While LSC’s board and management have taken actions to improve its governance and accountability practices towards fully implementing the recommendations from our August 2007 report additional actions to fully implement the other key recommendations are needed. In August 2007 we reported, that since its inception over 30 years ago, LSC’s governance and accountability practices, including its financial reporting and internal control, had not kept pace with evolving governance and accountability practices and as a result, its practices had fallen behind those of federal agencies, U.S. government corporations, and other nonprofit corporations. LSC’s board and management agreed with all twelve of our recommendations in this area, the board has implemented corrective actions for three of the eight recommendations made to the board and management has implemented all four recommendations made to management. For instance, in response to one of our eight recommendations to the board, in March 2008 the board established an audit committee, which filled an oversight gap of LSC’s internal control, financial reporting and audit processes. However, another key recommendation directed at the board developing and implementing procedures to periodically evaluate key management processes, has yet to be developed and fully implemented. This recommendation is key in that it contributes to establishing an effective, supporting internal control environment at LSC as well as assists the board in fulfilling its oversight duties. As the board transitions to new board members, it will be important for the new board to provide priority focused attention on fully implementing the other five of our recommendations. In August 2007 we reported that the governance practices of LSC’s board fell short of the modern practices employed by boards of nonprofit corporations and public companies. Although the board members had demonstrated active involvement in LSC through their regular board meeting attendance and participation, we pointed out several areas where LSC’s governance practices could be strengthened. Those areas included a more comprehensive orientation program for new board members and an ongoing training program that enables board members to stay current on governance practices, the regulatory environment, and key management practices. Although the LSC board had four committees, including finance and operations and regulations, it did not have audit, ethics, or compensation committees’ functions, important governance mechanisms commonly used in corporate governance structures. The board had also not assessed the performance, collectively or individually, of its board members. Finally, the board had not implemented certain procedures that are key to helping it carry out its fiduciary duties for overseeing LSC, including evaluating key management processes, such as risk assessment, risk mitigation, internal controls and financial reporting. Our August 2007 report recommendations to improve and modernize the governance processes and structure of LSC along with our views on the status of LSC’s efforts to implement these recommendations (as of October 20, 2009) are summarized in table 1. LSC data we obtained and analyzed as part of our follow up work conducted between May 2009 and October 2009, showed that the board had fully implemented three of the eight recommendations, and had taken some action on the remaining five recommendations. But full implementation will be needed in order for the board’s actions to be fully effective. The following summary highlights LSC actions and work that remains to be done on the five recommendations that our analysis showed were partially implemented. In response to our recommendation that the board establish and implement a comprehensive orientation program, LSC created a “wiki,” which contains relevant information for LSC board members. However, LSC management informed us that they are waiting for the pending board member nominations to be confirmed by the U.S. Senate prior to holding a formal orientation program. In response to our recommendation that the board develop a plan for providing regular training. LSC’s management informed us there have been discussions about a training program and that the organizational updates for training the board occurs during the quarterly board meetings and that additional training needs of the board are determined by the self- assessments that the board members complete. LSC officials also stated that since this is an overall experienced board, the recent self-assessments did not indicate a need for training outside the organizational update. Officials told us that LSC management is currently documenting a training program, which we will evaluate when completed and implemented. We recommended that the board establish a compensation committee function to oversee compensation matters including LSC officers and LSC’s overall compensation structure. Currently, the board’s Governance and Performance Review Committee’s charter requires the committee to annually review and report on LSC’s president and inspector general performance and compensation. An LSC official told us that during the October board meeting the board will be discussing and voting on a new charter for the Governance and Performance Review Committee. In response to our recommendation that the board conduct a periodic self- assessment of the board’s, the committees’ and each member’s individual performance, the board has conducted and documented assessments for the board and individuals. According to an LSC official, the committee self-assessment process is still under discussion. We recommended that the board develop and implement procedures to periodically evaluate key management processes including at a minimum, processes for risk assessment and mitigation, internal control and financial reporting. The recently established audit committee’s charter provides the audit committee with responsibility over internal controls and therefore the evaluation of management’s processes. Although the audit committee was established in March 2008, it has not yet completed this key action. In August 2007, we reported that LSC’s management practices did not reflect current practices in the areas of risk assessment, internal control, and financial reporting. We pointed out areas where management’s practices could be strengthened. We found that management had not implemented a systematic or formal risk assessment that evaluated the risks the corporation faces from both external and internal sources. Such an assessment provides a structure for implementing internal control and other risk mitigation policies. In addition, senior management had not established comprehensive policies or procedures regarding conflicts of interest or other issues of ethical conduct. Without such policies and procedures, LSC was at risk of not identifying potential conflicts of interest and not taking appropriate actions to avoid potentially improper transactions or actions on the part of LSC personnel. Also, management had not conducted analysis of accounting standards to determine the most appropriate standards for LSC to follow. Our August 2007 report recommendations to improve and modernize key management processes at LSC, along with our views on the status of LSC’s efforts to implement those recommendations (as of October 20, 2009) are summarized in Table 2. While LSC has taken some actions with respect to our prior report’s grants management-related recommendations, LSC has only partially implemented some key recommendations in this area. LSC management fully implemented two of our December 2007 report recommendations, including following up on identified improper or potentially improper uses of grants funds. However, LSC has only partially implemented three key recommendations, including limited action on implementing an approach for selecting grantees for review using consistently applied, risk-based criteria. Full implementation of all of the remaining recommendations is needed in order to ensure that LSC management has effective control over its mission-critical grantees. Our December 2007 review of grants management and oversight at LSC identified weaknesses in LSC’s internal controls over grants management and oversight that negatively affected LSC’s ability to monitor and oversee grants and left grant funds vulnerable to misuse. At grantees we visited, we also found poor fiscal practices and improper or potentially improper expenditures that LSC could have identified with more effective oversight. Although LSC has taken action to address two of the four recommendations we made to management in our December 2007 report, it has not yet implemented the two recommendations focused on oversight of grantees use of funds. In order to strengthen the organizational structure and governance of grantee oversight and monitoring, we made a recommendation to the board to develop and implement policies that clearly delineate organizational roles and responsibilities. In December 2007 we reported on weakness in LSC’s control environment regarding the lack of a clear definition of the authority and responsibilities between two of the three organizational units that oversee the work of grantees. At the time of our review, LSC management shared fiscal oversight and monitoring of grantees with the OIG. Management’s oversight role was conducted through two offices—the Office of Program Performance (OPP) and the Office of Compliance and Enforcement (OCE). We found that the roles and the division of responsibilities were not clearly communicated between the OIG and OCE. The result was staff confusion about the types and scope of grantee fiscal reviews that LSC management could undertake on its initiative and strained relations between management and the OIG. In addition, communication and coordination between OCE and OPP was not sufficient to prevent gaps and unnecessary duplication between the offices’ respective oversight activities. Regarding its oversight of grantees, the scope of LSC’s control activities for monitoring grantee fiscal compliance was limited and feedback to grantees not timely. In determining the timing and scope of grantee oversight visits, LSC did not employ a structured or systematic approach for assessing the risk of noncompliance or financial control weaknesses across its 137 grantees. Without an analytically sound basis for assessing risk and distributing its oversight resources, LSC did not have a basis for knowing whether its oversight resources were being used effectively to mitigate and reduce risk among its grantees. LSC’s monitoring of grantee internal control systems needed to be strengthened, because the scope of work in OCE’s fiscal reviews was not sufficient in assessing grantee internal control and compliance for purposes of achieving effective oversight. In the OCE site visits we observed, staff did not follow up on questionable transactions and relied heavily on information obtained through interviews. LSC also was not timely in follow-up on an investigation into an alleged instance of noncompliance referred to it by the OIG. Feedback to grantees was often slow. As of September 2007, LSC had not yet issued reports to grantee management for almost 19 percent (10 out of 53) of the 2006 site visits. Without timely communications about the results of site visits, grantee management does not have information about deficiencies and the related corrective actions needed.