In carrying out LSC’s mission, local legal-service providers (the grant recipients) employ staff attorneys to assist eligible clients in resolving their civil legal problems, often through advice and referral. According to LSC, in a typical year the largest portion of total cases (38 percent) concern family matters, followed by housing issues (24 percent), income maintenance (13 percent), and consumer finance (12 percent). LSC reported that most cases are resolved out of court. In 2007, LSC reported that three out of four clients were women, most of them mothers. To be eligible, clients must meet certain requirements. First, individual applicants for legal assistance supported by LSC funds must meet financial eligibility requirements. LSC has statutory authority to assist only “eligible clients,” which are defined as “any person financially unable to afford legal assistance.” LSC’s regulations include additional criteria to help determine whether a potential client is eligible for assistance from LSC. These regulations require that organizations receiving LSC grants adopt financial eligibility policies within the income limits set by LSC, which is at or below 125 percent of the current Federal Poverty Guidelines amounts— an income of approximately $25,000 for a family of four. Second, there are also legal restrictions on access to LSC-supported legal assistance by aliens. The LSC Act prohibits LSC personnel and grant recipients or their employees from engaging in certain prohibited activities, such as providing legal assistance with respect to any fee-generating case, providing legal assistance related to a criminal proceeding, supporting or conducting training programs for the purpose of advocating particular public policies or encouraging political activities, providing legal assistance in civil actions to persons who have been convicted of a criminal charge, or participating in litigation related to an abortion. In addition, LSC cannot provide funds for legal services for a proceeding related to a violation of the Military Selective Service Act. The LSC Board of Directors, which is charged with managing the affairs of the corporation, is responsible for ensuring compliance with these restrictions. The LSC Act established the LSC Board and specified that the board members shall annually select a Chairman and appoint an LSC President. The D.C. Nonprofit Corporation Act, which generally applies to LSC as a D.C. nonprofit corporation, provides that the affairs of the corporation shall be managed by the board of directors and permits the board of directors to delegate some of the authority to perform management duties to corporate officers. Our recently issued report, Legal Services Corporation: Governance and Accountability Practices Need to Be Modernized and Strengthened, discusses LSC, its unique status, and the rigorous controls necessary to protect the heavily federally funded entity. As an independent office within LSC, the LSC OIG is authorized to carry out audits and investigations of LSC programs and operations, recommend policies to improve program administration and operations, and keep the LSC board and Congress fully and currently informed about problems in program administration and operations and the need for and progress of corrective action. Also, LSC is subject to congressional oversight through the annual appropriations process as well as responding to congressional inquiries and participating in hearings. As shown in figure 1, since 1991 LSC’s annual federal funding has ranged from a high of $401.6 million in 1995 to a low of $279.1 million in 1996, with recent years’ appropriations (which makeup most of the federal funding) remaining fairly consistent at around $330 million. In the appropriation for LSC, Congress regularly designates a specific amount for the OIG. For example, the resulting allocations for the OIG were about $2.97 million in fiscal year 2007 and about $2.51 million in fiscal year 2006. LSC uses the majority of its funding to provide grants to local legal-service providers. Most of LSC’s approximately $330 million in annual federal funding of recent years has been designated for grants. Funds are distributed based on the number of low-income persons living within a service area, and some grantees maintain several offices within their service area. Beginning in 1996, the administrative provisions included each year in the acts making appropriations to LSC have required that grants be awarded through a system of competition and that LSC management issue regulations to implement this requirement. According to LSC management, one purpose of the competitive grants process is to encourage the economical and effective delivery of assistance to eligible clients. This represented a major change in the legal-services delivery system, eliminating the automatic renewal of funding as permitted by the LSC Act and practiced by LSC. After a final decision has been issued by LSC management terminating financial assistance to a recipient in whole for any service area, LSC management is required to implement a new competitive bidding process for the affected service area pursuant to implementing regulations. We found weaknesses in LSC’s internal controls that negatively affected LSC’s ability to monitor and oversee grants and left grant funds vulnerable to misuse. We also found poor fiscal practices and improper or potentially improper expenditures at grantees we visited. LSC’s control environment contains several weaknesses, including the lack of clearly defined roles and responsibility among the three different organizational units providing for oversight of grantees—OPP, OCE, and the OIG. In addition, OIG and OCE’s shared authority to oversee grantee financial internal controls and fiscal compliance has resulted in confusion about responsibility for grantee financial oversight. Poor communication and coordination between the oversight offices further impedes LSC’s ability to effectively oversee grantees. Furthermore, LSC’s control activities for monitoring grantee fiscal compliance are limited in scope and do not result in timely feedback to grantees. In addition, LSC does not utilize a structured or systematic approach for assessing risk across its 138 grantees when determining the timing and scope of its grantee oversight visits. LSC management monitors grantees through site visits and reviews conducted by two offices: the Office of Program Performance (OPP) and the Office of Compliance and Enforcement (OCE). OPP is responsible for designing and administering the competitive grant process and program evaluation. OCE is responsible for grantee compliance with the LSC Act and other laws, regulations, instructions, guidelines, and grant requirements. In addition, OCE and the OIG share responsibility for overseeing grantee financial controls and compliance. The current roles and division of responsibilities between the OIG and OCE for oversight of grantee financial controls and compliance are not clearly defined or communicated to the two offices. We also found that communication and coordination of grantee site visits between OCE and OPP need improvement in order to achieve effective oversight and avoid gaps and duplication in oversight. Management and employees should establish and maintain an environment throughout the organization that sets a positive and supportive attitude toward internal control and conscientious management. Another factor affecting an entity’s control environment is the entity’s organizational structure. It provides management’s framework for planning, directing, and controlling operations to achieve agency objectives. A good internal control environment requires that the agency’s organizational structure clearly define key areas of authority and responsibility and establish appropriate lines of reporting. In 1988 Congress subjected LSC to the Inspector General Act of 1978, as amended (IG Act).The IG Act provides that each designated federal entity, in this case LSC, shall transfer to the OIG “the offices, units, or other components, and the functions, powers, or duties thereof, that such head determines are properly related to the functions of the Office of Inspector General.” For example, the IG Act transferred to the Inspector General responsibility for providing policy direction for, and conducting, supervising, and coordinating audits of entity programs, such as LSC’s legal assistance grants program. Further, in April 1996, Congress enacted the appropriations act funding LSC for fiscal year 1996 (1996 Act) and included a number of administrative provisions supplementing the LSC Act requirements, including those related to grantee audits (§ 509). The 1996 Act clarified that the grantees are responsible for contracting for audits with independent public accountants (IPA), the OIG is responsible for overseeing the quality and integrity of the audit process, and LSC is responsible for resolving deficiencies and noncompliance identified in the audits and sanctioning grantees for unacceptable audits. Under the 1996 Act, IPAs follow OIG guidance and generally accepted government auditing standards in conducting their audits. These audits include an independent auditor’s opinion about whether the financial statements are fairly presented in accordance with generally accepted accounting principles, along with auditors’ reports on internal control and compliance. The 1996 Act also authorizes the OIG to conduct additional on-site monitoring, audits, and inspections. If the OIG reports to LSC management that a grantee IPA found significant reportable conditions, findings, or recommendations, then the 1996 Act provides that LSC is responsible for ensuring that these are timely resolved, including performing appropriate follow-up. In the event that the OIG were to determine that a grantee’s IPA audit were unacceptable, then the 1996 Act authorizes LSC, consistent with OIG recommendations, to sanction the grantee by withholding some or all its funding until the grantee completes an acceptable audit. Thus, the OIG plays an important role in LSC grantee oversight. OPP is specifically responsible for designing and administering the competitive grants process. In addition, OPP is responsible for (1) program evaluation and supportive follow-up; (2) developing strategies to improve program quality, including identifying areas of grantee weaknesses and following up with individual recipients; (3) promoting enhanced technology to improve client community access to services; and (4) encouraging “best practices” through the legal resource Web site, specialized help with intake and rural area delivery, and pilot projects such as loan repayment and mentoring. OPP also performs grantee program site visits. OPP’s staff totals 22 members, comprised of a Director, a Deputy Director, a senior program counsel, eight program counsels, seven program analysts, one grants coordinator, and three administrative assistants. OCE is responsible for overseeing grantee compliance with various federal laws and regulations that recipients of LSC funds must follow, including specific LSC regulations pertaining to LSC accountability. In particular, OCE reviews grantee compliance with various regulatory provisions, including the following related to fiscal accountability: fee generating cases; use of non-LSC funds and transfers of LSC funds; private attorney involvement; subgrants; membership fees; dues; timekeeping requirements; and attorney’s fees. A summary of these provisions in the fiscal component of OCE reviews is included in appendix III. In 2006, OCE conducted fiscal compliance site visits at 24 of these grantees, OPP conducted program review site visits at 32, and 3 were performed jointly. LSC presents the grantees with any findings arising from the site visits in its exit meetings and a later written report and subsequently monitors grantee actions to resolve them. OCE’s staff totals 15 members, comprised of a Director, 10 attorneys, two fiscal program analysts and two administrative assistants. According to OCE officials, prior to 1994, LSC staff in the OCE predecessor organization conducted internal control reviews and detailed financial statement-related audits. After the transfer of many oversight functions concerning grantees’ financial statement audit responsibilities to the IPAs and the OIG, OCE stopped its financial statement audits as well as its internal control reviews of grantees, even though oversight of grantee financial controls is a basic management responsibility. OCE instead implemented a limited fiscal review of grantee compliance with selected fiscal provisions of LSC regulations. The number of staff performing this function was reduced from 12 to 2. OCE management told us that the reason for this was that fiscal oversight of grantees had become the responsibility of the OIG, which oversees IPA audits that include testing of grantee internal controls. However, LSC management has the responsibility for overseeing grantee financial controls and compliance even if it relies on the IPA audits as the sole basis for its assurance about grantee controls. Further, even LSC management’s reduced oversight role has been further questioned by the OIG. Despite LSC’s shift to a limited compliance oversight role, the OIG recently reported that OCE’s reviews of grantee compliance were duplicative of IPA testing and concluded that most of the LSC regulations tested by OCE are already covered by the OIG’s own guidance and the reviews conducted by IPAs as part of the financial statement audits of grantees. With compliance oversight and monitoring responsibilities divided between OCE and the OIG and program oversight activities being performed by OPP, strong coordination and communication between the three offices and clarity in the roles and responsibilities is critical for achieving effective grantee and program oversight. Under GAO’s Standards for Internal Control in the Federal Government, “For an entity to run and control its operations, it must have relevant, reliable, and timely communications relating to internal as well as external events.” Our discussions with both OIG and LSC management indicated that working relationships and communications between them were strained. OCE staff have expressed confusion about their own roles and responsibility for the more limited fiscal compliance reviews they perform, and there is contention between OCE and OIG over unclear areas of responsibility that dates back to 1995. OCE and OIG officials indicated that to the best of their knowledge no memorandum of understanding or any other documentation implementing the board resolution to clarify the roles and responsibilities of each unit was ever drafted or implemented. We also found communication and coordination weaknesses between OPP and OCE based on interviews with LSC oversight staff, correspondence with the grantee and other documentation related to the joint OCE/OPP oversight visit that we observed, and our own observations of that joint oversight visit. As an example, during our visit to a Las Vegas grantee, we noted a lack of coordination and information sharing between OCE and OPP staff. Specifically, we found conflicting conclusions resulting from the OPP and OCE site visits to that grantee, and a lack of awareness between OPP and OCE about their respective site visits to that grantee. In reporting on an earlier April 2006 site visit in Las Vegas, OPP reported, “Overall, this program is in very good shape. Its delivery structure is sound, its management is excellent, and its case handling staff are performing at a high level.” During our February 2007 observation visit to the same grantee, OCE found it necessary to open an investigation after discovering several significant deficiencies with respect to the grantee’s compliance with LSC regulations. In addition, the OCE team leader on the visit stated that he was unaware of OPP’s programmatic visit. LSC’s Vice President of Program and Compliance stated that both OPP and OCE are required to share summary memorandums of their visits to grantees so that staff are aware of all visits made by both OPP and OCE and properly consider the results of the prior site visit in their own visits when conducting their own reviews. However, as discussed in a later section of this report, LSC’s grantee site visit reports were not being completed in a timely manner, and, therefore, were not available to the respective teams or to LSC management for use in communications and coordination of grantee oversight activities. In response to our finding, LSC officials acknowledged the need to further enhance internal communications and coordination between OPP and OCE to improve the overall efficiency and effectiveness of their oversight visits. LSC does not utilize a structured or systematic approach for assessing risk associated with its 138 grantees as a basis for determining the timing and scope of its grantee oversight visits. According to GAO’s Standards for Internal Control, risk assessment requires identifying and analyzing relevant risks associated with achieving the organization’s objectives and determining how risks should be managed. In determining which grantees to visit, both OPP and OCE use an approach based primarily on time between site visits and the respective office director’s judgments. The director of OCE stated that additional factors OCE considered include: complaints of noncompliance, referrals from the OIG, and discrepancies in reporting case closures. In response to a draft of this report, LSC’s President stated that other risk factors considered by OCE include the results of grantee self-inspections and potential compliance issues identified in OPP program visits and other discussions. The director of OCE also said OCE attempts to visit every grantee on a 5½-year cycle. However, this time-based cycle is not consistently followed. For example, the second largest grant recipient, receiving over $13 million in 2006, has not been visited by OCE since at least 1996. In addition, we noted there was a 7-year lapse between OCE visits to a grantee in Las Vegas, for which OCE, as previously discussed, recently opened an investigation after discovering several significant compliance-related findings. Management has indicated it believes additional grantee reviews are needed but stated that LSC does not have sufficient personnel to do this. OCE occasionally supplements its staff of two analysts that conduct fiscal reviews with an additional contract staff, and officials told us they plan to hire additional staff to conduct site visits on a 3- to 3½-year cycle by 2009. In 2006, LSC had 138 different grantees with more than 900 offices serving all 50 states, the District of Columbia, and current and former U.S. territories and had conducted fiscal compliance reviews at 24 of these grantees (17 percent). With this scope of grantee operations and a limited LSC oversight staff, an approach based on elapsed time and informal judgments is not adequate because it lacks analytical rigor and does not provide adequate assurance that risks are being properly addressed. Specifically, risk analysis should make a reasonable effort to identify risk, including inherent risk, based on all information sources available, assess the significance and likelihood of occurrence of the risk, and factor this in to the decision about scope and timing of oversight visits. However, LSC’s processes are not designed to identify risk in a comprehensive manner by not considering relevant risk factors including, for example, inherent risks due to program size or changes in grantee management or systems. Without a more structured process for selecting grantees to review, LSC does not have an analytical basis to know whether it is has the proper level of staff resources assigned to the grantee review function or whether it is gaining an adequate level of assurance for the number of staff assigned to grantee review activities. LSC’s control activities for monitoring grantee internal control systems do not reasonably assure that grant funds are being used properly and that grantees are in compliance with laws and regulations. OCE’s fiscal oversight was limited in scope, and feedback was not provided to the grantees. At both of our observation visits, we noted that staff did not follow-up on questionable transactions and relied too heavily on information obtained through interviews without corroborating the information. We also noted that LSC did not perform timely follow-up on an investigation into an alleged instance of noncompliance referred to it by the OIG. In addition, LSC has not consistently provided grantees the opportunity to take corrective actions based on findings arising out of the OCE/OPP site visits in a timely manner. As of September 17, 2007, LSC had not yet issued to grantee management almost 19 percent (10 out of 53) of the 2006 LSC reports for which grantee site visits had been completed. In one case we noted that, for unexplained reasons, the review team presented negative findings in a positive light to a grantee and omitted some negative findings from its feedback. Effective grantee monitoring is especially important for LSC because it has limited options for sanctioning poorly performing grantees. LSC’s fiscal reviews did not contain sufficient scope of work to adequately assess grantee internal control or fiscal compliance for purposes of achieving effective oversight. In addition to IPA audits, LSC management relies on its site visits and grantee reviews as a key control activity to monitor grantee fiscal compliance. The fiscal component of an OCE review is limited, and the reviews we observed left out important follow- up to issues that surfaced during interviews and did not address outstanding IPA findings. OCE staff use an OCE guide called Policies and Procedures for On-Site Fiscal Reviews for the fiscal component of OCE reviews. However, the guide is very limited in its scope. During our observation of an OCE site visit, we were told that no previsit preparation is needed and no formalized work program exists for the fiscal component of OCE reviews. The guide’s focus is assessing compliance with selected regulatory provisions and is not a review of grantee internal controls, so it would not, for example, require a review of whether expenditures were properly authorized. In addition, although the fiscal component of an OCE review involves a compliance review of seven LSC regulations, the guide provides a framework for conducting fiscal reviews related to only three of the seven required regulations. Furthermore, the guide does not provide an overall objective of the fiscal compliance review nor does it provide a clear scope or detailed steps for performing the oversight visitation. The approach to OCE site visits relies almost entirely on grantee oral responses to questions and did not include follow-up lines of questioning or requests for supporting evidence. For example, the OCE analyst did not question Greensburg, Pennsylvania, grantee officials about a $30,000 payment to a subgrantee that lacked supporting documentation. When GAO asked the grantee Executive Director about the payment, she stated that the previous Executive Director entered into the subgrant agreement and she did not know anything about the agreement other than the fact that she continued to pay the bill every year. The Executive Director was not able to support the payment, nor did she know the reasons for the payment. The OCE visit did not include review of important documents such as policy and procedure manuals, or verification of crucial financial information. In addition, OCE did not review invoices, perform internal control reviews, or scrutinize questionable items. Our review of information that OCE had also reviewed found that staff did not always follow up on questionable transactions. In reviewing documents already reviewed by the OCE fiscal program analyst during a site visit to Las Vegas, we discovered an improper transaction involving the sale of the grantee’s building that was partially purchased using LSC funds. The analyst did not question the sale or the reason the LSC share of the proceeds from the sale was not returned to the LSC restricted funds account. The grantee had entered into an agreement to sell the building to a developer for $3.6 million. The developer gave the grantee $310,000 as earnest money, and the grantee withdrew $30,000 to use as earnest money towards the expected purchase of a new property. The remaining $280,000 was deposited in an escrow account. However, when the sale of the building fell through, the grantee transferred the funds from the escrow account into its unrestricted general funds account. According to an official at the grantee, this transfer was made to avoid the funds being subjected to LSC regulations. Furthermore, the grantee official stated that he considered it an “enhancement of money.” However, the OCE site visit did not question this unusual transaction, nor was it disclosed in the independent public accountant’s (IPA) annual financial audit. As a result of our bringing this transaction to the attention of OCE, LSC has concluded that the funds should have been designated and spent as LSC restricted income. LSC’s reports of site visits are crucial to communicating and resolving instances of noncompliance in grantee internal controls. LSC, though, has not provided grantees the opportunity to address findings arising out of the OCE/OPP site visits in a timely manner because LSC has been slow to communicate its findings to them. As of September 2007, LSC had not yet issued to grantee management almost 19 percent (10 out of 53) of the 2006 LSC reports for which site visits had been completed. One such visit dates back to January 2006. LSC management stated that this occurs because there is not enough staff to conduct oversight visits and complete reports in a timely manner. Absent timely communications about findings from its site visits, grantee management does not have information about deficiencies and corrective actions needed to address identified deficiencies in their use of funds and improve controls. Furthermore, LSC cannot monitor the status of grantee corrective actions. During OCE compliance visits and in follow-up reviews, OCE attorneys and fiscal program analysts gather and analyze data on grantee compliance with both nonfinancial and financial LSC regulations and conduct an exit meeting with grantee management to present the findings. LSC then develops a report with recommendations that is to be provided to the grantee. OCE officials stated that although LSC policy requires reports to be issued within 90 days of site visits, they generally take much longer. One official also told us that OCE staff do not have the opportunity to complete one report before having to go on another site visit. The official told us that staff do summarize their findings in a memorandum, which is used internally at LSC. One fiscal program analyst told us that not only was he still working on a report which was due last year, but that he also had three other visits he was still working on, and he was planning on visiting three additional sites as well. It will be important to clear up the backlog of unissued reports, especially since LSC’s Vice President for Programs and Compliance stated that LSC plans to increase OCE and OPP staff levels to increase the number of site visits per year. We also found an instance where timely follow-up action was not taken when alleged instances of noncompliance and misuse of funds existed. On November 30, 2004, OCE received a referral from a state comptroller’s office, which reported that an LSC grantee’s Executive Director had misused LSC grant funds. OCE referred the case to the OIG. The OIG found that the Executive Director used LSC grant funds for time and travel unrelated to grantee operations and contributions of LSC funds to other charitable organizations. On November 3, 2005, the OIG referred the results of its investigation back to OCE for follow-up action. LSC management told us that this case has yet to be resolved and attributes the delay to other priorities, including staff shortages. In one case, we noted that, for unexplained reasons, the LSC review team presented mostly positive findings to a grantee during the exit conference when in fact other significant findings were negative. Without a complete report of the instance of noncompliance and potential weaknesses found by the reviewers, grantee management was not afforded the opportunity to respond to those findings, nor did they have the information needed to correct the deficiencies in a timely manner. An exit conference is the standard forum for presenting site visit results prior to issuing the final report. It gives LSC the opportunity to inform grantee management, once the team has finished its planned interviews, tests, and other data- collection activities, about the findings and observations discovered during the visit. It also gives grantee management an opportunity to timely begin addressing problems. However, in an exit conference held to close out a joint OCE-OPP oversight visit in Greensburg, Pennsylvania, we found that the attorneys and fiscal program analyst that performed the review focused on the few positive points that had been observed during the week-long visit. A number of findings that the review team had characterized as significant and in need of immediate attention during the previous day’s meeting to prepare for the exit conference were not communicated as such at the exit conference. In contrast to the discussion regarding the need for improvements at the exit conference, the memorandum prepared for the LSC files to summarize the visit characterizes the grantee as a weak program that faces many challenges. In effect, the exit conference focused on a few positive points rather than the substantial number of significant findings. LSC oversight staff cited staff shortages as the cause for some of the weaknesses in the quality of site visits. Currently, there are only two fiscal program analysts in OCE, and in order to ensure that there is a program analyst available to participate in every OCE grantee visit, it is sometimes necessary to contract with an outside analyst for coverage. Effective grantee monitoring is especially important for LSC because it has limited options for sanctioning or replacing poor-performing grantees. Although LSC has the authority to temporarily suspend funding or terminate all or part of a recipient’s grant, LSC rarely uses this authority. According to LSC, termination is seldom used because it is difficult to find a replacement organization to provide the service. Although the LSC Act provides general enforcement authority to the corporation, LSC must take all practical steps to ensure the continued provision of legal assistance. After a final decision has been issued by LSC terminating financial assistance to a grantee, LSC must implement a new competitive bidding process for the affected service area. In fiscal year 2006, only 5 out of 71 potential grants received multiple bids during the grant renewal process. Because there are few competitors for LSC grants in a given service area, LSC’s competition process does not provide a practical solution for competitive selection when quality issues arise in some cases. Therefore, it is particularly important that LSC effectively and efficiently oversee its grantees to ensure that grant funds are used for intended purposes in accordance with laws and regulations so that grantee weaknesses do not develop into serious weaknesses that would normally call for termination of funding for the grantee. Based on our limited reviews, we identified internal control weaknesses at 9 of the 14 grantees we visited that LSC could have identified with a more effective oversight review regimen. While control deficiencies at the grantees were the immediate cause of improper and potentially improper expenditures, weaknesses in LSC’s oversight controls discussed above negatively affected the effectiveness of its monitoring of grantees’ controls and compliance. Among the control weaknesses we found were grantee use of LSC grant funds for expenditures with insufficient supporting documentation, and for unusual contractor arrangements, alcohol purchases, employee interest-free loans, lobbying fees, late fees, and earnest money. The following two examples show the types of weaknesses we found at the grantees we visited. At 7 out of the 14 grantees we visited, we identified systemic issues involving payments that lacked sufficient supporting documentation. At one grantee, many payments were processed for travel despite the lack of supporting documentation. The lack of documentation made it impossible to determine whether the expenditures were accurate, allowable, and appropriate. At another grantee, certain travel expenses appeared to be improper. At a third grantee, the grantee underwent a change in management in August 2006, and the current Executive Director was unable to locate many of the records and invoices related to payments made under the previous Executive Director. At a fourth grantee, we reviewed six monthly credit card payments and determined that less than 50 percent of the charges had any supporting documentation. At this same grantee, many of the credit card charges that had support lacked sufficient information to determine whether they were a valid use of grant funds. At a fifth grantee, we identified a $30,000 payment to a subgrantee that lacked any supporting documentation. When questioned about the payment, the grantee’s Executive Director stated that the previous Executive Director entered into the agreement and that she did not know anything about the agreement other than the fact that she continued to pay the bill every year. At one grantee, we identified an individual who provided services to the grantee as an information technology (IT) contractor who was paid approximately $750,000 between 2004 and 2006. The individual was engaged to operate the organization’s IT servers and maintain the network. The individual told us that he had worked at the grantee since 2001. When we inquired as to why he did not work at the grantee as an employee, he stated that there were benefits to being an independent contractor. We noted the following facts that cause us to question the contractor arrangement: The contractor’s office and mailing address was located in the same office space as the grantee. The grantee could not locate its contract with the individual for 2005 and 2006. The contractor’s business card was identical to other employees working at the grantee. Two grantee employees worked for and were supervised by the contractor. The contractor indicated that the organization occasionally reimburses him for work-related training costs. See appendix II for additional detailed information related to our findings at the grantees we visited. We presented LSC management with the results of our analysis supporting each of our findings related to our grantee visits. LSC management expressed commitment to take action to resolve these matters in coordination with the grantees. Effective internal controls over grants and grantee oversight are critical to LSC as its very mission and operations rely extensively on grantees to provide legal services to people who otherwise could not afford to pay for adequate legal counsel. Effective grants-oversight procedures and monitoring, including a structured, systematic approach based on risk, are necessary given LSC’s limited resources and the scope of its responsibilities for many widely dispersed entities. In addition, the shared responsibilities for grantee oversight between LSC management and OIG presents risks that can be mitigated with clear lines of authority and responsibility and effective communications and coordination across oversight offices to avoid unnecessary duplication where possible. Finally, given the number of grantees, a sound risk-based approach for determining timing and scope of site visits is key to prioritizing resource allocations to reflect the varying risks presented by grantees. To maximize the effectiveness of each site visit, LSC needs to conduct its oversight visits with sufficient scope to target areas of greatest risk, follow up on information and results of prior reviews and audits, and employ a review scope and approach that is tailored to specific risks. With high- quality targeted reviews and management that promptly informs grantees about findings and provides them an opportunity to correct them, risk can be mitigated. To help LSC improve its internal control and oversight of grantees, we recommend that the LSC Board of Directors develop and implement policies that clearly delineate organizational roles and responsibilities for grantee oversight and monitoring, including grantee internal controls and compliance. To help LSC improve its internal control and oversight of grantees, we recommend that LSC management develop and implement the following: Policies and procedures for information sharing among the OIG, OCE, and OPP and coordination of OCE and OPP site visits. An approach for selecting grantees for internal control and compliance reviews that is founded on risk-based criteria, uses information and results from oversight and audit activities, and is consistently applied. Procedures to improve the effectiveness of the current LSC fiscal compliance reviews by revising LSC’s current guidelines to provide a direct link to the results of OPP reviews and OIG and IPA audit guidance for performing follow-up on responses from grantee examples of fiscal and internal control review procedures that may be appropriate based on individual risk factors and circumstances at grantees. In addition to the above improvements to LSC’s oversight of grantees, we also recommend that LSC management perform follow-up on each of the improper or potentially improper uses of grant funds that we identified in this report. We received written comments on a draft of this report from the Chairman on behalf of LSC’s Board of Directors and LSC’s President on behalf of LSC’s management (which are reprinted in apps. IV and V). Both the Chairman and the President expressed their full commitment to making the improvements noted in the report, concurred with all of our recommendations, and outlined the actions that LSC’s board and management plan to take in response to our recommendations. LSC management also separately provided technical comments that we incorporated into the report as appropriate. LSC’s President also suggested three clarifications to our report. First, LSC management stated that “the draft report does not sufficiently address the fact that in 1996 Congress mandated that the LSC OIG have oversight responsibility for all audit work performed by independent public accountants (IPA) and the report should include a fuller discussion of the role of the IPAs in the financial oversight of grantees.” We added language to our report to augment our discussion of how the 1996 Act clarified that grantee financial statement and compliance audits are performed by IPAs and overseen by OIG. While these audits serve as an accountability mechanism, they are performed after the fact, and do not include all the grantee oversight objectives and procedures that would be expected of LSC management as part of its responsibilities to manage the affairs of the corporation, such as its grants program and to monitor its grantees to ensure compliance with all applicable laws, regulations, and grant terms. Second, LSC’s President states that “the draft report supports its conclusion about limited coordination of the work of OCE and OPP with an isolated example from one grantee visit and fails to note the range of communication and coordination that actually exists between these offices.” We provide the example in the report to illustrate the effect on grantee oversight. Our conclusion about the need for improved communication and coordination were also based on interviews with LSC staff and our assessment of LSC’s control environment during the course of our work. Third, the LSC President stated that while LSC can and will expand its criteria and use of a risk-based approach for assessing risk of weaknesses at its grantees, the draft report did not include all of the risk- based criteria that LSC currently uses in selecting grantees for on-site reviews. We modified our report to add language recognizing that LSC considers the results of grantee self-inspections and potential compliance issues identified in OPP program visits and other discussions in selecting grantees for on-site reviews. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. We will then send copies to other appropriate congressional committees, the President of LSC, and the LSC Board of Directors. We will also make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact me at (202) 512-9471 or franzelj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. This report contains the results of our review of internal controls over the Legal Services Corporation’s (LSC) grantee monitoring and oversight function and our limited visits to grantees. In performing our work, we (1) evaluated LSC’s control environment, information and communications, and risk assessment procedures related to its grants management and oversight organizations; (2) reviewed LSC’s control activities for monitoring grantee management and compliance, and (3) performed limited reviews at 14 grantees. To evaluate LSC’s control environment, information and communications, and risk assessment procedures related to its grants management and oversight, we interviewed LSC and Office of Inspector General (OIG) management officials and reviewed board meeting minutes and LSC policy documents. To obtain an understanding of LSC’s internal control framework, including the oversight of grantees, we reviewed LSC policies and procedure manuals and reviewed LSC OIG, Office of Program Performance (OPP), and Office of Compliance and Enforcement (OCE) reports. In addition, we accompanied LSC staff on oversight visits to Las Vegas, Nevada, and Greensburg, Pennsylvania. During these visits, we reviewed grant agreements, observed LSC interviews with entity officials and external parties, evaluated grantee policies and procedure manuals, discussed the objectives of each visit with the LSC team leader, attended the grantee entrance and exit conferences, and observed testing performed by OCE. We also conducted fieldwork at LSC, observed LSC staff on 2 of their grantee oversight visits, and conducted 12 of our own grantee site visits. Specifically, we systematically selected 8 of our grantee site visits using a dollar unit sample of LSC’s calendar year 2006 grants. The grantees selected were located in Oakland, California; Tampa, Florida; Chicago, Illinois; Detroit, Michigan; Camden, New Jersey; New York, New York; Cleveland, Ohio; and Seattle, Washington. In addition, in order to include additional small grantees in our site visits, we randomly selected 2 additional grantees with 2006 grant amounts below the median grant amounts for 2006. The grantees selected were Window Rock, Arizona, and Philadelphia, Pennsylvania. Finally, we selected Washington, D.C., as a pilot program for our visits due to its proximity to GAO, and we selected Casper, Wyoming, because it had received month-to-month funding as a disciplinary sanction in 2006. At all of these locations, we analyzed key records and interviewed entity officials to obtain an understanding of LSC’s internal control framework, including the oversight of grantees, and assessed compliance of expenditures. Our grantee site reviews were limited in scope and were not sufficient for expressing an opinion on the effectiveness of grantee internal controls or compliance. To assess the appropriateness of grantee expenditures, we performed expenditure testing during our grantee site visits. The testing included reviewing invoices, vendor lists, and general ledger details. The appropriateness of grantee expenditures was based on the grant agreements and applicable laws. We classified expenditures as improper or potentially improper if they were not supported by sufficient documentation to enable an objective third party to determine if the expenditure was a valid use of grant funds or if the expenditure was specifically prohibited by applicable laws and regulations. For the findings we classified as improper or potentially improper, we found as applicable one or more of the following: (1) systemic issues with insufficient supporting documentation for the goods or services LSC money was paying for, (2) unusual contractor arrangements without sufficient support or justification, and (3) improper use of grant funds. We conducted our work from September 2006 through September 2007 in accordance with generally accepted government auditing standards. Examples of our findings from our limited visits to 14 grantees are presented in this appendix. These examples are not all-inclusive of the findings we identified and are not necessarily representative of the population of expenditures from which they were selected. We identified three grantees that used Legal Services Corporation (LSC) funds to purchase alcoholic beverages. LSC grantees are required by law to use LSC funds only for allowable purposes, and LSC management has issued implementing regulations on cost standards and procedures. LSC regulations do not directly address alcoholic beverages, but they permit LSC management to resolve issues arising from questioned costs by looking to Office of Management and Budget (OMB) circulars, such as OMB Circular No. A-122, Cost Principles for Non-Profit Corporations, when such circulars contain relevant policies or criteria that are not inconsistent with LSC statutes, regulations, and guidance. Appendix B of OMB Circular No. A-122, Selected Items of Cost, provides guidance on the allowability of the direct or indirect cost of the selected items. Appendix B’s item no. 3, Alcoholic Beverages, states that the costs of alcoholic beverages are unallowable and provides for no exceptions. Because this guidance is not mandatory for LSC, LSC management must make the final decision on whether alcohol purchases are allowable. The Executive Director at one grantee stated that the program would never use LSC funds to purchase alcohol during trips or other organizational functions. When we provided her copies of invoices showing alcohol purchases, she indicated that she was not aware of the expenditures and would have to investigate. She later explained that one of the invoices totaling $2,800 was a payment to another organization for the cost of beer and wine for an annual spring reception held for college student interns. In addition, she explained that the $128 in alcohol on a second invoice was part of a $725 staff dinner party in Washington D.C., and that, to the best of her knowledge, those funds were reimbursed to the grantee. At another grantee, we identified invoices containing wine purchases for company events. The Executive Director immediately recognized that this was an issue and stated that he would ensure that LSC funds are no longer used to purchase alcohol. We identified a grantee that was using LSC funds to provide interest-free loans to employees upon request as an employee benefit. The use of the loans included, but was not limited to, paying college tuition, making down payments on personal residences, and purchasing personal computers. According to the grantee’s Controller, employees are not required to sign a contract, but the grantee does try to have the employees pay off the loans through payroll deductions to ensure collection. Furthermore, she stated that the total amount of loans outstanding at any one time typically does not exceed $10,000. When asked to provide support for the loans, the Controller stated that she did not believe any specific supporting documentation existed. During our site visit, the Controller prepared a list of employee loans outstanding as of December 31, 2006. Since controls over the loans are nonexistent, we were unable to determine the completeness of this list. LSC grant funds are required by law to be used to support the provision of legal assistance in civil matters to low-income people for everyday legal problems. We identified no authority to use LSC grant funds for interest- free or other loans to grantee employees. We identified two instances in which one grantee was using LSC funds to pay for lobbyist registration fees. The Legal Services Corporation Act imposes a broad limitation on LSC grantees using LSC funds in a manner that would directly or indirectly influence legislation or other official action at the local, state, or federal government levels and requires LSC management to ensure that these limitations are not violated. With only limited exceptions, LSC grantees cannot use LSC funds to pay for any costs related to lobbying, including lobbying registration fees. The registration fee in each instance we identified was $50. The Executive Director of the program agreed that in this instance using LSC funds for lobbyist registration fees was a violation of the grant agreement. In addition, he stated that he would take additional steps to ensure that LSC funds are no longer used for expenses related to lobbying. Three of the grantees that we visited used LSC funds to pay late fees on overdue accounts for goods and services purchased. LSC regulations on cost standards and procedures provide that expenditures by a grantee are only allowable if the grantee can demonstrate that the expenditures were reasonable and necessary for performance of the grant, meaning that they were the type that would have been performed by a prudent person in similar circumstances at the time the decision to incur the cost was made. One grantee routinely failed to make payments on time, creating tension with several of its vendors. We found numerous communications from vendors regarding late payments. In one instance, the vendor sent a third notice of action to this grantee stating that the rent for the grantee’s unit or office space remained unpaid. The vendor threatened to place a lien against the goods in the unit and sell them at a public auction to satisfy the overdue balance if the overdue balance was not paid within 15 days. Systemic failure to pay bills on time is an indication of weak internal controls. All three Executive Directors agreed that there was no excuse for the inability to make payments on time. We view payments made under these circumstances as imprudent and unreasonable and, therefore, unallowable. We discovered an improper transaction at one grantee involving the sale of a grantee building that was purchased using both LSC and non-LSC funds. The grantee had entered into an agreement to sell the building to a developer for $3.6 million. The developer gave the grantee $310,000 as earnest money, and the grantee withdrew $30,000 to use as earnest money towards the expected purchase of a new building. The remaining $280,000 was deposited in an escrow account. However, when the sale of the building fell through, the grantee transferred the funds from the escrow account into its unrestricted general funds account. According to an official at the grantee, this transfer was made to avoid the funds being subjected to LSC regulations. Furthermore, the grantee official stated that he considered it an “enhancement of money.” As a result of our bringing this transaction to the attention of the Office of Compliance and Enforcement, LSC has concluded that the funds should have been designated and spent as LSC restricted income. In addition to the contact named above, Paul Caban, Blake M. Carpenter, Bonnie L. Derby, Lisa M. Galvan-Trevino, Maxine Hattery, Erik S. Huff, Keith H. Kronin, and Margaret Mills made key contributions to this report. F. Abe Dymond and Lauren S. Fassler provided technical assistance.

Summary: The Legal Services Corporation (LSC) was created as a private nonprofit to support legal assistance for low-income people to resolve their civil legal matters and relies heavily on federal appropriations. In 2006, LSC distributed most of its $327 million in grants to support such assistance. Effective internal controls over grants and oversight of grantees are critical to LSC's mission. GAO was asked to determine whether LSC's internal controls over grants management and oversight processes provide reasonable assurance that grant funds are used for their intended purposes. GAO analyzed key records and interviewed agency officials to obtain an understanding of LSC's internal control framework, including the monitoring and oversight of grantees, and performed limited reviews of internal controls and compliance at 14 grantees. GAO found weaknesses in LSC's internal controls over grants management and oversight of grantees that negatively affect LSC's ability to provide assurance that grant funds are being used for their intended purposes in compliance with applicable laws and regulations. Effective internal controls over grants and grantee oversight are critical to LSC as its very mission and operations rely extensively on grantees to provide legal services to people who otherwise could not afford to pay for adequate legal counsel. GAO also found poor fiscal practices and improper and potentially improper expenditures at grantees it visited. Weaknesses in LSC's control environment include the lack of clear definition in the responsibilities of two of the three organizational units that oversee the work of grantees. GAO also found that communication between oversight units and coordination of grantee site visits is not sufficient to prevent gaps or duplication of effort, or both. The timing and scope of site visits is not based on a systematic analysis of the risk of noncompliance or financial control weakness across LSC's 138 grantees, so LSC cannot determine whether its resources are being used effectively and efficiently to mitigate risk among its grantees. LSC control activities performed in the monitoring of grantee internal control were not sufficient in scope to achieve effective oversight, and GAO noted implementation weaknesses. For example, in the site visits GAO observed, staff did not follow up on questionable transactions and relied heavily on information obtained through interviews. Feedback to grantees was often delayed, preventing grantees from correcting deficiencies in a timely manner. As of September 2007, LSC had not yet issued reports to grantee management for about 19 percent (10 out of 53) of the 2006 site visits. LSC grantee reviews missed potential control deficiencies at grantees that could have been detected with more effective oversight as evidenced by weaknesses GAO found at 9 of the 14 grantee sites it visited. While control deficiencies at the grantees were the immediate cause of the problems GAO found, weaknesses in LSC's controls over its oversight of grantees did not assure effective monitoring of grantee controls and compliance. Among the questionable expenditures GAO found were grantee use of funds for expenditures with insufficient supporting documentation, unusual contractor arrangements, alcohol purchases, employee interest-free loans, lobbying fees, late fees, and earnest money.