The Disaster Relief Act included approximately $50 billion in supplemental appropriations for fiscal year 2013 to 19 agencies for 61 specific programs for expenses related to the consequences of Hurricane Sandy. Under the authority granted by the Balanced Budget and Emergency Deficit Control Act of 1985, as amended, OMB determined that these supplemental appropriations were to be included in the fiscal year 2013 base subject to sequestration under section 251A of that act. The amounts included in this report are drawn from the Disaster Relief Act as originally enacted, and are not adjusted to account for sequestration. Figure 1 shows the distribution of Sandy disaster relief funding by agency. Appendix II presents more detailed information on the supplemental appropriations provided by the Disaster Relief Act. Most of the agencies’ supplemental appropriations provided by the Disaster Relief Act are related to grant programs. As shown in figure 2, grant programs received more than $41 billion of the approximately $50 billion provided by the Disaster Relief Act. The Disaster Relief Act also provides an oversight framework for these funds in regard to improper payments and the recapture of unexpended grant funds. Specifically, the Disaster Relief Act states that all programs and activities receiving these funds shall be deemed “susceptible to significant improper payments,” for purposes of the Improper Payments Information Act of 2002 (IPIA), and funds for grants shall be expended by the grantees within the 24- month period following the agency’s obligation of funds for the grant, unless OMB waives this requirement for a particular grant program and submits a written justification for such waiver to the Committees on Appropriations of the U.S. Senate and the House of Representatives. The act states that agencies shall include a term in the grant that requires the grantee to return any funds to the agency that are not expended within this 24-month period. In addition, the Disaster Relief Act states that through September 30, 2015, the Recovery Accountability and Transparency Board (Recovery Board) shall develop and use information technology resources and oversight mechanisms to detect and remediate waste, fraud, and abuse in the obligation and expenditure of funds to support oversight of Sandy disaster relief funding. The act also states that the Recovery Board will coordinate its activities with OMB, each federal agency receiving appropriations related to the impact of Hurricane Sandy, and the IG of each such agency. As noted above, the Disaster Relief Act required OMB to establish criteria for agencies to use in developing their Sandy disaster relief internal control plans. Internal controls serve as the first line of defense in safeguarding assets and in preventing and detecting fraud, abuse, and errors. Given the magnitude of funding provided by the Disaster Relief Act, it is important for federal agencies to ensure that the funds appropriated under the act are used for their intended purposes. OMB established the criteria in M-13-07, which provides an overview of the internal control planning and reporting requirements for all programs funded under the act with a focus on (1) developing additional internal controls warranted beyond previously existing controls, (2) managing all Sandy disaster-related funding with the same discipline and rigor as programs that are traditionally designated as high risk for improper payments, and (3) managing unexpended grant funds. M-13-07 notes that as required by OMB Circular No. A-123, Management’s Responsibility for Internal Control (OMB Circular A-123), agencies must have established internal control plans to prevent waste, fraud, and abuse of federal program funds.management is responsible for establishing and maintaining internal control to achieve the objectives of effective and efficient operations, reliable financial reporting, and compliance with applicable laws and regulations. Specifically, OMB Circular A-123 states that As illustrated in figure 3, OMB directed agencies to describe incremental risks identified for each program administering Sandy disaster relief funding as well as the internal control strategy for mitigating each of these risks (if applicable). M-13-07 also discusses the roles of other parties involved in supporting Sandy disaster relief efforts, including the Recovery Board, the Hurricane Sandy Rebuilding Task Force (Task Force), and agency IGs. The Task Force was established on December 7, 2012, under Executive Order 13632.opportunities for federal agencies to work together to support recovery from Hurricane Sandy and to promote strong accountability for the use of the disaster relief funds. M-13-07 also notes that the Task Force is supported by a program management office that is working with agencies to ensure stakeholder engagement, establish performance metrics to gauge recovery efforts, and monitor the execution of Sandy disaster relief funding. Further, M-13-07 emphasizes that agency internal control plans should reflect consideration of early and frequent engagement between agencies and IGs to discuss issues affecting the Disaster Relief Act’s disaster-related programs and activities in order to identify and mitigate potential risk. M-13-07 states that the Task Force is responsible for identifying In addition to issuing M-13-07, OMB took steps to help agencies develop internal control plans for managing the risks related to Sandy funds. These activities occurred prior to and following the release of the guidance. On February 19, 2013, OMB sent the Chief Financial Officer community advance notice of the forthcoming OMB guidance. This notice identified minimum requirements for agency internal control plans that would be included and further explained in the OMB guidance. Also, as reported by OMB staff and agency officials, OMB met with the agencies to discuss agency risk assessments and the development of internal control plans. In accordance with M-13-07, each of the 19 agencies that received funds under the act submitted a Sandy disaster relief internal control plan with specific program details using the template provided by OMB. OMB guidance directed agencies to develop internal control plans based on incremental risk. We found that agencies identified incremental risk related to Sandy activities for 38 of the 61 programs receiving funding under the Disaster Relief Act. Our review of the internal control plans disclosed that agencies did not consistently apply M-13-07 in preparing these plans. Specifically, agencies’ plans ranged from providing most of the required information to not providing any information on certain programs. M-13-07 provides an overview of the internal control planning and reporting requirements for all programs funded under the act with a focus on three major areas: (1) additional internal controls for Sandy- related activities, (2) improper payments protocol, and (3) management of unexpended grant funds. M-13-07 states that agency internal control plans for Sandy-related program funding shall reflect consideration of elements such as conducting additional levels of review, increasing monitoring and oversight of grant recipients, continuing collaboration with the IG community, and expediting review and resolution of audit findings. The first element of additional internal control listed in M-13-07 is additional levels of review of award decisions, payment transactions, and other critical process elements that impact the use of Disaster Relief Act funds. This requirement applied to the 38 programs that identified incremental risk related to Sandy disaster relief funding. However, M-13- 07 notes that agencies should adopt more expansive review procedures, as appropriate. This allowed agencies to determine whether additional levels of review were necessary for their award decisions, payment transactions, and other critical process elements. M-13-07 did not require agencies to document their rationales for determining whether additional levels of review were appropriate. Table 1 summarizes the requirement to conduct additional levels of review per M-13-07. As illustrated in table 2, our review found that agencies’ discussion in their internal control plans of conducting additional levels of review for 38 programs that identified incremental risk related to Sandy activities varied. Certain agencies did not discuss additional levels of review for programs for which they identified incremental risk. Of the 38 programs that identified incremental risk, 8 programs did not discuss award decisions, 11 programs did not discuss payment transactions, and 12 programs did not discuss critical process elements that impact the use of Disaster Relief Act funds. However, it is not clear from the Sandy disaster relief internal control plans whether these agencies determined that additional levels of review were not appropriate for these programs. While the requirement for additional levels of review did not apply to the 23 programs that did not identify incremental risk, some agencies also discussed conducting additional levels of review for certain programs for which they did not identify incremental risk in their Sandy disaster relief internal control plans. Of the 23 programs that did not identify incremental risk, 5 programs discussed additional levels of review for award decisions, payment transactions, and other critical process elements. For example, one agency planned to add an additional level of review by establishing an executive council to make final decisions on project selection for its Hurricane Sandy funding. The second element of additional internal control listed in M-13-07 is increasing monitoring and oversight of grant recipients through (1) increased frequency and specificity of grantee reports, (2) additional site visits, and (3) additional technical assistance and training for grant recipients. This requirement applies to all 17 grant programs that identified incremental risk related to Sandy disaster relief funding. However, M-13-07 notes that agencies should adopt increased monitoring and oversight of grant recipients to the extent appropriate and possible under budgetary constraints. This allowed agencies to justify not designing controls for increased monitoring and oversight of grant recipients because of low program risk or budgetary constraints. M-13-07 did not require agencies to document their rationales for determining whether increased monitoring and oversight of grant recipients were appropriate. Table 3 summarizes the requirement to increase monitoring and oversight of grant recipients per M-13-07. As illustrated in table 4, our review found that agencies’ discussion in their internal control plans of increasing monitoring and oversight of grant recipients varied. For most of the 17 grant programs, agencies planned to increase monitoring and oversight mechanisms for their grant recipients. For example, one agency planned to increase monitoring and oversight of grant recipients by requiring financial and milestone progress reports from its Hurricane Sandy grantees on a monthly basis, rather than quarterly, as required of its other grantees. Conversely, certain agencies did not discuss additional monitoring and oversight of grant recipients for some grant programs. Specifically, of the 17 grant programs, 5 did not discuss increasing the frequency and specificity of grantee reporting, 6 did not discuss conducting additional site visits, and 9 did not discuss providing additional technical assistance and training to recipients. However, it is not clear from the Sandy disaster relief internal control plans whether these agencies determined that increasing monitoring and oversight of grant recipients was not necessary for these programs or not possible under budgetary constraints. The third element of additional internal control listed in M-13-07 is that agencies should continue early and frequent engagement with their respective IG. This requirement applied to all programs that identified incremental risk related to Sandy disaster relief funding. Table 5 summarizes the requirement to collaborate with the IG community per M-13-07. As illustrated in table 6, our review found that agencies discussed collaboration with their IGs for most programs, regardless of whether they identified incremental risk. For example, one agency noted in its Sandy disaster relief internal control plan that it planned to hold monthly meetings with its IG to discuss ongoing audits and foster additional coordination through participation in program conferences and training. While the requirement for continued collaboration with the IG community applied to the 38 programs that identified incremental risk, 15 programs that did not identify incremental risk also discussed continuing collaboration with their respective IGs in their Sandy disaster relief internal control plans. Of the 38 programs that identified incremental risk, 3 did not discuss continuing collaboration with the agency’s IG to identify and mitigate potential risk. The fourth element of additional internal control listed in M-13-07 is that agencies should expedite the review and resolution of audit findings. M- 13-07 states that agencies shall resolve all audit findings, which include findings from GAO, IG, and single audit reports, within 6 months after completion of the audit to the extent practicable. This requirement applied to all programs that identified incremental risk. Additionally, for grant programs that identified incremental risk, M-13-07 states that agencies should avoid granting extension requests for audit report submission and should explore the feasibility of conducting additional audit activities to review internal control procedures prior to funding the activity. Table 7 summarizes the requirement to expedite review and resolution of audit findings per M-13-07. As illustrated in table 8, our review found that agencies’ discussion in their internal control plans of expediting review and resolution of audit findings varied. While the requirement applied to the 38 programs that identified incremental risk, not all agencies discussed resolving all audit findings within 6 months after completion of the audit. Specifically, of the 38 programs, there were 12 programs that identified incremental risk and did not discuss expediting review and resolution of audit findings in their internal control plans. However, while the requirement applied to the 38 programs that identified incremental risk, 5 programs that did not identify incremental risk also discussed expediting review and resolution of audit findings in their Sandy disaster relief internal control plans. For the 17 grant programs, agencies did not discuss avoidance of granting extension requests for audit report submission and exploring the feasibility of conducting additional audit activities prior to funding the activity. Specifically, for the 17 grant programs, 14 did not discuss avoiding granting extension requests for audit report submission and 11 did not discuss exploring the feasibility of conducting additional audit activities prior to funding the activity. It is not clear from the Sandy disaster relief internal control plans whether agencies determined that these additional audit activities prior to funding the activity would not be feasible. The Disaster Relief Act states that all programs and activities receiving funds under the act shall be deemed to be “susceptible to significant improper payments” for purposes of IPIA. M-13-07 adds that all federal programs or activities receiving funds under the act are required to calculate and report an improper payment estimate. Additionally, M-13-07 notes that agencies shall manage all Sandy-related funding with the same discipline and rigor as programs that are traditionally designated as high risk for improper payments. Table 9 summarizes the requirement related to improper payments protocol. As illustrated in table 10, our review of agencies’ disaster relief internal control plans for all 61 programs found that agencies discussed developing a sampling methodology to produce and report an estimate of improper payments in the fiscal year 2014 reporting period for 38 programs. Agencies discussed improper payments, but did not discuss producing and reporting an estimate of improper payments for 11 programs. Agencies did not discuss improper payments for 12 programs. The Disaster Relief Act states that funds for grants shall be expended by the grantees within the 24-month period following the agency’s obligation of funds for the grant, unless OMB waives this requirement for a particular grant program and submits a written justification for such waiver to the Committees on Appropriations of the U.S. Senate and the House of Representatives. The act also states that agencies shall include a term in the grant that requires the grantee to return any funds to the agency that are not expended within this 24-month period. M-13-07 expands on the act by stating that agencies shall ensure that each proposed grant activity has clear timelines for execution and completion within the statutory period available for grantee expenditure. Table 11 summarizes the requirements related to the management of unexpended grant funds. As illustrated in table 12, our review found that some agencies’ internal control plans did not address OMB’s four requirements related to the management of unexpended grant funds for all 17 grant programs. However, it is not clear whether all of these four requirements apply to each grant program because agencies may be planning to request waivers of the 24-month expenditure requirement for certain of their grant programs. OMB issued guidance to provide oversight over Sandy disaster funding, which represents an important step toward accountability over these funds. Several weaknesses limited the effectiveness of this guidance in providing a comprehensive oversight mechanism for these funds. Specifically, the guidance (1) focused on the identification of incremental risks without adequate linkages to demonstrate that known risks had been adequately addressed, (2) provided agencies with significant flexibility without requirements for documentation or criteria for claiming exceptions, and (3) resulted in certain agencies’ developing their internal control plans at the same time that funds needed to be quickly distributed. The demand for rapid response and recovery assistance suggests that a proactive approach is needed in providing guidance to agencies to ensure accountability over disaster relief funding, prior to a disaster occurring. The internal control plans prepared by the agencies under M-13-07 were intended to mitigate incremental risk, and therefore they did not provide comprehensive information on all known risks and internal controls that may affect the programs that received the Sandy disaster funding. For many years, we and the IG community have identified internal control weaknesses in the federal government related to agencies receiving funds for disaster assistance. For example, following Hurricane Katrina, we reported on a number of internal control weaknesses related to contracting issues, such as federal agencies involved in responding to the disaster that had inadequate acquisition plans for carrying out their assigned responsibilities, insufficient knowledge of the market or unsound ordering practices that led to excessive or wasteful expenditures, and insufficient staff available for monitoring and oversight. We also identified control weaknesses related to grants management following Hurricanes Katrina and Rita, such as determining the amount of damage that was actually disaster related; sharing project information among intergovernmental participants during project development, and limitations in how the status of projects is tracked; and inadequate human capital capacity, especially early on in the recovery. Similarly, IGs have reported on internal control weaknesses related to accountability over disaster assistance. For example, IGs have reported that grantees did not complete their disaster relief projects in a timely manner and did not ensure the use of funds for intended purposes, and that states did not provide timely reporting on activity progress related to grant funding as some activities were not reported on until the projects were complete. When we compared the incremental risks identified by the agencies receiving funds for Sandy disaster relief with risks identified in prior GAO, IG, and financial statement audit reports related to grants management, contract management, improper payments, and other internal control weaknesses for programs receiving Sandy funding, we determined that some of the risks in these reports were not included in the Sandy disaster relief internal control plans. For example, one agency that reported that it will expend its Sandy disaster relief funds through contracts did not identify any incremental risks. Our review of prior GAO, IG, and financial statement audit reports found significant risks related to the agency’s contract management. According to Standards for Internal Control in the Federal Government, internal control should provide for an assessment of the risks the agency faces from both external and internal sources. Management needs to comprehensively identify risks and should consider all significant interactions between the entity and other parties as well as internal factors at both the entity-wide and activity levels. Because the internal control plans prepared by the agencies are a subset of the complete set of risks related to programs receiving Sandy disaster relief funding, they are not effective for providing comprehensive oversight of Sandy disaster relief funds.assessment is necessary to help to ensure that agencies have considered all risks when designing internal controls. As described previously, OMB guidance listed various elements of additional internal control that at a minimum should have been reflected in the agencies’ internal control plans. However, the guidance included language that allowed agencies significant flexibility in deciding whether they needed to design additional internal controls. M-13-07 did not provide specific criteria for agencies to follow to claim exemptions from requirements, and the guidance did not require agencies to document their rationales for not including additional internal controls in their internal control plans. For example, M-13-07 states that agencies should conduct additional levels of review “as appropriate” and should increase monitoring and oversight of grant recipients “to the extent appropriate to mitigate risk and possible under budgetary constraints.” The guidance did not provide criteria for determining “appropriateness” or “budgetary constraints.” We found that some agencies did not discuss additional levels of review despite having identified incremental risk and did not discuss increased monitoring and oversight of grant recipients for some of their grant programs. Because M-13-07 did not require agencies to document their reasons for these omissions, the extent to which the agencies considered the need for these additional internal controls is not apparent from the Sandy disaster relief internal control plans. Additionally, M-13-07 required agencies to make an annual certification that the appropriate policies and controls were in place for activities and expenses related to Hurricane Sandy. M-13-07 provides agencies flexibility by stating that this annual certification for Hurricane Sandy funding “can be included” as part of the agencies’ annual assurance statements. According to OMB staff, OMB expected agencies to leverage their existing annual internal control review process performed in accordance with OMB Circular A-123 to include the internal controls related to activities and expenses funded by the Disaster Relief Act related to Hurricane Sandy. However, M-13-07 did not include specific requirements linking the annual review of controls to any additional control requirements for disaster-related funding. In light of the amount of funds involved and the risks associated with the funds provided by the Disaster Relief Act, on August 2, 2013, we sent a letter to the Director of OMB requesting consideration for sending written instructions to federal agencies to ensure that agency management includes the programs receiving funds for disaster assistance for Hurricane Sandy in their annual internal control reviews and assessments for fiscal year 2013. Such linkage between the incremental risks and mitigating controls related to disaster funding and efforts to address known internal control risks would be an important factor in providing comprehensive oversight of the internal control risks for the programs receiving disaster relief funds. In addition to the lack of comprehensive information on risks and internal controls, there is a risk that the incremental internal controls for Sandy disaster relief funding may not have been designed in time for its distribution. The Disaster Relief Act, which required OMB to issue guidance, was enacted on January 29, 2013. OMB had a short time frame to develop and issue the internal control guidance. As noted earlier, on February 19, 2013, OMB sent the Chief Financial Officer community advance notice of its impending guidance, and OMB finalized its guidance by issuing M-13-07 on March 12, 2013. In many cases, agencies developed and implemented the internal control plans at the same time that the funds needed to be quickly distributed. The Disaster Relief Act required agencies to submit their internal control plans by March 31, 2013, and agencies reported that they had already obligated approximately $4.6 billion as of that date. The limitations we identified in implementing M-13-07 illustrate that developing comprehensive internal control plans while a disaster unfolds is not feasible, and a proactive approach could help ensure that controls are designed timely. For example, OMB has provided standard procurement guidance, through its Emergency Acquisitions Guide, to assist the federal contracting community with carrying out procurement activities during disasters and other emergencies. As we have previously reported, following a disaster, decision makers face a tension between the demand for rapid response and recovery assistance— including assistance to victims—and implementing appropriate controls and accountability mechanisms. The risk for fraud and abuse grows when billions of dollars are being spent quickly. Weather-related events have cost the nation tens of billions of dollars in damages over the past decade. In our 2013 high-risk series, we reported that the United States Global Change Research Program has observed that the impacts and costliness of weather disasters will increase in significance, as what are considered “rare” events become more common and intense because of climate change. We previously reported that the growing number of disaster declarations—98 in fiscal year 2011 compared with 65 in 2004— has contributed to higher federal disaster costs. These impacts pose significant financial risks for the federal government, which owns extensive infrastructure, insures property through federal flood and crop insurance programs, provides technical assistance to state and local governments, and provides emergency aid in response to natural disasters. Without standard internal control guidance in place prior to future disasters, agencies may not be able to ensure that internal controls for disaster relief funding are effectively designed and timely implemented for all related funding. When disasters occur, the destruction caused by those disasters must be addressed immediately, and disaster relief funding must be delivered expeditiously. However, the risk for fraud and abuse increases when billions of dollars are being spent quickly. Our past work and that of the IG community has shown that effective controls and comprehensive accountability mechanisms for the use of resources related to a disaster are essential to ensure that resources are used appropriately. Relying on incremental disaster relief internal control plans cannot ensure that comprehensive information on risks and related internal controls will be adequate to ensure the safeguarding of disaster funds. Although M-13-07 represents an important step in the right direction, establishing more robust internal control guidance that can be applied to future disaster relief funding would allow agencies to proactively identify risks and develop internal controls prior to receiving such funding. Further, linking the additional risks identified in incremental plans to the complete set of known risks and related internal controls can help agency management and external entities, including Congress, to provide effective oversight of the funds. To proactively prepare for oversight of future disaster relief funding, we recommend that the Director of OMB develop standard guidance for federal agencies to use in designing internal control plans for disaster relief funding. Such guidance could leverage existing internal control review processes and should include, at a minimum, the following elements: robust criteria for identifying and documenting incremental risks and mitigating controls related to the funding and requirements for documenting the linkage between the incremental risks related to disaster funding and efforts to address known internal control risks. We requested comments on a draft of the report from the Director of the Office of Management and Budget or her designee. On November 14, 2013, staff from OMB’s Office of Federal Financial Management provided oral comments and stated that they generally agreed with our recommendation and requested additional information on the findings to inform future guidance. They also provided technical comments, which we incorporated as appropriate. We are sending copies of this report to interested congressional committees, the Director of the Office of Management and Budget, and the 19 agencies receiving funds under the Disaster Relief Act. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staffs have any questions about this report, please contact me at (202) 512-2623 or davisbh@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff members who made key contributions to this report are listed in appendix III. The Disaster Relief Appropriations Act, 2013 (Disaster Relief Act),mandated GAO to review the design of the internal control plans prepared by federal agencies receiving funds under the Disaster Relief Act. This report addresses the extent to which (1) the internal control plans prepared by federal agencies complied with Office of Management and Budget (OMB) guidance and (2) OMB’s guidance was effective for providing comprehensive oversight of the internal control risks for the programs receiving funds for Sandy disaster relief. To determine the extent to which the internal control plans prepared by federal agencies complied with OMB guidance, we obtained the Sandy disaster relief internal control plans for the 19 federal agencies administering the 61 programs receiving funds under the Disaster Relief Act and compared them to OMB Memorandum M-13-07 (M-13-07). To determine the extent to which OMB’s guidance was effective for providing comprehensive oversight of the internal control risks for the programs receiving funds for Sandy disaster relief, we reviewed the internal control plans and M-13-07 against Standards for Internal Control in the Federal Government. We interviewed OMB staff and agency officials regarding the development and implementation of M-13-07. In addition, we compared the agencies’ identified incremental risks to prior GAO and inspector general (IG) findings associated with internal control risks for agency programs receiving funds for Sandy disaster relief. Specifically, we reviewed the following: GAO, High-Risk Series: An Update, GAO reports and findings from 2010 to 2013 that focused on programs receiving funding under the Disaster Relief Act, and GAO work related to Hurricane Katrina or the American Recovery and Reinvestment Act of 2009; agencies’ IG reports from 2010 to 2013 that focus on programs receiving Disaster Relief Act funds; agencies’ fiscal year 2012 financial statement auditor’s reports, including reports on internal control over financial reporting and reported noncompliance with laws and regulations, fiscal year 2012 reported improper payments, and management’s statement of assurance related to 31 U.S.C. § 3512(c)-(d), commonly known as the Federal Managers’ Financial Integrity Act, and OMB Circular No. A- 123; agencies’ fiscal year 2012 annual reviews of programs and identification of those susceptible to significant improper payments. In addition, we obtained information from agencies regarding the status of obligations of Sandy disaster relief funding and the impact of sequestration on these funds. We also obtained information from agency IGs regarding their ongoing or planned audit work related to Sandy disaster relief funding. We conducted this performance audit from March 2013 to November 2013 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Table 13 presents the federal agencies and programs or appropriation accounts receiving funding under the Disaster Relief Act. Under the authority granted by the Balanced Budget and Emergency Deficit Control Act of 1985, as amended, OMB determined that these supplemental appropriations were to be included in the fiscal year 2013 base subject to sequestration under section 251A of that act. The amounts included in this report are drawn from the Disaster Relief Act as originally enacted and are not adjusted to account for sequestration. In addition to the contact named above, Michael Hansen (Assistant Director), Kim McGatlin (Assistant Director), Gloria Cano, Oliver Culley, Francine DelVecchio, Gabrielle Fagan, Patrick Frey, James Healy, Wilfred Holloway, Jason Kelly, Jason Kirwan, Felicia Lopez, Andrew Seehusen, Danietta Williams, and Matthew Zaun made key contributions to this report.

Summary: In late October 2012, Hurricane Sandy devastated portions of the Mid-Atlantic and northeastern United States, leaving victims of the storm and their communities in need of financial assistance for disaster relief aid. On January 29, 2013, the President signed the Disaster Relief Appropriations Act, 2013, which provided approximately $50 billion in supplemental appropriations, before sequestration, to 61 programs at 19 federal agencies for expenses related to the consequences of Hurricane Sandy. The act required agencies to submit internal control plans for the funds in accordance with OMB criteria by March 31, 2013. The act mandated GAO to review the design of agencies' internal control plans. This report addresses the extent to which (1) the internal control plans prepared by federal agencies complied with OMB guidance and (2) OMB's guidance was effective for providing comprehensive oversight of the internal control risks for the programs receiving funds for Sandy disaster relief. To address these objectives, GAO reviewed agencies' Sandy disaster relief internal control plans; M-13-07; and relevant GAO, inspector general, and financial statement audit reports. GAO also reviewed the internal control plans and M-13-07 against internal control standards. In response to the Disaster Relief Appropriations Act, 2013, agencies prepared Hurricane Sandy disaster relief internal control plans based on Office of Management and Budget (OMB) guidance but did not consistently apply the guidance in preparing these plans. OMB Memorandum M-13-07 (M-13-07), Accountability for Funds Provided by the Disaster Relief Appropriations Act, directed federal agencies to provide a description of incremental risks they identified for Sandy disaster relief funding as well as an internal control strategy for mitigating these risks. Each of the 19 agencies responsible for the 61 programs receiving funds under the act submitted an internal control plan with specific program details using a template provided by OMB. Agencies' plans ranged from providing most of the required information to not providing any information on certain programs. For example, each of the 61 programs was required to discuss its protocol for improper payments; however, GAO found that 38 programs included this information, 11 included partial information, and 12 included no information. OMB's guidance was an important step in the oversight of Sandy disaster funding, addressing internal controls, improper payments protocol, and unexpended grant funds. However, several weaknesses limited its effectiveness in providing a comprehensive oversight mechanism for these funds. Specifically, the guidance (1) focused on the identification of incremental risks without adequate linkages to demonstrate that known risks had been adequately addressed, (2) provided agencies with significant flexibility without requirements for documentation or criteria for claiming exceptions, and (3) resulted in certain agencies developing their internal control plans at the same time that funds needed to be quickly distributed. GAO found that OMB guidance: Asked agencies to focus on mitigating incremental risk, so the resulting plans did not provide comprehensive information on all known risks and internal controls that may affect the programs that received funding. Linking the additional risks identified in the plans to the complete set of known risks and related internal controls can help agency management and Congress to provide effective oversight of the funds. Allowed agencies significant flexibility in deciding whether they needed to design additional internal controls, and did not provide specific criteria for agencies to claim exemptions from requirements. GAO found that some agencies did not discuss certain additional internal controls in their plans, despite having identified incremental risks. Did not require agencies to document their rationales for not including additional internal controls in their plans. As a result, it was not apparent from the internal control plans the extent to which the agencies considered the need for these additional internal controls. Was developed and issued in a short time frame in response to the act. By the time that the agencies submitted their internal control plans on March 31, 2013, they reported that they had already obligated approximately $4.6 billion. Standard internal control guidance for disaster funding could help ensure that controls are designed timely. GAO recommends that OMB develop more robust guidance for agencies to design internal control plans for future disaster relief funding. OMB staff generally agreed with GAO's recommendation.