that award recipients submitted their single audit reports timely. Agriculture’s approach for single audit oversight is decentralized, and the Office of the Chief Financial Officer (OCFO) is responsible for providing departmental policy to the subagencies. Agriculture’s subagencies, such as FNS, are responsible for obtaining single audit reports and resolving single audit findings.

Food and Nutrition Service

FNS did not effectively design policies and procedures to reasonably assure that award recipients submitted single audit reports timely. FNS had policies and procedures that reference OMB Circular No. A-133 single audit guidance, but these policies and procedures were not effectively designed to identify award recipients that should have submitted single audit reports, verify that the award recipients that were required to submit single audit reports actually submitted the reports, determine whether the single audit reports were submitted within the required time frames, and take action to obtain the single audit reports when award recipients did not submit the reports within the required time frames.

According to FNS’s policies and procedures included in the FNS Audit Manual, the Agriculture OCFO receives a copy of single audit reports with findings related to Agriculture’s programs. If the OCFO determines that the single audit reports include award recipients that have received awards from FNS, the OCFO forwards those single audit reports to FNS. In addition, FNS’s policies and procedures state that the regional offices should periodically check the FAC database to determine if single audit reports have been submitted. Specifically, according to FNS officials, the single audit liaison checks the FAC for single audit reports and notifies the regional offices that single audits are available for download from the FAC. While these policies and procedures allow FNS to identify the award recipients that have submitted single audit reports, including the date when each single audit report was submitted, the policies and procedures do not allow FNS to reasonably assure that award recipients that have not submitted their single audit reports do so by the required due dates. An FNS official stated that the agency does not maintain a list of award recipients that should have submitted single audit reports to the FAC but did not. In addition, the FNS official stated that its award recipients are primarily state agencies and that FNS receives a statewide single audit report once annual statewide audits are completed. As a result, according to an FNS official, FNS would be aware when a state has not submitted its single audit report. FNS also makes awards to Indian tribal organizations. We reviewed data in the FAC database and found that 110 Indian tribal organizations received over $500,000 in federal awards from FNS and that all of them had submitted single audit reports for their 2013 fiscal year-end. With award recipients from up to 50 states and numerous Indian tribal organizations, it is unclear how FNS officials would reasonably assure that award recipients have submitted each single audit report in the time frame required without a tracking system or list that identifies the award recipients, the fiscal year-end for each, and required due dates for single audit report submission. Thus, FNS’s policies and procedures were not effectively designed to identify award recipients that should have submitted single audit reports, verify that the award recipients that were required to submit single audit report actually submitted them, determine whether the award recipients that were required to submit single audit reports did so within the required time frames, and take action to obtain single audit reports when award recipients did not submit the single audit reports within the required time frames.

A FNS official stated that it is the award recipient’s responsibility to ensure that it files a single audit report not FNS’s responsibility. However, OMB Circular No. A-133 requires award recipients to ensure that the audits are performed and submitted when due and federal awarding agencies to ensure that single audit reports are received timely. An Agriculture official acknowledged that independently verifying if single audit reports are missing from the FAC database would be a major challenge for the subagencies because of their reliance on award recipients to self-report. Nonetheless, OMB Circular No. A-133 requires that federal awarding agencies ensure that award recipients complete and submit single audit reports within the required time frames.

Rural Development

RD did not effectively design policies and procedures to reasonably assure that award recipients submitted single audit reports timely. RD had policies and procedures that made reference to OMB Circular No. A-133; however, we found that RD’s policies and procedures were not effectively designed to identify award recipients that should have submitted single audit reports, verify that the award recipients that were required to submit single audit reports actually submitted the reports, determine whether the award recipients that were required to submit single audit reports submitted the reports within the required time frames, and take action to obtain single audit reports when award recipients did not submit the reports within the required time frames.

RD’s policies and procedures included in its Financial Management OMB Circular A-133 Standard Operating Procedures call for RD to run queries on information stored in the FAC database to determine which single audit reports have been submitted; however, it did not contain policies and procedures for identifying the award recipients that met the threshold and were required to submit single audit reports. An RD official stated that RD is aware of the dollar amount of funds that it provides to award recipients and whether those funds met the threshold. Officials in RD’s Financial Management Division reported that one of RD’s program divisions relies on award recipients to undergo single audits and submit the single audit reports to the FAC when total expenditures of federal awards exceed the threshold. However, similar to FNS, while these policies and procedures allow RD to identify award recipients that have submitted single audit reports, they do not reasonably assure that RD identifies award recipients that should have submitted single audit reports by the required due dates but did not. An Agriculture official acknowledged that independently verifying that single audit reports are missing from the FAC would be a major challenge for the subagencies because they rely on the award recipients to self-report. Nonetheless, OMB Circular No. A-133 requires that federal awarding agencies ensure that award recipients complete and submit single audit reports within the required time frames.

Department of Education

Education effectively designed policies and procedures to reasonably assure that award recipients completed and submitted single audit reports timely. Education has a centralized organizational structure for overseeing single audits. As a result, the policies and procedures designed to reasonably assure that award recipients submitted single audit reports on time at the two selected subagencies—the Office of Elementary and Secondary Education (OESE) and the Office of Special Education and Rehabilitative Services (OSERS)—are the same.

Education’s Post Audit Group (PAG) under the OCFO has department- wide policies and procedures for single audit oversight and audit resolution. PAG has effectively designed policies and procedures to identify and follow up on single audit reports that have not been submitted to the FAC within the required time frames. PAG also processes and distributes single audit reports to Education’s principal offices for resolution.

Education’s Office of the Chief Financial Officer Guidance Memorandum calls for PAG to take steps to help program offices identify award recipients that have not submitted their single audit reports in a timely manner. The guidance memorandum requires that in September of each fiscal year, Education’s Risk Management Service prepares a list of all of Education’s award recipients that have expended funds over the threshold dollar amount in a prior year. The guidance memorandum requires the Risk Management Service to compare the list of award recipients against the FAC database to determine if audit reports were completed and submitted to the FAC in 9 months. According to its policies and procedures, the Risk Management Service is to then create a list of award recipients that did not submit the required single audit reports and send the list to PAG to identify the award recipients that are to be notified.

PAG’s procedures then call for PAG to send a notification letter requesting that the award recipient submit the required single audit report or provide information as to why it did not submit the report or is not required to do so. If there is no response or no single audit report is provided within 30 business days, in accordance with PAG’s procedures, PAG is to send a second letter to the award recipient. If the award recipient still fails to respond by submitting the single audit report or explaining why it is not required to do so, PAG’s procedures call for program offices to make decisions about follow-up action. These actions may include imposing special conditions that direct the award recipient to submit a single audit report by a certain date or its plan to obtain an audit by a certain date, declaring an award recipient as “high risk” and imposing special conditions that place the recipient on a cost-reimbursement payment basis until it submits a single audit report or provides a plan for obtaining an audit, or withholding funds from the award recipient.

In addition, audit follow-up reflects a key component of Education’s risk management strategy in the U.S. Department of Education Strategic Plan for Fiscal Years 2014 – 2018. According to Education’s OCFO officials, Education performed these procedures annually in fiscal year 2013 but began performing them quarterly at the time of our audit.

Department of Health and Human Services

HHS’s two selected subagencies, Audit Resolution Division (ARD) and the Centers for Medicare and Medicaid Services (CMS), did not effectively design policies and procedures to reasonably assure that award recipients submitted single audit reports timely. HHS has a decentralized approach in which the Office of the Assistant Secretary for Financial Resources sets policy for single audit oversight, which is carried out by ARD, HHS’s operating divisions (such as CMS), and the Office of Inspector General (OIG). While ARD has a key role in HHS’s single audit oversight process, it does not award federal funds to nonfederal entities.

Audit Resolution Division

ARD did not effectively design policies and procedures to reasonably assure that award recipients submitted single audit reports timely. ARD had detailed policies and procedures for conducting single audit oversight; however, ARD’s policies and procedures were not effectively designed to identify award recipients that should have submitted single audit reports, verify that the award recipients that were required to submit single audit reports actually submitted the reports, and determine whether the award recipients that were required to submit single audit reports submitted the reports within the required time frames.

Based on a review of ARD’s policies and procedures, we determined that ARD is not responsible for taking action to obtain single audit reports when award recipients did not submit the single audit reports within the required time frames, as shown in figure 2. ARD is to provide each HHS operating division with a list of the award recipients that are potentially delinquent in submitting single audit reports to the FAC. Each operating division is responsible for following up with its award recipients and updating ARD quarterly on the status of the potentially delinquent single audit reports.

ARD did not effectively design policies and procedures to identify award recipients that should have submitted single audit reports. ARD’s policies and procedures include the Audit Resolution Division Manual (ARD Manual) and the 2011 Annual Delinquent Audit Process Detailed Instructions. These documents outline ARD’s responsibility for annually performing a delinquent audit review to identify award recipients that should have submitted single audit reports as required by OMB Circular No. A-133 but did not. However, these policies and procedures do not reasonably assure that the delinquent audit review is performed annually. We found that as of May 2016, ARD had not performed the fiscal year 2013 delinquent audit review. In addition, ARD had not updated the 2011 Annual Delinquent Audit Process Detailed Instructions for the fiscal year 2013 delinquent audit review.

In May 2016, an ARD official stated that the reason the delinquent audit review for fiscal year 2013 had not been completed was that ARD found errors with the information for identifying award recipients that received over $500,000 in federal awards during fiscal year 2013.The ARD Manual states the Program Support Center is to query the Payment Management System to identify award recipients who received $500,000 or more in federal awards and compare the results of the query against the FAC to verify whether award recipients submitted single audit reports. However, the ARD Manual did not contain a requirement to ensure that the query was complete and accurate. As a result, when the query was run, the list that identified award recipients for fiscal year 2013 that received $500,000 or more in federal awards did not include CMS award recipients— because the query contained CMS’s prior name, the Health Care Financing Administration, according to an ARD official. CMS awarded the largest dollar amount of HHS’s reported grant outlays to states and local governments for fiscal year 2013. Once ARD noticed that the data were inaccurate, ARD worked with the Program Support Center to change the query to include CMS’s name in future queries. An HHS official stated that the policies and procedures to incorporate changes related to the query had not been updated as of May 2016 and that HHS was working on revising the policies and procedures in this area. However, it is unclear whether the revised policies and procedures relating to single audits would be effectively designed to address our audit finding. In addition, the ARD Manual did not contain policies and procedures for determining whether the award recipients that were required to submit single audit reports submitted the reports within the required time frames. Thus, ARD’s policies and procedures were not effectively designed to identify award recipients that should have submitted single audit reports, verify that the award recipients that were required to submit single audit reports actually submitted the reports, and determine whether the award recipients that were required to submit single audit reports did so within the required time frames.

Centers for Medicare and Medicaid Services

CMS did not effectively design policies and procedures to reasonably assure that it takes action when award recipients did not submit single audit reports within the required time frames. We found that ARD is responsible for identifying award recipients for each HHS operating division that should have submitted single audit reports, verifying that the award recipients that were required to submit single audit reports actually submitted the reports, and determining whether the award recipients that were required to submit single audit reports did so in a timely manner. As a result, we did not assess the design of CMS’s policies and procedures for those activities, as shown in figure 2.

We found that CMS’s policies and procedures for single audit oversight consisted of older manuals. Specifically, the policies and procedures that CMS officials provided consisted of documents such as the Grants Administration Manual and the 1982 Health Care Financing Administration Audit Resolution Manual—both of which were issued before the 1984 enactment of the Single Audit Act. Accordingly, the manuals do not reflect requirements related to the Single Audit Act, OMB Circular No. A-133, or HHS’s Grants Policy Directive 4.01. CMS officials acknowledged that their policies and procedures in this area were old. In addition, HHS officials acknowledged that one of the most significant challenges with single audit oversight has been the lack of standardization among the operating divisions’ policies and procedures. In May 2016, during our audit, HHS officials stated that they were working on updating single audit policies and procedures. However, it is unclear whether the updated single audit policies and procedures would address the specific findings related to CMS’s policies and procedures that we identified during our audit.

Department of Housing and Urban Development

HUD’s two selected subagencies, the Office of Community Development and Planning (CPD) and the Office of Public and Indian Housing (PIH), effectively designed policies and procedures to reasonably assure that award recipients completed and submitted single audit reports timely. HUD’s single audit oversight process is decentralized and HUD’s OCFO provides general departmental policies and procedures to the department’s program offices, such as CPD and PIH. HUD has policies and procedures that describe responsibilities of and processes for program offices in reviewing single audit reports. Each HUD program office is responsible for ensuring that award recipients submit single audit reports according to the time frames outlined in OMB Circular No. A-133.

Office of Community Planning and Development

CPD effectively designed policies and procedures to reasonably assure that award recipients completed and submitted single audit reports timely. According to CPD’s Clarifying Guidance to CPD Field Offices on Single Audit Act Requirements, field offices are expected to maintain a list of award recipients. CPD’s policies and procedures call for each field office to use its list to identify award recipients that are required to submit single audit reports based on the $500,000 expenditure threshold and to compare the list to the FAC database to determine if single audit reports have been completed and submitted within the required time frame. According to CPD’s guidance, if an audit has not been submitted, the field office is required to follow up in writing with the award recipient to determine the date of anticipated audit completion and submission of the needed information to the FAC database. CPD provided an example of a tracking log from fiscal year 2013 that it used to document missing audit reports, including the dates that it contacted award recipients of missing reports.

Office of Public and Indian Housing

PIH effectively designed policies and procedures to reasonably assure that award recipients completed and submitted single audit reports timely. PIH developed standard operating procedures for the field offices to help ensure that single audit reports are submitted. These procedures include (1) monitoring the PIH Real Estate Assessment Center’s (REAC) website, which is designed to allow award recipients to provide their financial statements to PIH prior to submission deadlines, and determining if the expenditures exceeded the single audit threshold; (2) contacting the award recipients to help ensure that single audit reports are submitted; and (3) checking the FAC to determine whether the required reports have been submitted. The REAC established a system wherein award recipients electronically submit information such as financial statements, audit reports, and audit findings into a data warehouse. In addition, PIH’s IPA Assessment Review states that PIH is to perform on-site reviews of the field offices’ internal controls over single audits and provide a checklist for these on-site reviews. PIH’s IPA Assessment Review included steps for reviewing the field offices’ internal controls (tracking logs) for ensuring submission of single audit reports.

Department of Transportation

One of Transportation’s two selected subagencies, the Federal Highway Administration (FHWA), effectively designed policies and procedures to reasonably assure that award recipients completed and submitted single audit reports timely. However, the other selected subagency at Transportation, the Federal Transit Administration (FTA), did not effectively design policies and procedures to reasonably assure that award recipients completed and submitted single audit reports timely. Transportation’s single audit oversight process is decentralized, with oversight responsibilities divided between the Assistant Secretary for Administration; the OIG; and each operating authority, such as FHWA and FTA. Transportation’s Assistant Secretary for Administration is responsible for issuing guidance, including guidance related to single audits. Each operating authority is responsible for ensuring that award recipients submit single audit reports according to the time frames outlined in OMB Circular No. A-133 and Transportation’s department- wide guidance.

Federal Highway Administration

FHWA effectively designed policies and procedures to reasonably assure that award recipients completed and submitted single audit reports timely. Transportation’s Office of the Senior Procurement Executive’s Financial Assistance Guidance Manual states that each operating authority, such as FHWA, is responsible for ensuring that award recipients undergo single audits and distribute the audit reports timely. The guidance manual also requires each operating authority to maintain tracking mechanisms for recording the receipt of audit reports. In addition, FHWA’s Financial Integrity Review and Evaluation (FIRE) Program Tool Kit (FIRE Tool Kit) states that FHWA officials are to determine when an audit report is due and use the FAC to ensure that the audit has been submitted. The FIRE Tool Kit includes a list of the states and their respective single audit reporting due dates. If an award recipient does not submit its single audit report by the due date, the guidance manual outlines the sanctions that can be taken until the report is received.

Federal Transit Administration

FTA did not effectively design policies and procedures to reasonably assure that award recipients submitted single audit reports timely. FTA had policies and procedures that reference OMB Circular No. A-133 single audit guidance, but these policies and procedures were not effectively designed to identify award recipients that should have submitted single audit reports, verify that the award recipients that were required to submit single audit reports actually submitted the reports, determine whether the award recipients that were required to submit single audit reports submitted the reports within the required time frame, and take action to obtain single audit reports when award recipients did not submit the reports within the required time frame.

FTA’s Grants A to Z Standard Operating Procedures states that each FTA regional office is responsible for ensuring that single audit reports are submitted timely and for identifying award recipients that are required to submit single audit reports, either through the review of the FAC database or by requesting report copies directly from award recipients. FTA regional offices are also required to follow up in writing with award recipients that have not provided single audit reports as required. While FTA’s policies and procedures allow it to ascertain which award recipients have submitted single audit reports and the dates of submission, the standard operating procedures document does not provide procedures on how regional offices should identify and track award recipients that should have submitted single audit reports by the required due dates but did not. According to an FTA official, FTA provides (1) additional guidance to its regional offices by holding bimonthly single audit training and guidance teleconferences and (2) customer support on a one-on-one basis when requested. Transportation officials acknowledged that single audits are important and that there are a number of opportunities to improve the department’s oversight.

Most of the Selected Subagencies Did Not Effectively Design Policies and Procedures to Reasonably Assure Timely Issuance of Written Management Decisions with the Required Content

The selected subagencies in Agriculture, HHS, HUD, and Transportation did not effectively design policies and procedures to reasonably assure that management decisions were prepared with the required content and issued within 6 months of receipt of the single audit report for each single audit finding, as required by OMB Circular No. A-133. Both of the selected subagencies in Education effectively designed policies and procedures to reasonably assure that management decisions were prepared with the required content and issued within 6 months of receipt of the single audit report for each single audit finding.

OMB Circular No. A-133 requires federal agencies to issue written management decisions on each of the single audit findings that clearly state whether the agency sustains the audit finding, the reasons for the decision, the expected award recipient action to repay disallowed costs and make financial adjustments or take other action, a timetable for follow-up if the award recipient has not completed corrective action, the appeals process available to the award recipient on the federal awarding agency’s management decision, and the reference numbers the auditor assigned to each single audit finding.

OMB Circular No. A-133 also requires the management decision to be issued within 6 months of receipt of a recipient’s single audit report. To reasonably ensure that award recipients take action to correct single audit findings, management decisions are to describe the corrective actions that federal agencies consider necessary based on their evaluation of the single audit findings and the award recipient’s plan to correct the single audit findings, according to OMB Circular No. A-133. Since federal agencies are responsible for ensuring that the award recipients take appropriate and timely corrective action, it is important for agency management to clearly communicate the agency’s expectations and time frames for action through management decisions. Management decision letters provide award recipients with written notification of the agency’s position. Without timely notification that contains all of the OMB requirements for written management decisions, award recipients may be unclear about the agency’s position on the single audit findings and what corrective actions, if any, they need to take to address the single audit findings. In turn, single audit findings may not be corrected, thus hampering oversight of federal awards.

Figure 3 provides an overview of our assessment of the design of selected subagencies’ policies and procedures to reasonably assure that management decisions met the requirements in OMB Circular No. A-133 and were issued timely.

Department of Agriculture

Agriculture’s two selected subagencies, FNS and RD, did not effectively design policies and procedures to reasonably assure that they prepared management decisions with the required content for each single audit finding and issued such management decisions within 6 months of receipt of the single audit reports, as required by OMB Circular No. A-133. Agriculture’s single audit oversight is decentralized, and the OCFO is responsible for providing departmental policy to the subagencies. Each subagency is responsible for issuing management decisions.

Food and Nutrition Service

FNS did not effectively design policies and procedures to reasonably assure that it prepared management decisions with the required content for each single audit finding and issued such management decisions within 6 months of receipt of the single audit reports, as required by OMB Circular No. A-133. The FNS Audit Manual requires regional offices to (1) evaluate single audit findings and the award recipients’ plans to correct single audit findings, (2) develop and communicate written management decisions on award recipients’ corrective action plans, and (3) issue management decisions within 6 months of receipt of the single audit reports. However, the audit manual does not require management decisions to include all of the criteria for the content of written management decisions identified in OMB Circular No. A-133, such as clearly stating whether a single audit finding is sustained, the reason for the management decision, and a description of the appeals process available to the award recipient on the federal agency’s decision.

FNS has policies and procedures for issuing a management decision within 6 months after a single audit report is received; however, the policies and procedures were not effectively designed to reasonably assure that the management decisions are issued as required. Specifically, FNS’s policies and procedures describe its Automated Tracking System, where FNS personnel enter single audit report tracking information, such as open and closed audits, disallowed costs, and the dates management decisions were issued. The Automated Tracking System generates a report that identifies audit reports for which management decisions have not been issued more than 120 days (about 4 months) after issuance of the audit report. However, the FNS Audit Manual does not require policies and procedures to reasonably assure that action is taken on the information in the Automated Tracking System so that management decisions are issued within 6 months of receipt of the audit reports.

An FNS official stated that other than its audit manual, FNS has not provided the regional offices with additional guidance about management decisions. The official also stated that single audit reports are not very helpful to FNS because while some of these reports are very comprehensive, the single audit findings are typically general in nature and very rarely specifically address FNS programs. According to an FNS official, the regional offices are expected to resolve FNS-specific single audit findings. However, according to FNS officials, there is no standard procedure for how the regional offices are to contact the states to resolve the issues.

An FNS official stated that the regional offices conduct Management Evaluations and Financial Management Reviews of award recipients. These reviews provide periodic assessments to help ensure that award recipients operate audit management programs that ensure compliance with applicable federal requirements. The FNS official further stated that FNS finds these assessment tools to be more useful to them for oversight purposes than single audit reports because they help FNS to identify specific programs that may need additional oversight. FNS officials also stated that single audits have not been the top priority for FNS because the quality and usefulness of the single audit reports are inconsistent, and therefore these reports are not beneficial oversight tools. However, the Single Audit Act requires federal awarding agencies to use single audits to conduct oversight of the federal funds that they award and provides for single audits to play a key role in achieving federal accountability objectives and ensuring that funds are used for authorized purposes and that risks of fraud, waste, and abuse are mitigated.

Without effectively designed policies and procedures for issuing management decisions related to single audit findings, FNS cannot reasonably assure the management decisions are issued timely and contain all of the required elements. For example, we reviewed a nongeneralizable sample of 16 FNS single audit findings and found that FNS issued management decision letters for 3 of the 16 single audit findings and that none of the letters contained all of the required elements listed in OMB Circular No. A-133 or were issued within 6 months of receipt of the single audit reports. The 3 management decisions were issued within 8 to 11 months of receipt of the single audit reports.

Rural Development

RD did not effectively design policies and procedures to reasonably assure that it prepared management decisions with the required content for each single audit finding and issued such management decisions within 6 months of receipt of the single audit reports, as required by OMB Circular No. A-133. RD had policies and procedures in its Instruction A- 2012 Manual that call for its regional offices to (1) evaluate single audit findings and the award recipients’ plans to correct single audit findings and (2) develop and communicate written management decisions on the award recipients’ corrective action plans. In addition, RD’s Financial Management OMB A-133 Standard Operating Procedures also describe its Automated Reports Tracking System, where RD personnel enter single audit report information for tracking, such as the single audit report number, audit finding code, action the auditee will take to correct the single audit findings, and the management decision date as defined by RD. However, its policies and procedures did not require all of the content listed in OMB Circular No. A-133 for management decisions, including whether the single audit finding was sustained, the reasons for the decision, a description of the appeals process available to the award recipient on the federal agency’s decision, and the reference numbers the auditor assigns to each single audit finding. In addition, the policies and procedures do not include a requirement that management decisions are to be issued within 6 months after the single audit reports are received.

Officials in RD’s Financial Management Division said that the state offices are in contact with the award recipients periodically, but do not usually send management decision letters to award recipients. In addition, RD’s policies and procedures use a different definition for management decisions than stated in OMB Circular No. A-133. RD’s policies and procedures state that RD provides a transmittal letter to the responsible party and that the responsible party is to provide all necessary documentation that verifies that corrective actions have been taken to address the auditor’s findings. RD’s policies and procedures describe the management decision date as the date that the award recipient responds to RD’s transmittal letter. OMB Circular No. A-133, however, provides that a management decision is the evaluation by the federal awarding agency of the single audit finding and corrective action plan and the issuance of a written decision as to what corrective action is necessary, and also states that the entity responsible for issuing a management decision shall do so within 6 months of receipt of the single audit report. We reviewed supporting documentation for a nongeneralizable sample of 12 single audit findings and found that RD issued transmittal letters for all 12 of the single audit findings. However, these transmittal letters did not provide evaluations of the single audit findings and corrective action plans and written decisions as to what corrective actions are necessary, as required by OMB Circular No. A-133. Without effectively designed policies and procedures for issuing management decisions related to single audit findings, RD cannot reasonably assure that the management decisions are issued timely and contain all required elements.

Department of Education

Education effectively designed policies and procedures to reasonably assure that it prepared management decisions with the required content for each single audit finding and issued such management decisions within 6 months of receipt of the single audit reports, as required by OMB Circular No. A-133. Education’s action officials are responsible for determining the action to be taken in issuing management decision letters within the 6-month time frame required by OMB Circular No. A-133. The policies and procedures related to management decisions on the award recipients’ plans to correct single audit findings at the two selected subagencies—OESE and OSERS—are the same.

Education’s Handbook for the Post Audit Process provides elements for the management decision letters that met the OMB Circular No. A-133 content requirements. These elements include (1) whether Education agrees with the audit finding; (2) the reasons for the decision; and (3) the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. In addition, Education’s policies and procedures require its Audit Accountability and Resolution Tracking System to mark as overdue any management decision letter not issued within 6 months. According to the handbook, tracking reports generated from the database that identify overdue or potentially overdue audit reports are sent to the action officials at the end of any quarter following the end of the 6-month resolution period. According to Education officials, at the time of our audit PAG was responsible for completing and updating the audit dashboards each month that include a metric related to the percentage of audits that are resolved timely. The dashboards include a variety of metrics for single audits reports and are to be distributed to all of Education’s program offices and reviewed by Education’s senior management.

Despite these policies and procedures, Education officials stated that for fiscal year 2013 single audit reports, some management decisions for OSERS and OESE were not issued timely. We reviewed a nongeneralizable sample of 42 Education single audit findings from fiscal year 2013 and found that all of the written management decisions included the content required by OMB Circular No. A-133. However, we found that most of the letters were issued from 7 to 18 months after receipt of the single audit reports. According to an Education official, in fiscal year 2013, Education did not have mechanisms to hold the program offices accountable for not issuing management decisions timely, but subsequently Education developed an organizational performance review that includes timely audit resolution in its metrics, which has served to increase accountability. In addition, Education’s fiscal year 2015 agency financial report stated that Education has strengthened controls over audit follow-up to ensure more timely resolution, correction, and closure of audit findings and continues to show significant improvements in timely audit resolution, and remains focused on working cooperatively with award recipients to address the most complex and repeat findings. In addition, audit follow-up reflects a key component of Education’s risk management strategy in the U.S. Department of Education Strategic Plan for Fiscal Years 2014 – 2018.

Department of Health and Human Services

HHS’s two selected subagencies, ARD and CMS, did not effectively design policies and procedures to reasonably assure that they prepare management decisions with the required content for each single audit finding and issue such management decisions within 6 months of receipt of the single audit reports, as required by OMB Circular No. A-133. According to an official from the HHS OIG, the OIG reviews single audit reports and assigns single audit findings to operating divisions, such as CMS, for resolution. Operating divisions are responsible for issuing management decisions for single audit findings assigned by the OIG. The OIG also assigns single audit findings that affect more than one operating division—crosscutting findings—to ARD for resolution, and ARD is to work with applicable operating divisions to issue management decisions.

An HHS official acknowledged that one of the most significant challenges with single audit oversight has been the lack of standardization and interpretation of the policies and procedures. An HHS official further stated that some operating divisions were interpreting the management decision guidance differently. Specifically, the official said that some operating divisions thought that the management decision was only sent when the audit resolution official determined that the corrective action was complete and acceptable, while others sent management decision letters as soon as they had evaluated the nature of the finding and decided what the corrective action would be, with the goal of accomplishing this within 6 months. In other cases, the award recipient had already provided evidence that the single audit finding was resolved. HHS officials stated that the operating divisions have the same understanding now and that it was agreed that the decisions would be based on the initial opinion of the single audit finding and planned corrective action, and that these decisions would need to be issued within 6 months. In addition, an HHS official stated that HHS’s Single Audit Resolution work group recently developed guidance for issuing and handling management decisions for single audit findings that will apply to the entire department. At the time of our audit, the Deputy Assistant Secretary and the Deputy Chief Financial Officer were reviewing this guidance. In addition, ARD officials told us that HHS plans to transition single audit finding activities from the OIG to ARD. They also stated that ARD has established an overall plan to streamline processes that will enhance its audit resolution processes and reporting and that the implementation of an enterprise-wide audit resolution system that will automate audit resolution processes will be a major process enhancement. However, it is unclear whether the updated single audit guidance or processes will address our audit finding, ensuring that policies and procedures are effectively designed to reasonably assure that management decisions with the required content for each single audit finding are prepared and issued within 6 months of receipt of the single audit reports, as required by OMB guidance.

Audit Resolution Division

ARD did not effectively design policies and procedures to reasonably assure that it prepared management decisions with the required content for each single audit finding and issued such management decisions within 6 months of receipt of the single audit reports, as required by OMB Circular No. A-133. The ARD Manual contains ARD’s policies and procedures for issuing management decisions and states that staff should issue management decisions after they have completed their review of single audit reports and the award recipients’ corrective action plans. In addition, the manual provides an example of a management decision that staff should use when communicating the results of ARD’s review of the single audit finding and the corrective action plan to the award recipient. However, neither the ARD Manual nor the management decision example contains all of the required OMB Circular No. A-133 elements, such as the reason for the decision, a timetable for follow-up that should be performed if the award recipient has not completed corrective action, and a description of any appeal process available to the award recipient. In addition, the manual does not specifically state that the management decision letter should be issued within six months of receipt of the single audit report as required. According to an HHS official, ARD issues management decisions after the HHS OIG sends ARD a letter of single audit findings for resolution. OMB Circular No. A-133 states that the awarding agency shall issue a management decision on single audit findings within 6 months after the receipt of the audit report.

Without effectively designed policies and procedures for issuing management decisions, ARD cannot reasonably assure that the management decisions are issued timely and contain all required elements. For example, we reviewed a nongeneralizable sample of 10 ARD single audit findings from fiscal year 2013 and found that ARD issued management decisions for all 10 single audit findings but they did not contain the required elements listed in OMB Circular No. A-133 . We also found that ARD issued 6 of the 10 management decisions within the required 6 months of the single audit report being available in the FAC. ARD issued the other 4 management decisions from 7 to 9 months after the reports were available in the FAC. According to an HHS official, there can be delays between the time the OIG obtains the reports from the FAC and assigns the single audit findings to ARD and other operating divisions. For the 4 management decisions, we reviewed the time period between the date that the OIG assigned the single audit finding to ARD and the date ARD issued the management decision. ARD issued the management decisions from 3 to 5 months after the OIG assigned the single audit findings to ARD. ARD officials stated that ARD was currently in a transition period, as it is taking on some of the activities that were performed by the OIG and is revising its audit resolution policies and procedures to accommodate the transition.

Centers for Medicare and Medicaid Services

CMS did not effectively design policies and procedures to reasonably assure that it prepared management decisions with the required content for each single audit finding and issued such management decisions within 6 months of receipt of the single audit reports, as required by OMB Circular No. A-133. According to a CMS official, CMS’s policies and procedures relating to single audit oversight include its 1982 Health Care Financing Administration Manual. This manual contains the policies and procedures for resolving CMS single audit findings on grants, contracts, and cooperative agreements, and for controlling the audit resolution process and CMS’s departmental audit resolution policies and requirements. According to a CMS official, CMS issued its policies and procedures for the resolution of audit findings, which contained elements found in OMB Circular No. A-73, Audit of Federal Operations and Programs. However, OMB Circular No. A-73 was rescinded in 1995. CMS had not updated its policies and procedures for management decisions as of May 2016.

Without effectively designed policies and procedures for issuing management decisions, CMS cannot reasonably assure that the management decisions are issued timely and contain all required elements. For example, we reviewed a nongeneralizable sample of 18 CMS single audit findings from fiscal year 2013, and found that CMS issued only one management decision for 1 of the 18 single audit findings that we reviewed. This management decision contained the content required by OMB Circular No. A-133 and was issued within 6 months of receipt of the single audit report. CMS officials told us that in the past, CMS has communicated management decisions through telephone conversations or via e-mail to the award recipients. CMS provided us with e-mail correspondence between CMS and the award recipients for 13 of the 18 single audit findings. However, the e-mails related to requesting additional information from the award recipients and did not contain the content elements required by OMB Circular No. A-133 for management decisions and accordingly do not constitute a management decision.. According to CMS officials, at the time of our audit CMS was collaborating with the other HHS operating divisions to update their policies and procedures. However, it is unclear whether the updated single audit guidance would address our audit finding, ensuring that policies and procedures are effectively designed to reasonably assure that management decisions with the required content for each single audit finding are prepared and issued within 6 months of receipt of the single audit reports, as required by OMB guidance.

Department of Housing and Urban Development

HUD’s two selected subagencies, CPD and PIH, did not effectively design policies and procedures to reasonably assure that they prepared management decisions with the required content for each single audit finding and issued such management decisions within 6 months of receipt of the single audit reports, as required by OMB Circular No. A-133. HUD’s OCFO provides general departmental policies and procedures to its program offices, such as CPD and PIH. HUD’s OCFO developed the Audits Management System Handbook that describes procedures and responsibilities for HUD’s program offices to review single audit reports and issue management decisions. Each HUD program office is responsible for ensuring single audit findings are resolved and management decisions are issued as set forth in OMB Circular No. A- 133. HUD’s senior accountable official for single audits stated that the decentralized approach for single audit oversight that HUD currently uses is a consequence of the HUD OIG transferring audit resolution activities to HUD program offices. The official further stated that the program offices did not have the processes and procedures or experience needed to take on responsibility for audit resolution. The official also stated that HUD is working on a proposal to move to a centralized approach for single audit oversight to better manage HUD’s compliance with OMB Circular No. A-133 but will need additional staffing to implement the proposed approach.

Office of Community Planning and Development

CPD did not effectively design policies and procedures to reasonably assure that it prepared management decisions with the required elements for each single audit finding and issued such management decisions within 6 months of receipt of the single audit reports, as required by OMB Circular No. A-133. HUD/CPD’s Clarifying Guidance to CPD Field Offices on Single Audit Act Requirements requires that written management decisions on all CPD-specific single audit findings be communicated to the award recipients within 6 months of receipt of the single audit. It also listed all the management decision content requirements of OMB Circular No. A-133. However, CPD’s and HUD’s policies and procedures were not effectively designed to reasonably assure that management decisions are actually prepared with the required content and were issued timely as they did not include steps to help to ensure that the policies and procedures were actually carried out. For example, neither CPD’s nor HUD’s policies or procedures identify the steps such as reviews by management at the functional or activity levels to help reasonably assure that management decisions are issued timely. We reviewed a nongeneralizable sample of 18 CPD single audit findings from fiscal year 2013 and found that CPD issued management decisions for all 18 single audit findings, but only 4 of the management decisions contained all of the required content elements of OMB Circular No. A-133. Furthermore, management decisions for 10 of the 18 single audit findings were not issued within 6 months of receipt of the single audit reports. The 10 management decisions were issued from 7 to 19 months after receipt of the single audit reports. Without effectively designed policies and procedures for issuing management decisions, CPD cannot reasonably assure that the decisions are issued timely and contain all required elements.

Office of Public and Indian Housing

PIH did not effectively design policies and procedures to reasonably assure that it prepared management decisions with the required content for each single audit finding and issued such management decisions within 6 months of receipt of the single audit reports, as required by OMB Circular No. A-133. PIH’s Memorandum for PIH Hub Directors and Program Coordinators (Field Guidance on Single Audit Act Requirements) did not include all of the management decision letter content required by OMB Circular No. A-133, such as the requirement that the management decision describe the appeals process available to the recipient or include the auditor’s assigned reference number for the single audit finding. In addition, while PIH’s policies and procedures call for management decisions to be issued within 6 months of receipt of the single audit report, such policies and procedures did not include steps to help ensure that the policies and procedures are actually carried out. For example, the policies and procedures do not identify steps such as reviews by management at the functional or activity levels to help reasonably assure that management decisions are issued timely.

We reviewed a nongeneralizable sample of 19 PIH single audit findings from fiscal year 2013 and found that PIH issued management decision letters for 14 of the 19 single audit findings, but none of them contained all of the content required for management decisions, as specified in OMB Circular No. A-133. For 4 of the 14 single audit findings, the management decisions were not issued within 6 months of the single audit report but were issued about 11 months after receipt of the single audit reports. Without effectively designed policies and procedures for issuing management decisions, PIH cannot reasonably assure the management decisions are issued timely and contain all required elements.

Department of Transportation

Transportation’s two selected subagencies, FHWA and FTA, did not effectively design policies and procedures to reasonably assure that they prepared management decisions with the required content for each single audit finding and issued such management decisions within 6 months of receipt of the single audit reports, as required by OMB Circular No. A- 133. Each operating authority is responsible for issuing management decisions and ensuring that award recipients take action to correct single audit findings. Accordingly, each operating authority may have different policies and procedures related to issuing management decisions than those included in Transportation’s Financial Assistance Guidance Manual, which provides procedural guidance to be followed in the department’s award and monitoring of financial assistance. The Office of the Deputy Secretary for Administration recognized the need to strengthen Transportation’s actions relating to single audit recommendations. However, as discussed below, we found deficiencies relating to the management decision requirements in OMB Circular No. A- 133 at the two selected subagencies—FHWA and FTA.

Federal Highway Administration

FHWA did not effectively design policies and procedures to reasonably assure that it prepared management decisions with the required elements for each single audit finding and issued such management decisions within 6 months of receipt of the single audit reports, as required by OMB Circular No. A-133. Transportation had policies and procedures relating to single audit findings, and FHWA had policies and procedures requiring the issuance of a management decision within 6 months of receipt of the single audit report, as required by OMB Circular No. A-133. While FHWA’s policies and procedures include an example of a management decision, they did not specifically require the elements of management decisions specified in OMB Circular No. A-133. FHWA’s FIRE Tool Kit states that division offices are responsible for developing and issuing management decision letters and contains an example of a management decision. This example includes information related to the single audit report, a reference to the single audit finding, and FHWA’s assessment of the corrective action proposed by the award recipient. However, neither the Fire Tool Kit nor the example of the management decision describes the elements OMB Circular No. A-133 requires be included in the management decision, such as a statement indicating whether FHWA agrees with the single audit finding, the reasons for its decision, and a timetable for actions if the award recipient has not completed corrective action.

In addition, FHWA’s policies and procedures listed in the FIRE Tool Kit were not effectively designed to reasonably assure that management decisions are actually prepared with the required content and are issued timely because such policies and procedures did not include steps that help to ensure that the policies and procedures are actually carried out. For example, the policies and procedures did not include steps such as reviews by management to reasonably assure that management decisions contain the required content and are issued within 6 months of the date the single audit report is received.

We reviewed a nongeneralizable sample of 22 FHWA single audit findings from fiscal year 2013 and found that FHWA issued management decisions for 9 of the 22 single audit findings. Of these nine management decisions, three contained the elements required by OMB Circular No. A- 133 and were issued within 6 months of receipt of the single audit reports. FHWA officials stated that the management decisions that were not issued were inadvertently missed and the FHWA division offices responsible for issuing the management decisions did not adhere to FHWA’s single audit procedures. FHWA officials further stated that the responsible division offices worked with the award recipients to resolve these single audit findings. However, FHWA’s policies and procedures were not effectively designed to reasonably assure that management decisions are actually prepared with the required content and are issued timely, as they did not include steps to help to ensure that the policies and procedures were actually carried out.

Federal Transit Administration

FTA did not effectively design policies and procedures to reasonably assure that it prepared management decisions with the required content for each single audit finding and issued such management decisions within 6 months of receipt of the single audit reports, as required by OMB Circular No. A-133. Transportation had policies and procedures relating to single audit findings. In addition, FTA’s Grants A to Z Standard Operating Procedures states that FTA’s staff is responsible for issuing management decisions, staying up-to-date on OMB Circular No. A-133 requirements, and ensuring that management decisions are issued on FTA single audit findings within 6 months of receiving the award recipients’ single audit reports. However, FTA’s Grants A to Z Standard Operating Procedures does not state the OMB Circular No. A-133 content requirements that should be included in the management decisions or describe how the agency will reasonably assure that management decisions are issued timely. FTA officials stated that they issued management decisions via e- mail. However, we reviewed the e-mails provided to us by FTA officials and found that none of them contained all of the elements required in OMB Circular No. A-133. FTA officials also stated that they are working on updating the standard operating procedures to reflect the changes they are implementing for issuing management decisions and have started a review of their management decision process.

Without effectively designed policies and procedures over management decisions, FTA cannot reasonably assure the management decisions contain the required elements and are issued timely. We reviewed a nongeneralizable sample of 15 FTA single audit findings from fiscal year 2013 and found that FTA issued management decision letters for 3 of the 15 single audit findings. In addition, none of the three management decisions contained all of the required elements or were issued within 6 months, as required by OMB Circular No. A-133. For the remaining 12 single audit findings, FTA provided us with e-mail correspondence; however, the e-mails primarily related to requesting additional information from the award recipients and did not contain the management decision content elements required by OMB Circular No. A-133. FTA officials stated that they ensured that the award recipients took steps to complete the appropriate corrective actions.

Only Two of the Selected Subagencies Had Policies and Procedures for Identifying and Managing Both High- Risk and Recurring Single Audit Findings Using a Risk-Based Approach

Two of the selected subagencies, OESE and OSERS in Education, had policies and procedures designed to use a risk-based approach to identify and manage both high-risk and recurring single audit findings. Education uses a centralized approach to identify and manage high-risk and recurring single audit findings for these subagencies. None of the selected subagencies in Agriculture, HHS, and HUD had policies and procedures for using a risk-based approach to identify and manage high- risk and recurring single audit findings. Two of the selected subagencies in Transportation had policies and procedures for using a risk-based approach to identify and manage high-risk but not recurring single audit findings.

We previously reported that federal agencies do not systematically use audit findings to identify and understand emerging and persistent issues related to grant programs and award recipients’ use of funds. Identifying and categorizing certain single audit findings as high risk—that is, those that if they are not corrected in a timely manner, may be seriously detrimental to federal programs—can assist federal agencies in understanding emerging and persistent issues related to award recipients’ use of funds and allow federal agencies to prioritize their resources to help ensure that the award recipients timely address these findings. Among other things, high-risk single audit findings could result in program failure; abuse; mismanagement; misuse of federal funds; improper payments; significantly impaired service; significantly reduced program efficiencies and effectiveness; unreliable data for decision making; and unauthorized disclosure, manipulation, or misuse of sensitive information. Recurring single audit findings are also of concern because they indicate deficiencies that have persisted and may need more resources or attention from the agency to address them. Consequently, both high-risk and recurring single audit findings pose increased risks to federal programs and improper payments.

Risk management is a strategy for helping program managers and stakeholders make decisions about assessing risk, allocating resources, and taking actions under conditions of uncertainty. Risk management can be applied to an entire organization; to different levels of the organization; or to specific functions, projects, and activities. Leading risk management practices include that an organization develop, implement, and continuously improve a process for managing risk and integrate it into the organization’s overall governance, strategy, policies, planning, management, and reporting processes. While risk management does not provide absolute assurance of achieving an organization’s objectives, an effective risk management strategy over high-risk and recurring single audit findings can be particularly useful to help management identify potential problems and reasonably allocate resources to address them. In addition, Standards for Internal Control in the Federal Government states that internal control should provide for an assessment of the risk the agency faces from both external and internal sources.

FAC officials stated that award recipients submitted over 40,000 single audit reports to the FAC for fiscal year 2013. Given the numbers of single audit reports and single audit findings as well as constraints in federal resources for conducting oversight of single audits, identifying and managing high-risk and recurring single audit findings using a risk-based approach can assist in identifying problem areas and addressing priorities.

Figure 4 provides an overview of our assessment of the selected subagencies’ policies and procedures for using a risk-based approach for identifying and managing high-risk and recurring single audit findings.

Department of Agriculture

Agriculture’s two subagencies, FNS and RD, did not have policies and procedures for using a risk-based approach to identify and manage high- risk and recurring single audit findings.

Food and Nutrition Service

FNS did not have policies and procedures for using a risk-based approach to identify and manage high-risk and recurring single audit findings. Instead, FNS officials stated that regional offices conduct a Management Evaluation and Financial Management Review of each award recipient every 3 to 5 years. This review focuses on program compliance issues as well as financial management issues to assist FNS’s oversight of award recipients. According to FNS officials, these reviews are used to identify award recipients that are not in compliance with award requirements, including requirements for resolving single audit findings. While these reviews may be useful in evaluating award recipients’ use of federal funds, performing the reviews every 3 to 5 years limits FNS’s ability to timely identify problem areas and set priorities for addressing them.

Rural Development

RD did not have policies and procedures for using a risk-based approach to identify and manage high-risk and recurring single audit findings. According to RD officials, all single audit findings were given the utmost attention to ensure that corrective actions were taken for all findings, regardless of their substance. However, using a risk-based approach may help to reasonably assure that the single audit findings that pose the greatest risk to a program’s objectives or of fraud, waste, or abuse of federal funds are identified and addressed in a timely manner.

RD’s standard operating procedures state that the Financial Management Division program analyst downloads single audit reports from the FAC, reviews the information contained in the single audit reports, and determines which RD agency or program area is to respond to the single audit findings. In addition, the standard operating procedures state that the program analyst tracks the single audit findings in the Automated Reports Tracking System until the single audit finding is closed. Although RD does not separately identify and track recurring single audit findings, officials noted that single audit reports are checked against previous single audit reports to see if there are recurring single audit findings. According to RD officials, they notify the state office or program area via transmittal letter that a single audit finding is recurring from a prior year (citing the previously processed single audit finding) and that the award recipient has not addressed the single audit finding through corrective actions. While this procedure is indicated in RD’s standard operating procedures, RD’s standard operating procedures do not include a risk-based approach so that state offices or program areas can identify and manage the single audit findings that could pose a greater risk to the program’s objectives or increase the risk of fraud, waste, or abuse of federal funds.

Department of Education

Education had policies and procedures for using a risk-based approach to identify and manage high-risk and recurring single audit findings and such procedures include assigning a category to single audit reports and findings based upon an assessment of risks. The Post Audit Group (PAG) of Education’s Office of the Chief Financial Officer (OCFO) developed department-wide policies and procedures for single audit oversight and audit resolution. In addition PAG plays a central role in single audit oversight and in coordination of audit resolution by processing and distributing single audit reports, working with the principal offices and other stakeholders for the award recipients to address single audit findings, and tracking audit reports and single audit findings in the Audit Accountability and Resolution Tracking System (AARTS). Education’s PAG Director stated that the department began categorizing single audit reports as high, medium, or low risk, based on a variety of factors, through the AARTS system in 2012. As new single audit reports are uploaded into AARTS, they are assessed electronically using predetermined criteria based on risk factors and each audit is assigned an overall risk rating. As such, all single audit findings contained in an audit carry the same level of risk. According to the Director, these risk ratings enable the staff assigned to the audit report to prioritize their workloads according to the assessed risk.

Education’s program offices and PAG then use a “triage” process at the program and department levels to assess the seriousness of each single audit finding and determine the amount of attention needed for resolution. According to the policies and procedures in Education’s Handbook for the Post Audit Process, each program office holds a monthly meeting to discuss and reach agreement on the actions needed to resolve each single audit finding at the program level. In addition, Education holds a monthly “triage meeting” at the department level where the program offices, PAG, OIG, and the Office of the General Counsel review the program office-level triage recommendations on whether the resolution approach should be full resolution, abbreviated resolution, informal resolution, or an appropriate combination of these approaches. Education’s Handbook for the Post Audit Process also states that a full resolution approach should be used for a recurring finding. In addition, Education was able to provide us with a list of single audit findings that were recurring from prior years.

Department of Health and Human Services

HHS’s two selected subagencies, ARD and CMS, did not have policies and procedures for using a risk-based approach to identify and manage high-risk and recurring single audit findings. HHS’s Office of the Assistant Secretary sets the policies that outline the roles and responsibilities of the offices and operating divisions involved in the single audit process, but had not issued guidance requiring the department to identify and manage high-risk and recurring single audit findings using a risk-based approach. HHS officials stated that operating divisions are responsible for ensuring that single audit findings are identified and resolved. Operating divisions are responsible for issuing management decisions for single audit findings assigned to them by the OIG. The OIG also assigns single audit findings that affect more than one operating division—known as crosscutting findings—to ARD for resolution, and ARD is to work with the affected operating divisions to issue management decisions. ARD and CMS officials stated that they do not assess the risk of the single audit findings.

Audit Resolution Division

ARD did not have policies and procedures for using a risk-based approach to identify and manage high-risk and recurring single audit findings. According to ARD officials, they do not prioritize single audit findings based on risk or recurrence, and as a result, they have not developed policies and procedures to identify, monitor, or track high-risk and recurring single audit findings. ARD officials stated that if they determine that a crosscutting finding is recurring from a prior year, they will indicate that it is a prior year finding in the management decision to the award recipient, but they do not otherwise assign a risk to recurring single audit findings.

Centers for Medicare and Medicaid Services

CMS did not have policies and procedures for using a risk-based approach to identify and manage high-risk and recurring single audit findings. CMS officials stated that they resolve each single audit finding and ensure that corrective actions have been achieved. CMS’s policies and procedures did not contain requirements to identify and manage single audit findings based on risk and recurrence. However, CMS officials stated that CMS has been participating in a Single Audit Metrics Initiative pilot project since fiscal year 2012. The project focuses on eliminating repeated material noncompliance single audit findings in CMS’s highest-risk program, Medicaid. They also stated that the number of repeated material noncompliance single audit findings for fiscal year 2014 audits decreased by 29 percent compared to the number in fiscal year 2010. CMS officials stated that this level of success was achieved by focusing on training audit analysts in audit resolution principles and processes; requiring that implementation of corrective action plans is verified; and holding regular meetings with CMS’s single audit work group to discuss best practices, new techniques, and other topics. The CMS pilot illustrates the effectiveness of using a risk-based approach to manage risks.

Department of Housing and Urban Development

HUD’s two subagencies, CPD and PIH, did not have policies and procedures for using a risk-based approach to identify and manage high- risk and recurring single audit findings. The OCFO provides general departmental policies and procedures to HUD’s program offices for single audit oversight. HUD’s policies and procedures state that the program offices (such as CPD and PIH) are responsible for ensuring that single audits are submitted, monitored, and tracked.

Office of Community Planning and Development

CPD did not have policies and procedures for using a risk-based approach to identify and manage high-risk and recurring single audit findings. CPD’s Risk Analyses for Monitoring Community Planning and Development Grant Programs guidance provides a methodology for conducting risk analyses of award recipients and establishes monitoring priorities. Each CPD field office is responsible for developing an office work plan with monitoring strategies to address how it will monitor CPD award recipients and programs during the fiscal year. The risk analyses include evaluating risk factors related to grant management and financial management and looking at specific elements, such as findings contained in the single audit reports. Based on this evaluation, CPD assigns award recipients to one of three risk categories: low, medium, and high. CPD’s policies and procedures call for it to rank award recipients based on risks in order to develop a work plan and strategies for monitoring individual award recipients.

According to CPD’s guidance, recurring findings are included in CPD’s risk analysis process and can affect the risk score and risk rating assigned to a grantee. The guidance also requires CPD staff to maintain a log to track all CPD findings and recurring findings. However, CPD policies and procedures do not specifically require staff to indicate if a finding is repeated from a prior year. While the review of single audit findings is included as one of the elements used to determine award recipient risk, this process is not designed to assess individual audit findings based on risks and thus, CPD does not use a risk-based approach for recurring single audit findings. Single audit findings of a higher risk, if not identified and managed, could increase the risk of fraud, waste, or abuse of federal resources.

Office of Public and Indian Housing

PIH did not have policies and procedures for using a risk-based approach to identify and manage high-risk and recurring single audit findings. According to PIH officials, PIH conducts a national risk assessment on a quarterly basis to assess the risks presented by each of PIH’s award recipients. PIH officials informed us that each award recipient is rated on four categories—physical risks, financial risks, management risks, and governance risks—using a basic statistical formula to identify outliers and other key risk indicators. According to PIH officials, the National Risk Assessment includes a survey of the quality of the audits and whether the award recipient is responsive to single audit findings, including whether the award recipient has past due responses or repeat single audit findings. The staff survey includes a question on whether the award recipient understands HUD requirements, policies, regulations, and laws in the event that there were serious single audit findings. However, the National Risk Assessment does not include identifying or tracking single audit findings and is not used to identify high-risk single audit findings. According to PIH officials, the data on specific single audit findings are not in a usable format that would allow the risk assessment to include that level of data.

According to PIH officials, single audit findings are identified and tracked either through the Next Generation Management System/Portfolio and Risk Management Tool or through the intra-office tracking log located on PIH’s Office of Field Operation’s SharePoint website. However, PIH did not have policies and procedures for using a risk-based approach to identify and manage high-risk and recurring single audit findings.

Department of Transportation

Transportation had policies and procedures for using a risk-based approach to identify and manage high-risk single audit findings. In addition, FHWA and FTA had policies and procedures for identifying recurring single audit findings, but neither of them had policies and procedures to use a risk-based approach to manage recurring single audit findings. The responsibilities of identifying, monitoring, and resolving high-risk and recurring single audit findings were divided between the OIG and the operating administrations. The OIG reviews single audit reports and categorizes single audit findings as part of its oversight role, and the operating authorities are responsible for ensuring that single audit findings are resolved. The OIG had policies and procedures detailing its single audit oversight for reviewing single audit reports from the FAC and using a risk-based approach for categorizing single audit findings for both FHWA and FTA.

Federal Highway Administration

The Transportation OIG is responsible for and had policies and procedures for reviewing single audit findings for FHWA and categorizing them based on risk; however, FHWA did not have policies and procedures for using a risk-based approach to manage recurring single audit findings. FHWA’s FIRE Tool Kit states that high-risk single audit findings identified by the OIG are tracked using a SharePoint tracking website. FHWA has 30 days to prepare a plan to address the single audit findings, establish target action dates to correct the findings, and provide an e-mail to the OIG stating (1) that the single audit report has been reviewed, (2) that the award recipient is in tentative agreement with the single audit finding, and (3) the action dates. If FHWA does not submit this information to the OIG within 30 days, it is considered late. According to an OIG official, in such instances, officials within the Office of the Secretary contact the departments to determine why the single audit findings are still open.

FHWA’s FIRE Tool Kit also states that its regional offices are responsible for conducting repeat finding analyses to determine if there are systemic deficiencies or internal control gaps in the award recipients’ processes. However, the policies and procedures do not state what is done with this report or how it is used to monitor recurring single audit findings. FHWA uses the Review Response Tracker and SharePoint system to track the resolution of single audit findings. According to FHWA officials, the Review Response Tracker can generate a report or list of all the single audit findings that are repeated from a prior year; however, the FIRE Tool Kit does not require that this report be generated regularly or that the report to be used to monitor recurring single audit findings. In addition, the FIRE Tool Kit does not state what is done with this report or how it is used to monitor recurring single audit findings.

Federal Transit Administration

The Transportation OIG is responsible for and has policies and procedures for reviewing single audit findings and categorizing them based on risk; however, FTA did not have policies and procedures for using a risk-based approach to identify and manage recurring single audit findings. FTA’s Grants A to Z Standard Operating Procedures requires FTA regional offices to track all single audit findings using the FTA Oversight Tracking System. In addition, FTA regional offices work with award recipients to ensure that the single audit findings identified by the OIG are adequately addressed. Once action has been taken, an FTA regional office is responsible for completing the Report to Close OIG Single Audit Recommendation document and sending it to the OIG for review and closeout. Once the OIG approves the closure of the finding, the finding will be closed in the Oversight Tracking System.

According to FTA officials, those responsible for resolving single audit findings can indicate in the Oversight Tracking System whether a single audit finding is a “repeat” finding from a prior year, and the system can generate a report of all the single audit findings that have been identified as repeat findings. However, FTA’s guidance does not require staff to indicate if the finding is repeated from a prior year. As a result, FTA lacks policies and procedures to reasonably assure that recurring single audit findings are consistently identified within the Oversight Tracking System, or track the progress award recipients have made to address such findings.

Conclusions

Single audits are considered to be a critical element of the government’s oversight of more than an estimated $600 billion in annual federal awards and help reasonably assure that federal funds are properly used. The selected subagencies of the five federal agencies that we reviewed had policies and procedures that included elements of OMB’s guidance on single audit oversight. However, most of these subagencies did not always effectively design policies and procedures to reasonably assure that award recipients submitted single audit reports in a timely manner and that federal awarding agencies issued written management decisions on single audit findings with the required content in a timely manner. Without the effective design of these policies and procedures, agencies and subagencies cannot reasonably assure that they are conducting the required effective oversight of the federal funds they have awarded. In addition, most of the subagencies in our study did not have policies and procedures for using a risk-based approach to identify and manage high- risk and recurring single audit findings. Such findings, if not addressed timely, may be seriously detrimental to federal programs. Identifying and managing single audit findings using a risk-based approach could also assist federal agencies and subagencies in understanding emerging and persistent issues related to award recipients’ use of funds identified by single audit findings and allow federal agencies and subagencies to prioritize their resources to help ensure that these findings are timely addressed by the award recipients. Of the five agencies in our audit, only one agency’s (Education) two selected subagencies had effectively designed policies and procedures in the three areas addressed in our audit. The results in our report point to a need for more effective design of policies and procedures relating to single audits to help improve oversight of federal awards and reduce improper payments.

Recommendations for Executive Action

We recommend that the Secretary of Agriculture direct the Under Secretary for Food, Nutrition, and Consumer Services to take the following three actions:

Design policies and procedures to reasonably assure that all award recipients required to submit single audit reports do so in accordance with OMB guidance.

Revise policies and procedures to reasonably assure that management decisions contain the required elements and are issued timely in accordance with OMB guidance.

Design and implement policies and procedures for identifying and managing high-risk and recurring single audit findings using a risk- based approach.

We recommend that the Secretary of Agriculture direct the Under Secretary for Rural Development to take the following three actions:

Design policies and procedures to reasonably assure that all award recipients required to submit single audit reports do so in accordance with OMB guidance.

Revise policies and procedures to reasonably assure that management decisions contain the required elements and are issued timely in accordance with OMB guidance.

Design and implement policies and procedures for identifying and managing high-risk and recurring single audit findings using a risk- based approach.

We recommend that the Secretary of Health and Human Services direct the Assistant Secretary for Financial Resources to take the following three actions:

Design policies and procedures to reasonably assure that all award recipients required to submit single audit reports do so in accordance with OMB guidance.

Revise policies and procedures to reasonably assure that management decisions contain the required elements and are issued timely in accordance with OMB guidance.

Design and implement policies and procedures for identifying and managing high-risk and recurring single audit findings using a risk- based approach.

We recommend that the Secretary of Health and Human Services direct the Administrator of the Centers for Medicare and Medicaid Services to take the following three actions:

Revise its policies and procedures to take action to obtain single audit reports when award recipients did not submit reports within the required time frames.

Revise its policies and procedures to reasonably assure that management decisions contain the required elements and are issued timely in accordance with OMB guidance.

Design and implement policies and procedures for identifying and managing high-risk and recurring single audit findings using a risk- based approach.

We recommend that the Secretary of Housing and Urban Development direct the Principal Deputy Assistant Secretary for the Office of Community Planning and Development to take the following two actions:

Revise policies and procedures to reasonably assure that management decisions contain the required elements and are issued timely in accordance with OMB guidance.

Design and implement policies and procedures for identifying and managing high-risk and recurring single audit findings using a risk- based approach.

We recommend that the Secretary of Housing and Urban Development direct the Principal Deputy Assistant Secretary for the Office of Public and Indian Housing to take the following two actions:

Revise policies to reasonably assure that management decisions contain the required elements and are issued timely in accordance with OMB guidance.

Design and implement policies and procedures for identifying and managing high-risk and recurring single audit findings using a risk- based approach.

We recommend that the Secretary of Transportation direct the Administrator of the Federal Highway Administration to take the following two actions:

Revise policies and procedures to reasonably assure that management decisions contain the required elements and are issued timely in accordance with OMB guidance.

Design and implement policies and procedures for identifying and managing recurring single audit findings using a risk-based approach.

We recommend that the Secretary of Transportation direct the Administrator of the Federal Transit Administration to take the following three actions:

Design policies and procedures to reasonably assure that all award recipients required to submit single audit reports do so in accordance with OMB guidance.

Revise policies and procedures to reasonably assure that management decisions contain the required elements and are issued timely in accordance with OMB guidance.

Design and implement policies and procedures for identifying and managing recurring single audit findings using a risk-based approach.

Agency Comments and Our Evaluation

We provided a draft of this report to Agriculture, Education, HHS, HUD, and Transportation for comment.

One of Agriculture’s subagencies, RD, provided comments, in an e- mail submitted on behalf of the Acting Deputy Under Secretary for Rural Development, stating that it agreed with our recommendations. The e-mail did not address our recommendations to the other subagency, FNS.

Education provided a technical comment, in an e-mail from the Executive Secretariat in the Office of the Secretary, which we incorporated as appropriate.

In its written comments, reprinted in appendix II, HHS concurred with our recommendations.

HUD provided comments related to its two subagencies, PIH and CPD, in an e-mail submitted on behalf of the Principal Deputy Assistant Secretary for PIH and the Principal Deputy Assistant Secretary for CPD. PIH indicated that it had taken actions that addressed our recommendations, while CPD disagreed with the two recommendations directed to it.

In its written comments, reprinted in appendix III, Transportation concurred with our recommendations.

Agriculture, HHS, HUD, and Transportation also provided technical comments, which we incorporated as appropriate.

Department of Agriculture

In an e-mail submitted on behalf of the Acting Deputy Under Secretary for Rural Development, RD stated that it agreed with our recommendations and stated that it will work with Agriculture’s OCFO and the program areas to develop policies and procedures to ensure that its award recipients are in compliance with OMB guidance. RD stated that it will meet with each program area and discuss how single audits are processed and resolved. RD plans to develop policies and procedures for identifying all award recipients that should file single audit reports; determining if all required single audit reports are filed, received, and processed each year; and assuring that transmittal letters and management decisions contain the required elements and are issued timely in accordance with current OMB guidance. RD also stated that it will develop new policies and procedures for identifying and managing high-risk and recurring single audit findings using a risk-based approach.

Department of Health and Human Services

In its letter reprinted in appendix II, HHS concurred with our recommendations to the Assistant Secretary for Financial Resources (ASFR) and to the Administrator of CMS related to monitoring the submission of single audit reports, issuing management decisions, and identifying and managing high-risk and recurring single audit findings.

Overall, HHS stated that it is committed to ensuring that grantees submit single audits in a timely and complete manner and that its subagencies utilize the findings to ensure proper management of its grantees. HHS stated that ASFR is taking over the single audit assignment and tracking function from the OIG and that this realignment will allow HHS to better meet the requirements of the Uniform Guidance. HHS also stated that it updated its Grants Policy Manual on December 31, 2015 With regard to the recommendations directed to ASFR, HHS stated that ASFR had issued several policies and procedures related to the grantees’ timely submission of single audits. HHS stated that it would continue to evaluate its policies and procedures to ensure compliance with its regulations, particularly as ASFR takes over the single audit findings assignment and tracking function from the OIG. In addition, HHS stated that ASFR will work to develop policies and procedures that utilize a risk- based approach for high-risk and recurring single audit findings.

With regard to the recommendations directed to CMS, HHS stated that it is working to incorporate the Grants Policy Manual into CMS’s policies and procedures for actions related to the timely submission of single audit reports and for reasonably assuring that management decisions contain the required elements and are issued timely in accordance with OMB guidance. CMS plans to update the 1982 Health Care Financing Administration Audit Resolution Manual and work collaboratively to develop policies and procedures that utilize a risk-based approach for high-risk and recurring single audit findings. If implemented as planned, these actions could address the intent of the recommendation.

Department of Housing and Urban Development

In an e-mail submitted on behalf of the Principal Deputy Assistant Secretary, CPD disagreed with our recommendation to revise policies and procedures to reasonably assure that management decisions contain the required elements and are issued timely in accordance with OMB guidance. CPD stated that it was not a prudent investment of resources to implement recommendations based upon a review of single audits under OMB Circular No. A-133, which was superseded by the Uniform Guidance. As stated in our report, the Uniform Guidance is effective for audits for fiscal years beginning on or after December 26, 2014. However, Uniform Guidance, Section 200.521, Management Decisions, carried forward the requirements in OMB Circular No. A-133 for management decisions relating to the content requirements and the time frames for issuing management decisions. Therefore, we continue to believe that actions to revise CPD’s policies and procedures related to management decisions are warranted and will help CPD comply with the Uniform Guidance.

In its e-mail, CPD also disagreed with our recommendation to design and implement policies and procedures for identifying and managing high-risk and recurring single audit findings using a risk-based approach. CPD stated that neither OMB Circular No. A-133 nor the Uniform Guidance makes reference to high-risk or recurring single audit findings. However, as stated in our report, leading risk management practices include that an organization develop, implement, and continuously improve a process for managing risk and integrate it into the organization’s overall governance, strategy, policies, planning, management, and reporting processes. Further, our report also notes that in July 2016, OMB released OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control, effective beginning fiscal year 2016, which requires federal agencies to consider risk management in their operations.

Also, in its e-mail, CPD stated that our definition of high-risk findings was too broad. Our definition states that high-risk single audit findings are findings that may be seriously detrimental to federal programs. Among other things, high-risk single audit findings could result in program failure; abuse; mismanagement; misuse of federal funds; improper payments; significantly impaired service; significantly reduced program efficiencies and effectiveness; unreliable data for decision making; and unauthorized disclosure, manipulation, or misuse of sensitive information. This definition provides agencies with the flexibility to analyze the types of risks pertinent to their operating environments and to develop definitions of high-risk single audit findings that they deem appropriate.

CPD also stated that our definition of high-risk findings does not lend itself to uniform and consistent interpretation across all CPD programs or within HUD and is unlikely to be consistently interpreted across all federal agencies, undermining the basis upon which the Uniform Guidance was developed. However, CPD and HUD can develop a definition of high-risk single audit findings that is pertinent to their operating environment and applied consistently within their organization. As stated in our report, an effective risk management strategy over high-risk and recurring single audit findings can be particularly useful to help management identify potential problems and reasonably allocate resources to address them, which can help improve program performance and outcomes. In addition, OMB Circular No. A-123 states that risks are analyzed in relation to achievement of the objectives established in an agency’s strategic plan and are to be reexamined regularly to identify new risks or changes to existing risks. Thus, risks can be agency specific. To that end, the definition for high-risk single audit findings need not be uniform across the federal government.

We continue to believe that CPD needs to take action to implement this recommendation to design and implement policies and procedures for identifying and managing high-risk and recurring single audit findings using a risk-based approach.

In an e-mail on behalf of the Principal Deputy Assistant Secretary, PIH stated that it has been in the process of revising its policies and procedures for reviewing and taking action on single audit report findings for public housing agencies. PIH stated that our recommendations were substantially addressed through new procedures. Where the report identified new areas that had not been addressed, PIH stated that it has incorporated those areas into its audit finding review process and risk assessment updates to address the recommendations in our report. If fully implemented, these actions should address the intent of the recommendations.

Department of Transportation

In its letter reprinted in appendix III, Transportation concurred with our recommendations. Transportation stated that it employs stringent monitoring and oversight to ensure that grantees meet the terms of award agreements and conduct activities in accordance with federal laws and regulations. It stated that Transportation is committed to using single audits as a valuable tool to help monitor performance, reduce improper payments, and strengthen accountability and oversight of these funds. In addition, Transportation indicated that it will revise, design, and implement policies and procedures to (1) reasonably assure that all required award recipients submit single audit reports and management decisions contain required elements and are issued timely, in accordance with OMB guidance, and (2) identify and manage recurring single audit findings using a risk-based approach. If fully implemented, these actions should address the intent of the recommendations.

We are sending copies of this report to the appropriate congressional committees; the Secretaries of Agriculture, Education, Health and Human Services, Housing and Urban Development, and Transportation; and other interested parties. This report is also available at no charge on the GAO website at http://www.gao.gov.

If you or your staff members have any questions about this report, please contact me at (202) 512-2623 or davisbh@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff members who made key contributions to this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine the extent to which selected federal agencies (1) effectively designed policies and procedures for reasonably assuring that award recipients submit single audit reports in a timely manner, (2) effectively designed policies and procedures for reviewing award recipients’ plans to correct single audit report findings and issuing written management decisions on those plans, and (3) had policies and procedures for managing high-risk and recurring single audit findings through a risk-based approach.

Because grant awards proportionally represent one of the largest amounts of federal awards, we used grant data from the Office of Management and Budget’s (OMB) Outlays for Grants to State and Local Governments in fiscal year 2013 to select the agencies and subagencies for our audit. We selected for our audit the five agencies that had the largest dollar amount of total reported outlays for grants to state and local governments in fiscal year 2013. These five agencies—the Departments of Agriculture (Agriculture), Education (Education), Housing and Urban Development (HUD), Transportation (Transportation), and Health and Human Services (HHS)—collectively accounted for 93 percent of total reported outlays for federal grants to state and local governments in fiscal year 2013. For Agriculture, Education, HUD, and Transportation, we selected subagencies that collectively outlaid over 90 percent of their respective agencies’ fiscal year 2013 total reported outlays for grants to state and local governments. For HHS, we selected the single largest subagency within HHS, which outlaid over 83 percent of HHS’s fiscal year 2013 total reported outlays for grants to state and local governments. We also reviewed HHS’s Audit Resolution Division, which has a key role in HHS’s single audit oversight process but does not provide federal awards. (See table 1.)

For our first objective, we reviewed the Single Audit Act of 1984, as amended (Single Audit Act); OMB Circular No. A-133; and Standards for Internal Control in the Federal Government to identify agency responsibilities. In addition, we reviewed the selected agencies’ and subagencies’ written policies and procedures for those areas and interviewed selected agency and subagency officials with responsibility for single audit oversight. We also identified four key steps relating to the design of single audit policies and procedures that would assist federal awarding agencies in fulfilling their responsibilities under OMB Circular No. A-133 for reasonably assuring that award recipients submit single audit reports timely. To that end, designing policies, procedures, and mechanisms to include the following steps would help provide reasonable assurance that agencies can fulfill these responsibilities: identify award recipients that should have submitted single audit reports, verify that the award recipients submitted single audit reports, determine whether the reports were submitted within the required time take action to obtain single audit reports when award recipients did not submit the reports within the required time frames.

For purposes of our audit, we reviewed the agencies’ and subagencies’ policies and procedures to assess whether they reasonably assure that award recipients completed and submitted their single audit reports within the required time frames, using 9 months after each award recipient’s fiscal year-end as the applicable time period. Nine months after the fiscal year-end is in most cases the later date compared to 30 days after receipt of the single audit report; we used this time period because it generally represents the maximum amount of time award recipients would have to submit single audit reports, and measuring the length of time after receipt as the applicable time period would have been unduly burdensome for our audit.

We requested from each subagency a list of award recipients that expended in excess of $500,000 in federal awards during fiscal year 2013 and were therefore required to submit single audit reports for fiscal year 2013. We then queried the Federal Audit Clearinghouse (FAC) to determine whether selected award recipients submitted their single audit reports timely. While we do not present data directly from the FAC in this report, because the FAC database is integral to the Single Audit Act reporting requirements, we undertook data reliability procedures to ascertain whether award recipients were submitting their single audit reports to the FAC. Specifically, we randomly selected 15 award recipients from each of the six subagencies that provided lists—Food and Nutrition Service, Office of Elementary and Secondary Education, Office of Special Education and Rehabilitative Services, Office of Public and Indian Housing, Federal Highway Administration, and Federal Transit Administration—for a total of 90 sampled cases. We received a listing of award recipients from the remaining three subagencies: Centers for Medicare and Medicaid Services, Rural Development, and Office of Community Planning and Development.

We were unable to use the lists for our testing because lists from the Centers for Medicare and Medicaid Services and Rural Development were not generated independently of the FAC. In addition, the Office of Community Planning and Development did not provide us with a list that facilitated searching in the FAC. Two of the six responding subagencies provided us with a list that included 8 award recipients that expended less than $500,000. For the remaining 82 cases, we undertook searches in the FAC to ascertain whether those award recipients had single audit reports in the FAC database. In 72 of the 82 cases, we were able to find the applicable fiscal year 2013 single audit report. In the remaining 10 cases, we could not readily locate an applicable 2013 single audit report using our multistep search procedures. Our random sample, which examined a limited number of single audit reports for the selected subagencies, was not designed to be generalizable. As a result, we do not make a generalizable statement about the completeness of the single audit reports in the FAC database.

For our second objective, we reviewed selected policies and procedures and interviewed agency and subagency officials to clarify our understanding of those policies and procedures. We also randomly selected nongeneralizable samples of single audit findings applicable to each subagency. For each sample item, we requested and reviewed documentation relating to written management decisions.

To address our third objective, we reviewed the selected agencies’ and subagencies’ written policies and procedures for those areas and interviewed selected agency and subagency officials to clarify our understanding of those policies and procedures.

We conducted this performance audit from May 2015 to February 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Department of Health and Human Services

Appendix III: Comments from the Department of Transportation

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Phyllis Anderson (Assistant Director), Sharon Byrd, Bruce David, Francine DelVecchio, Benjamin Durfee, Doreen Eng, Maxine Hattery, Bradley Johnson, Jason Kelly, Jennifer Leone, Kevin McAloon, Jared Minsk, Lisa Motley, Mai Nguyen, Anna Maria Ortiz, Amber Sinclair, and Walter Vance made key contributions to this report.