While LSC’s board and management have taken actions to improve its governance and accountability practices towards fully implementing the recommendations from our August 2007 report additional actions to fully implement the other key recommendations are needed. In August 2007 we reported, that since its inception over 30 years ago, LSC’s governance and accountability practices, including its financial reporting and internal control, had not kept pace with evolving governance and accountability practices and as a result, its practices had fallen behind those of federal agencies, U.S. government corporations, and other nonprofit corporations. LSC’s board and management agreed with all twelve of our recommendations in this area, the board has implemented corrective actions for three of the eight recommendations made to the board and management has implemented all four recommendations made to management. For instance, in response to one of our eight recommendations to the board, in March 2008 the board established an audit committee, which filled an oversight gap of LSC’s internal control, financial reporting and audit processes. However, another key recommendation directed at the board developing and implementing procedures to periodically evaluate key management processes, has yet to be developed and fully implemented. This recommendation is key in that it contributes to establishing an effective, supporting internal control environment at LSC as well as assists the board in fulfilling its oversight duties. As the board transitions to new board members, it will be important for the new board to provide priority focused attention on fully implementing the other five of our recommendations. In August 2007 we reported that the governance practices of LSC’s board fell short of the modern practices employed by boards of nonprofit corporations and public companies. Although the board members had demonstrated active involvement in LSC through their regular board meeting attendance and participation, we pointed out several areas where LSC’s governance practices could be strengthened. Those areas included a more comprehensive orientation program for new board members and an ongoing training program that enables board members to stay current on governance practices, the regulatory environment, and key management practices. Although the LSC board had four committees, including finance and operations and regulations, it did not have audit, ethics, or compensation committees’ functions, important governance mechanisms commonly used in corporate governance structures. The board had also not assessed the performance, collectively or individually, of its board members. Finally, the board had not implemented certain procedures that are key to helping it carry out its fiduciary duties for overseeing LSC, including evaluating key management processes, such as risk assessment, risk mitigation, internal controls and financial reporting. Our August 2007 report recommendations to improve and modernize the governance processes and structure of LSC along with our views on the status of LSC’s efforts to implement these recommendations (as of October 20, 2009) are summarized in table 1. LSC data we obtained and analyzed as part of our follow up work conducted between May 2009 and October 2009, showed that the board had fully implemented three of the eight recommendations, and had taken some action on the remaining five recommendations. But full implementation will be needed in order for the board’s actions to be fully effective. The following summary highlights LSC actions and work that remains to be done on the five recommendations that our analysis showed were partially implemented. In response to our recommendation that the board establish and implement a comprehensive orientation program, LSC created a “wiki,” which contains relevant information for LSC board members. However, LSC management informed us that they are waiting for the pending board member nominations to be confirmed by the U.S. Senate prior to holding a formal orientation program. In response to our recommendation that the board develop a plan for providing regular training. LSC’s management informed us there have been discussions about a training program and that the organizational updates for training the board occurs during the quarterly board meetings and that additional training needs of the board are determined by the self- assessments that the board members complete. LSC officials also stated that since this is an overall experienced board, the recent self-assessments did not indicate a need for training outside the organizational update. Officials told us that LSC management is currently documenting a training program, which we will evaluate when completed and implemented. We recommended that the board establish a compensation committee function to oversee compensation matters including LSC officers and LSC’s overall compensation structure. Currently, the board’s Governance and Performance Review Committee’s charter requires the committee to annually review and report on LSC’s president and inspector general performance and compensation. An LSC official told us that during the October board meeting the board will be discussing and voting on a new charter for the Governance and Performance Review Committee. In response to our recommendation that the board conduct a periodic self- assessment of the board’s, the committees’ and each member’s individual performance, the board has conducted and documented assessments for the board and individuals. According to an LSC official, the committee self-assessment process is still under discussion. We recommended that the board develop and implement procedures to periodically evaluate key management processes including at a minimum, processes for risk assessment and mitigation, internal control and financial reporting. The recently established audit committee’s charter provides the audit committee with responsibility over internal controls and therefore the evaluation of management’s processes. Although the audit committee was established in March 2008, it has not yet completed this key action. In August 2007, we reported that LSC’s management practices did not reflect current practices in the areas of risk assessment, internal control, and financial reporting. We pointed out areas where management’s practices could be strengthened. We found that management had not implemented a systematic or formal risk assessment that evaluated the risks the corporation faces from both external and internal sources. Such an assessment provides a structure for implementing internal control and other risk mitigation policies. In addition, senior management had not established comprehensive policies or procedures regarding conflicts of interest or other issues of ethical conduct. Without such policies and procedures, LSC was at risk of not identifying potential conflicts of interest and not taking appropriate actions to avoid potentially improper transactions or actions on the part of LSC personnel. Also, management had not conducted analysis of accounting standards to determine the most appropriate standards for LSC to follow. Our August 2007 report recommendations to improve and modernize key management processes at LSC, along with our views on the status of LSC’s efforts to implement those recommendations (as of October 20, 2009) are summarized in Table 2. While LSC has taken some actions with respect to our prior report’s grants management-related recommendations, LSC has only partially implemented some key recommendations in this area. LSC management fully implemented two of our December 2007 report recommendations, including following up on identified improper or potentially improper uses of grants funds. However, LSC has only partially implemented three key recommendations, including limited action on implementing an approach for selecting grantees for review using consistently applied, risk-based criteria. Full implementation of all of the remaining recommendations is needed in order to ensure that LSC management has effective control over its mission-critical grantees. Our December 2007 review of grants management and oversight at LSC identified weaknesses in LSC’s internal controls over grants management and oversight that negatively affected LSC’s ability to monitor and oversee grants and left grant funds vulnerable to misuse. At grantees we visited, we also found poor fiscal practices and improper or potentially improper expenditures that LSC could have identified with more effective oversight. Although LSC has taken action to address two of the four recommendations we made to management in our December 2007 report, it has not yet implemented the two recommendations focused on oversight of grantees use of funds. In order to strengthen the organizational structure and governance of grantee oversight and monitoring, we made a recommendation to the board to develop and implement policies that clearly delineate organizational roles and responsibilities. In December 2007 we reported on weakness in LSC’s control environment regarding the lack of a clear definition of the authority and responsibilities between two of the three organizational units that oversee the work of grantees. At the time of our review, LSC management shared fiscal oversight and monitoring of grantees with the OIG. Management’s oversight role was conducted through two offices—the Office of Program Performance (OPP) and the Office of Compliance and Enforcement (OCE). We found that the roles and the division of responsibilities were not clearly communicated between the OIG and OCE. The result was staff confusion about the types and scope of grantee fiscal reviews that LSC management could undertake on its initiative and strained relations between management and the OIG. In addition, communication and coordination between OCE and OPP was not sufficient to prevent gaps and unnecessary duplication between the offices’ respective oversight activities. Regarding its oversight of grantees, the scope of LSC’s control activities for monitoring grantee fiscal compliance was limited and feedback to grantees not timely. In determining the timing and scope of grantee oversight visits, LSC did not employ a structured or systematic approach for assessing the risk of noncompliance or financial control weaknesses across its 137 grantees. Without an analytically sound basis for assessing risk and distributing its oversight resources, LSC did not have a basis for knowing whether its oversight resources were being used effectively to mitigate and reduce risk among its grantees. LSC’s monitoring of grantee internal control systems needed to be strengthened, because the scope of work in OCE’s fiscal reviews was not sufficient in assessing grantee internal control and compliance for purposes of achieving effective oversight. In the OCE site visits we observed, staff did not follow up on questionable transactions and relied heavily on information obtained through interviews. LSC also was not timely in follow-up on an investigation into an alleged instance of noncompliance referred to it by the OIG. Feedback to grantees was often slow. As of September 2007, LSC had not yet issued reports to grantee management for almost 19 percent (10 out of 53) of the 2006 site visits. Without timely communications about the results of site visits, grantee management does not have information about deficiencies and the related corrective actions needed. In a grantee exit conference we observed, the LSC review team did not communicate a number of findings they had concluded were significant and in need of immediate attention. Effective grantee monitoring is especially important for LSC because LSC has limited options for sanctioning poorly performing grantees due to the recurring nature of many of its grants. In the limited reviews we performed at 14 grantees, we identified internal control weaknesses at 9 grantees that LSC could have identified with more effective oversight reviews. While control deficiencies at the grantees were the immediate cause of the improper expenditures we found, weaknesses in LSC’s controls over its oversight of grantees did not assure effective monitoring of grantee controls and compliance or prevent the improper expenditures. We also identified various weaknesses and improper expenditures at grantees we visited. These weaknesses and improper expenditures can result in a loss of credibility to the grantee and grantor and also allow instances of fraud to take place if not addressed. Our December 2007 report recommendations to improve its internal control and oversight of grantees, along with our views on the status of LSC’s efforts to implement those recommendations (as of October 20, 2009) are summarized in Table 3. As a result of our follow-up work conducted between May 2009 and October 2009, we determined that LSC management had fully implemented two of the four recommendations we made to management. The remaining two, as well as the recommendation to the board were partially implemented. Based on our evaluation, the following summary highlights LSC actions and work that remains to be done on the three recommendations that remain partially implemented. In response to our recommendation that LSC management use an approach for selecting grantees for internal control and compliance reviews that is founded on risk-based criteria and consistently applied, LSC revised its OPP and OCE manuals to include criteria for use in selecting grantees for reviews. Although LSC officials told us that the risk- based criteria was issued, they have not provided us with sufficient evidence to demonstrate that the criteria is consistently applied. We will evaluate LSC’s implementation as part of our current ongoing work. We recommended that LSC address three factors—revise current guidelines of fiscal compliance reviews to provide (1) a direct link of results of OPP reviews and other audit findings, (2) guidance for performing follow up responses during interviews, and (3) examples of fiscal and internal control review procedures relative to individual risk factors. LSC has updated its written guidelines for the fiscal component of OCE’s regulatory and compliance reviews; however, the updates do not include the three factors. LSC officials told us they will analyze their current manuals and incorporate interview guidelines and other information as needed. We will reevaluate this recommendation after LSC management completes its analysis. In response to our recommendation that the board develop and implement policies and procedures that clearly delineate organizational roles and responsibilities for grantee oversight and monitoring, the board-approved updated descriptions of organizational roles and responsibilities. However, internal controls discussed in the board approved descriptions are limited to fiscal internal controls and do not include operational or other internal controls that OPP and OCE are responsible for monitoring. According to LSC’s management, the board’s description combined with OPP and OCE manuals and documents address more than fiscal internal controls. We will reevaluate this recommendation after LSC management analyzes and gathers additional documentation to determine whether further actions are needed to ensure clear organizational roles and responsibilities. LSC’s Board of Directors and management have made progress on implementing our prior recommendations including fully implementing nine recommendations. The improvements that LSC has made in its governance and accountability provide a good foundation for completing implementation of the elements needed for a strong program of governance and internal controls. Although management has implemented the key recommendation of conducting and documenting a risk assessment, ongoing risk assessment and a robust risk management program is important to LSC’s overall internal control structure. Further, although the board has implemented the key recommendation of establishing an audit committee, the board must continue its efforts to implement another key recommendation of developing and implementing procedures to periodically evaluate management processes, including risk assessment, mitigation, internal control and financial reporting. It will also be important for the board to provide ongoing oversight of management’s risk assessment and risk management program. Periodically evaluating management will assist the board in fulfilling its oversight duty. Fully implementing the remaining recommendations, will enable the board and management to achieve the level of governance and internal control needed to provide adequate assurance that LSC’s governance and internal control structures are effective, and that grant funds are being used as intended and in accordance with laws and regulations. A strong governance structure and well established management practices and internal controls will be crucial for LSC to maintain stable operations during the upcoming board transition. Strong internal controls, with ongoing risk assessment, monitoring, and oversight will also be key to providing both the board and management with assurance that LSC funds are being used for their intended purposes, in accordance with laws and regulations and enable LSC to effectively adjust to evolving practices and risks. This concludes my prepared statement. For further information about this testimony, please contact Susan Ragland, Director, Financial Management and Assurance at (202) 512-8486, or raglands@gao.gov. Contact points for our offices of Congressional Relations and Public Affairs may be found on the last page of this testimony. Major contributors to this testimony included Kimberley McGatlin, Assistant Director; F. Abe Dymond, Assistant General Counsel; Lauren S. Fassler; Bernice M. Lemaire; Mitch Owings; and Carrie Wehrly. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: In August 2007, GAO reported (GAO-07-993) that Legal Services Corporation (LSC) had not kept up with evolving reforms aimed at strengthening governance, accountability and internal controls. In December 2007, GAO reported (GAO-08-37) weaknesses in LSC's internal controls over grants management and oversight of grantees. GAO was asked to testify on the status of accountability practices of the LSC. GAO's testimony is primarily a summary of our prior reporting, but includes follow up work conducted between May and October 2009 to obtain information on the status of our prior recommendations. In August 2007, GAO reported that the governance practices of LSC's board fell short of the modern practices employed by other nonprofit corporations and public companies. Although the board members had demonstrated active involvement in LSC through regular board meeting attendance and participation, we pointed out several areas where LSC's governance practices could be strengthened. LSC's management practices had also not kept up with the current practices for key processes in risk assessment, internal control, and financial reporting. We pointed out certain areas where management's practices could be strengthened. GAO concluded that a properly implemented governance and accountability structure might have prevented incidents, such as compensation rates in excess of statutory caps, questionable expenditures, and potential conflicts of interest. GAO made 12 recommendations - 8 to the board and 4 to management. LSC's management has implemented all 4 recommendations to improve its management practices. The board has fully implemented 3 recommendations, but it needs to take additional actions to fully implement the other 5 recommendations. For example, LSC's board has fully implemented the key recommendation to establish an audit committee. However, another key recommendation for the board to implement procedures to periodically evaluate key management processes has not yet been fully implemented. LSC told GAO that it plans to take additional actions to more fully address the five recommendations. In December 2007, GAO reported weaknesses in LSC's internal controls over grants management and oversight of grantees that negatively affected LSC's ability to provide assurance that grant funds were being used for their intended purposes in compliance with applicable laws and regulations. Effective internal controls over grants and grantee oversight are critical to accomplishing LSC's mission because it relies extensively on grantees to provide legal services to individuals who otherwise could not afford to pay for legal counsel. GAO made 5 recommendations to address these issues. LSC management fully implemented two of our report recommendations, including following up on identified improper or potentially improper uses of grants funds. However, LSC has only partially implemented three key recommendations, including only limited action to implement an approach for selecting grantees for review using consistently applied, risk-based criteria. In order to improve LSC's board and management's ability to maintain accountability over LSC's mission, it will be critical for LSC's board and management to maintain priority focus on fully implementing all remaining GAO recommendations.