The Disaster Relief Act included approximately $50 billion in supplemental appropriations for fiscal year 2013 to 19 agencies for 61 specific programs for expenses related to the consequences of Hurricane Sandy. Under the authority granted by the Balanced Budget and Emergency Deficit Control Act of 1985, as amended, OMB determined that these supplemental appropriations were to be included in the fiscal year 2013 base subject to sequestration under section 251A of that act. The amounts included in this report are drawn from the Disaster Relief Act as originally enacted, and are not adjusted to account for sequestration. Figure 1 shows the distribution of Sandy disaster relief funding by agency. Appendix II presents more detailed information on the supplemental appropriations provided by the Disaster Relief Act. Most of the agencies’ supplemental appropriations provided by the Disaster Relief Act are related to grant programs. As shown in figure 2, grant programs received more than $41 billion of the approximately $50 billion provided by the Disaster Relief Act. The Disaster Relief Act also provides an oversight framework for these funds in regard to improper payments and the recapture of unexpended grant funds. Specifically, the Disaster Relief Act states that all programs and activities receiving these funds shall be deemed “susceptible to significant improper payments,” for purposes of the Improper Payments Information Act of 2002 (IPIA), and funds for grants shall be expended by the grantees within the 24- month period following the agency’s obligation of funds for the grant, unless OMB waives this requirement for a particular grant program and submits a written justification for such waiver to the Committees on Appropriations of the U.S. Senate and the House of Representatives. The act states that agencies shall include a term in the grant that requires the grantee to return any funds to the agency that are not expended within this 24-month period. In addition, the Disaster Relief Act states that through September 30, 2015, the Recovery Accountability and Transparency Board (Recovery Board) shall develop and use information technology resources and oversight mechanisms to detect and remediate waste, fraud, and abuse in the obligation and expenditure of funds to support oversight of Sandy disaster relief funding. The act also states that the Recovery Board will coordinate its activities with OMB, each federal agency receiving appropriations related to the impact of Hurricane Sandy, and the IG of each such agency. As noted above, the Disaster Relief Act required OMB to establish criteria for agencies to use in developing their Sandy disaster relief internal control plans. Internal controls serve as the first line of defense in safeguarding assets and in preventing and detecting fraud, abuse, and errors. Given the magnitude of funding provided by the Disaster Relief Act, it is important for federal agencies to ensure that the funds appropriated under the act are used for their intended purposes. OMB established the criteria in M-13-07, which provides an overview of the internal control planning and reporting requirements for all programs funded under the act with a focus on (1) developing additional internal controls warranted beyond previously existing controls, (2) managing all Sandy disaster-related funding with the same discipline and rigor as programs that are traditionally designated as high risk for improper payments, and (3) managing unexpended grant funds. M-13-07 notes that as required by OMB Circular No. A-123, Management’s Responsibility for Internal Control (OMB Circular A-123), agencies must have established internal control plans to prevent waste, fraud, and abuse of federal program funds.management is responsible for establishing and maintaining internal control to achieve the objectives of effective and efficient operations, reliable financial reporting, and compliance with applicable laws and regulations. Specifically, OMB Circular A-123 states that As illustrated in figure 3, OMB directed agencies to describe incremental risks identified for each program administering Sandy disaster relief funding as well as the internal control strategy for mitigating each of these risks (if applicable). M-13-07 also discusses the roles of other parties involved in supporting Sandy disaster relief efforts, including the Recovery Board, the Hurricane Sandy Rebuilding Task Force (Task Force), and agency IGs. The Task Force was established on December 7, 2012, under Executive Order 13632.opportunities for federal agencies to work together to support recovery from Hurricane Sandy and to promote strong accountability for the use of the disaster relief funds. M-13-07 also notes that the Task Force is supported by a program management office that is working with agencies to ensure stakeholder engagement, establish performance metrics to gauge recovery efforts, and monitor the execution of Sandy disaster relief funding. Further, M-13-07 emphasizes that agency internal control plans should reflect consideration of early and frequent engagement between agencies and IGs to discuss issues affecting the Disaster Relief Act’s disaster-related programs and activities in order to identify and mitigate potential risk. M-13-07 states that the Task Force is responsible for identifying In addition to issuing M-13-07, OMB took steps to help agencies develop internal control plans for managing the risks related to Sandy funds. These activities occurred prior to and following the release of the guidance. On February 19, 2013, OMB sent the Chief Financial Officer community advance notice of the forthcoming OMB guidance. This notice identified minimum requirements for agency internal control plans that would be included and further explained in the OMB guidance. Also, as reported by OMB staff and agency officials, OMB met with the agencies to discuss agency risk assessments and the development of internal control plans. In accordance with M-13-07, each of the 19 agencies that received funds under the act submitted a Sandy disaster relief internal control plan with specific program details using the template provided by OMB. OMB guidance directed agencies to develop internal control plans based on incremental risk. We found that agencies identified incremental risk related to Sandy activities for 38 of the 61 programs receiving funding under the Disaster Relief Act. Our review of the internal control plans disclosed that agencies did not consistently apply M-13-07 in preparing these plans. Specifically, agencies’ plans ranged from providing most of the required information to not providing any information on certain programs. M-13-07 provides an overview of the internal control planning and reporting requirements for all programs funded under the act with a focus on three major areas: (1) additional internal controls for Sandy- related activities, (2) improper payments protocol, and (3) management of unexpended grant funds. M-13-07 states that agency internal control plans for Sandy-related program funding shall reflect consideration of elements such as conducting additional levels of review, increasing monitoring and oversight of grant recipients, continuing collaboration with the IG community, and expediting review and resolution of audit findings. The first element of additional internal control listed in M-13-07 is additional levels of review of award decisions, payment transactions, and other critical process elements that impact the use of Disaster Relief Act funds. This requirement applied to the 38 programs that identified incremental risk related to Sandy disaster relief funding. However, M-13- 07 notes that agencies should adopt more expansive review procedures, as appropriate. This allowed agencies to determine whether additional levels of review were necessary for their award decisions, payment transactions, and other critical process elements. M-13-07 did not require agencies to document their rationales for determining whether additional levels of review were appropriate. Table 1 summarizes the requirement to conduct additional levels of review per M-13-07. As illustrated in table 2, our review found that agencies’ discussion in their internal control plans of conducting additional levels of review for 38 programs that identified incremental risk related to Sandy activities varied. Certain agencies did not discuss additional levels of review for programs for which they identified incremental risk. Of the 38 programs that identified incremental risk, 8 programs did not discuss award decisions, 11 programs did not discuss payment transactions, and 12 programs did not discuss critical process elements that impact the use of Disaster Relief Act funds. However, it is not clear from the Sandy disaster relief internal control plans whether these agencies determined that additional levels of review were not appropriate for these programs. While the requirement for additional levels of review did not apply to the 23 programs that did not identify incremental risk, some agencies also discussed conducting additional levels of review for certain programs for which they did not identify incremental risk in their Sandy disaster relief internal control plans. Of the 23 programs that did not identify incremental risk, 5 programs discussed additional levels of review for award decisions, payment transactions, and other critical process elements. For example, one agency planned to add an additional level of review by establishing an executive council to make final decisions on project selection for its Hurricane Sandy funding. The second element of additional internal control listed in M-13-07 is increasing monitoring and oversight of grant recipients through (1) increased frequency and specificity of grantee reports, (2) additional site visits, and (3) additional technical assistance and training for grant recipients. This requirement applies to all 17 grant programs that identified incremental risk related to Sandy disaster relief funding. However, M-13-07 notes that agencies should adopt increased monitoring and oversight of grant recipients to the extent appropriate and possible under budgetary constraints. This allowed agencies to justify not designing controls for increased monitoring and oversight of grant recipients because of low program risk or budgetary constraints. M-13-07 did not require agencies to document their rationales for determining whether increased monitoring and oversight of grant recipients were appropriate. Table 3 summarizes the requirement to increase monitoring and oversight of grant recipients per M-13-07. As illustrated in table 4, our review found that agencies’ discussion in their internal control plans of increasing monitoring and oversight of grant recipients varied. For most of the 17 grant programs, agencies planned to increase monitoring and oversight mechanisms for their grant recipients. For example, one agency planned to increase monitoring and oversight of grant recipients by requiring financial and milestone progress reports from its Hurricane Sandy grantees on a monthly basis, rather than quarterly, as required of its other grantees.