NIH funds extramural research primarily through grants. In 2015, NIH funded approximately 50,000 research projects, totaling over $22 billion to research organizations, through grants and cooperative agreements for extramural research. Of the six types of organizations conducting extramural research, NIH provided approximately $17 billion of funding to universities in fiscal year 2015. See figure 1 for a breakout of direct and indirect cost reimbursements received by these research organizations that were funded through grants and cooperative agreements. NIH generally reimburses for both direct and indirect costs incurred by the research organizations conducting extramural grant research. Direct costs are specifically attributed to research projects and include, for example, a researcher’s salary, equipment cost, and travel. Indirect costs represent an organization’s general support expenses that cannot be specifically attributed to a specific research project or function. They include, for example, administrative staff salaries, building utilities, and library operations. Because indirect costs cannot be specifically attributed to a particular research project, they are allocated via an indirect cost rate that is applied to certain direct costs for each awarded grant. NIH then uses the negotiated indirect cost rate to reimburse indirect cost expenses to the organization. In fiscal year 2015, indirect costs represented approximately $6.3 billion (28 percent) of NIH’s grants and cooperative agreement award totals. Each research organization that applies for NIH funding develops a proposed indirect cost rate and subsequently negotiates with its designated cognizant agency to set an indirect cost rate used for reimbursement. Because many research organizations perform research for multiple federal agencies, OMB guidance specifies that the designated cognizant agency for a particular research organization is responsible for negotiating and approving indirect cost rate proposals on behalf of all other federal agencies. As noted above, OMB and HHS have designated three primary cognizant agencies to negotiate indirect cost rates for research organizations that receive NIH-funded grants: (1) CAS, (2) NIH- DFAS, and (3) ONR. For fiscal year 2014 NIH-funded grants, CAS negotiated rates for approximately 460 universities, 150 research institutes, and 90 hospitals; NIH-DFAS negotiated rates for approximately 190 for-profit organizations; and ONR negotiated rates for 25 universities and 5 nonprofit organizations. The cognizant agencies are responsible for ensuring that the negotiated indirect cost rates comply with OMB guidance and the FAR, as applicable. A research organization’s proposed indirect cost rate is essentially the ratio of its total indirect costs (after adjustments) to its total direct costs related to all of the research organization’s grants for a particular time period. To calculate its indirect cost rate, a research organization divides its total claimed indirect costs (e.g., equipment and maintenance) across the organization by its total direct costs (e.g., researcher’s salary and travel), referred to as the distribution base, across all of the research organization’s grants. The resulting percentage is the proposed indirect cost rate. This proposed rate is then negotiated with the cognizant agency until they agree upon a negotiated indirect cost rate. To determine how much of the research organization’s indirect costs should be allocated to each research grant, each grant’s direct cost amount is multiplied by the negotiated indirect cost rate. In this way, if a particular research grant contributes a higher percentage of the organization’s direct costs, it will share in a proportionally higher percentage of the indirect costs as well. See figure 2 for an example calculation of an indirect cost rate and allocation at a hypothetical research organization. This example presumes that the cognizant agency approves the proposed rate as the negotiated rate without further adjustment. The indirect cost rate-setting process begins when a research organization submits an indirect cost rate proposal with supporting documentation to its cognizant agency based on a combination of historical and estimated costs. Examples of supporting documentation include proposals, audited financial statements, Single Audit reports, and certification of indirect cost rates for universities and for-profit organizations. CAS and NIH-DFAS review proposals whereas ONR generally sends proposals to the Defense Contract Audit Agency (DCAA) to be audited. When reviewing a proposal, the cognizant agency is to verify the mathematical accuracy of the rates proposed, confirm unallowable costs have been excluded, reconcile the cost proposal to the audited financial statements, and determine the reasonableness of the proposed costs. After the proposal has been reviewed or audited, the cognizant agency and the research organization negotiate and come to an agreement on the rate. The negotiated rate is then documented in a formal indirect cost rate agreement to be applied to all grants going forward. Generally, the negotiated rate is set for a 1-to-4-year time frame. This process is illustrated in figure 3. The cognizant agencies are required to negotiate the indirect cost rates in accordance with applicable federal guidance and regulations. OMB Circular No. A-21 (Cost Principles for Educational Institutions); OMB Circular No. A-122 (Cost Principles for Non-Profit Organizations); OMB’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance); and FAR Part 31 (Contract Cost Principles and Procedures, applicable to for-profit organizations) establish the principles for defining, calculating, and negotiating indirect cost rates for applicable grants. Specifically, the guidance and regulations describe classification and types of allowable indirect costs; methods of allocating such costs; reasonableness of claimed costs; exclusions and descriptions of unallowable cost elements, such as alcohol and bad debts; and guidelines for establishing indirect cost rates. GAO’s A Framework for Managing Fraud Risks in Federal Programs identifies leading practices to aid program managers in managing fraud risks. For example, A Framework for Managing Fraud Risks in Federal Programs states that management should design and implement data analytics as a control activity to prevent and detect fraud. Further, Standards for Internal Control in the Federal Government provides the overall framework for establishing and maintaining internal control across the federal government and for identifying and addressing major performance and management challenges and areas at greatest risk of fraud, waste, abuse, and mismanagement. Standards for Internal Control in the Federal Government states that internal controls comprise the plans, methods, and procedures used to meet missions, goals, and objectives. Management is responsible for developing detailed internal guidance and practices to fit the agency’s operations and ensuring that they are integral to operations. GAO and ONR’s internal review team have each issued one report in recent years with recommendations related to the indirect cost rate- setting processes for the cognizant agencies. GAO reviewed DOD’s processes and procedures related to indirect costs for research and made one recommendation. During its review, GAO found a wide variation in indirect cost rates at universities receiving DOD funding because of inconsistencies in the rate-setting and reimbursement processes. The report concluded that with inconsistencies in rate-setting and reimbursement processes and weakness in oversight methods, DOD lacks assurance that it is reimbursing indirect costs appropriately. GAO’s recommendation directed the Secretary of Defense to assess the current level of audit coverage for monitoring DOD’s indirect cost reimbursement for universities and determine what level is sufficient and whether to expand use of closeout and other audits to oversee compliance. ONR’s internal review office assessed the effectiveness of its Indirect Cost Branch’s processes. While the overall rating was satisfactory, ONR’s review office made one recommendation related to the performance standards and procurement processes and one recommendation to complete a staffing analysis. ONR implemented GAO’s recommendation, but ONR’s two internal review recommendations remain unimplemented. Under OMB guidance, the cognizant agencies are responsible for reviewing, negotiating, and approving indirect cost rate proposals on behalf of all other federal agencies. Consequently, NIH relies on the cognizant agencies to design adequate internal controls over their processes for negotiating indirect cost rates with research organizations that support the various types of NIH extramural research programs. Since NIH reimburses the indirect costs for NIH grants based on the negotiated rates, the controls that the cognizant agencies have designed are essential to help protect NIH funds against fraud, waste, and abuse in the indirect cost rate-setting process. Based on our review of OMB guidance and the FAR, we identified controls that are key to preventing fraud, waste, and abuse in the indirect cost rate-setting process. These controls included steps for the negotiator to (1) determine the allowability, allocability, and reasonableness of proposed indirect costs and assess a research organization’s methods for allocating such costs to federally funded research grants; (2) determine the composition of the distribution base; and (3) maintain sufficient documentation to support the negotiation and calculation of the indirect cost rates. Our review determined that while the three cognizant agencies had designed some controls for setting indirect cost rates, deficiencies in the design of these controls could result in the waste of federal resources. The deficiencies we identified are as follows: internal guidance at all three cognizant agencies was not updated to reflect current OMB guidance or changes in agency requirements, such as documentation requirements or formalizing agency internal guidance; ONR’s internal guidance lacked adequate review procedures over DCAA’s advisory audit function when a DCAA audit was significantly delayed or resulted in a qualified opinion or when DCAA rescinded a previously issued opinion; internal guidance at all three cognizant agencies lacked detailed instructions to supervisors on their review responsibilities over the indirect cost rate process; CAS and ONR had not developed internal guidance addressing differences in negotiating indirect cost rates with certain types of research organizations; and ONR and NIH-DFAS had not developed mechanisms to track key milestones for the indirect cost rate-setting process. Standards for Internal Control in the Federal Government states that management should develop internal guidance to help ensure that management directives are carried out and effective and efficient control activities are implemented to accomplish the agency’s objectives.