Congress — in in the wake of unprecedented demand for disaster relief and recovery funding in 2017 — mandated that federal agencies, with guidance from the Office of Management and Budget, submit plans ensuring money was spent efficiently and effectively. OMB failed to give sufficient guidance to the agencies, however, resulting in Congress not receiving sufficient assurance that disaster relief funds were appropriately safeguarded, according to a June 28 Government Accountability Office report.

Federal agencies were required to submit internal control plans by March 31, 2018, to reduce risks of fraud and improper payment associated with spending billions of dollars quickly. OMB was required to provide agencies with guidance and “robust criteria for identifying and documenting incremental risks and mitigating controls related to disaster relief funding.”

GAO found that out of the six agencies receiving the most disaster aid funding — totaling $115 billion — only the Department of Education submitted its internal control plan by the statutory deadline. Further, as of April 2019, the Department of Defense has not submitted an internal control plan, and the other four agencies submitted plans late — from two to over seven months after the deadline.

OMB issued a memorandum containing guidance for agencies to use in developing their plans — but not until March 30, 2018, giving agencies only one day to consult the memorandum before the statutory deadline.

“Because OMB did not establish an effective strategy for timely communicating requirements for agency reporting in internal control plans, federal agencies lacked the information needed to meet the statutory deadline,” the report said.

GAO also found that the plans varied in completeness and detail. For example, one agency’s plan was over 30 pages, while another plan was two pages. For one agency’s program receiving the most funding, the agency’s description for its internal control plan “consisted of one paragraph that identified one incremental risk and mitigation strategy for that program” and “did not describe other controls it used to ensure the integrity for the payments of funds in this program.”

Also, while the memorandum said agencies should incorporate federal control standards, none of the selected agencies described how they met all of the federal control standards or “clearly communicated how the agency’s oversight body and management demonstrated a commitment to integrity and ethical values.”

According to GAO, OMB’s guidance memorandum did not provide criteria for what the plans should include or provide illustrative examples of completed plans, making it difficult for agencies to develop their plans.

GAO recommended that “OMB develop a strategy for ensuring that agencies communicate sufficient and timely internal control plans for effective oversight of disaster relief funds.”

OMB did not agree that this recommendation is needed, and stated that “OMB Circular No. A-123’s enterprise risk management requirements were sufficient for agencies to produce effective internal control plans” because “agencies should consider disaster situations as part of their overall consideration of risk.”

However, Congress required agencies to communicate internal control plans associated with the supplemental disaster aid funding.

“Without a clear OMB strategy for preparing oversight of future disaster relief funding, there is an increased risk that agencies will not appropriately assess risks associated with disaster relief funding,” GAO said. “As a result, Congress and others may not receive the necessary information about internal controls, which will affect Congress’s and others’ ability to provide effective oversight” and “fully assess the extent to which agencies achieve payment integrity objectives for the disaster relief fund.”