This manual chapter established the policies, procedures, and guidelines for supporting outside Audit Reviews and follow-up activities conducted at NIH by the Department of Health and Human Services (HHS) Office of Inspector General (OIG), and Government Accountability Office (GAO); and NIH Management Officials’ responsibilities for responding to and taking corrective actions on OIG and GAO audit findings and recommendations. For reference, Appendix A contains definitions of relevant terms used in this Manual Chapter and the audit process. Appendix B contains guidelines for sharing sensitive information with auditors. Appendix C contains pertinent information on the Audit Lifecycle.

This chapter also establishes the response criteria and time frames for NIH Management Officials for responding to OIG and GAO audit findings and recommendations. Time frames may vary depending on the topic and complexity of the OIG or GAO Review.

The policy in this chapter applies to all NIH Institutes, Centers, and Offices within the Office of the Director (ICOs) and all personnel, including employees, contractors, volunteers, fellows, trainees, and interns (referred to here as “staff”).

This chapter does not apply to reviews initiated by the OIG Office of Investigations or the GAO Forensic Audits and Special Investigations team, which are initiated under different authorities than the reviews referred to in this chapter.

NIH Delegation of Authority, General Administration: No. 34

1. 5 United States Code (U.S.C.) App., Inspector General Act of 1978, as amended
2. 31 USC § 711 - 712, 717, 719, 720 General Authority, Comptroller General Reports, as amended
3. 31 USC § 3529, Requests for decisions of the Comptroller General, as amended
4. OMB Circular No. A-123: Management’s Responsibility for Enterprise Risk Management and Internal Control, Revised July 2016
5. OMB Circular A-50 Audit Follow-up
6. The Good Accounting Obligation in Government Act (GAO-IG Act; Public Law 115- 414), January 2019
7. Government Accountability Office, GAO-19-55G, Revised, Agency Protocols, January 2019
8. Government Accountability Standards for Internal Control in the Federal Government, Revised September 2014
9. GAO Open Recommendations Database, Updated Periodically
10. NIH Manual Chapter 1743, Managing Federal Records, Appendix 4, Records Management Resources

Outside Audit Reviews are an important component of the oversight of internal programs and operations. These Audit Reviews help the organization identify, prevent, and mitigate fraud, waste, abuse, mismanagement, and conflicts of interest. The prompt resolution and development of corrective actions to address audit findings and recommendations are an integral part of good management. Corrective actions taken by NIH management to resolve findings and recommendations are essential to improving the effectiveness and efficiency of NIH operations. The audit liaison function at NIH for OIG and GAO Audit Reviews resides within the Office of the Director (OD), Office of Management (OM), Office of Management Assessment (OMA).

The OIG is mandated to protect the integrity of HHS programs, as well as the health and welfare of the beneficiaries of those programs. The OIG has the responsibility to report program and management problems, and make recommendations to correct them, both to the Secretary of HHS and to Congress. In order to carry out these responsibilities, OIG conducts audits, investigations, and inspections.

At the request of Congress and, under special circumstances, on their own initiative, GAO provides oversight of Federal programs and insight into ways to make government more efficient, effective, ethical, and equitable. GAO reports, testimonies, and legal decisions are reported to Congress. The GAO also issues guidance on the development and use of internal or management controls to ensure effective and efficient government operations.

The NIH policy outlines general principles and protocols governing NIH’s relationships with Outside Audit Reviews. The policy, as well as numerous statutory laws and obligations, requires management officials to promptly comply with OIG and GAO audit requests for access to the agency’s records for evidence and examination of virtually every federal program, activity, and policy.

The statutory requirements help ensure the consistency, fairness, and effectiveness of interactions between NIH and audit agencies. These activities include scheduling timely entrance and exit conferences, providing information and data throughout the audit lifecycle, preparing prompt, responsive, and constructive comments to confirm the critical facts, and finally to address corrective actions, as applicable, in response to OIG and GAO audit report findings and recommendations. The NIH considers Audit Follow-up to be an integral part of good management and a responsibility shared by NIH staff. It is NIH policy to ensure that an Audit Follow-up System provides a complete record of action taken on findings and recommendations.

1. NIH Principal Deputy Director will:
   1. Review and approve written NIH comments to Audit Reviews and sign-off on transmittal documents.
2. NIH Office of the Director, Office of Management, Deputy Director for Management will:
   1. Review written NIH comments to Audit Reviews to ensure that NIH’s responses are consistent with the organization’s mission, goals, and external communications, as well as the Risk Management Program.
3. NIH Office of the Director, Office of Management, Office of Management Assessment will:
   1. Serve as the primary contact for notifying the appropriate organization(s) within NIH regarding the start of an OIG or a GAO Audit Review.
   2. Identify and appoint an OMA Audit Liaison for each OIG or GAO Audit Review.
   3. Initiate meetings between NIH Management Officials and coordinate subsequent meetings between NIH staff and OIG or GAO auditors.
   4. Analyze OIG and GAO requirements, coordinate and negotiate requests for documentation, data, information or meetings with specific NIH Management Officials.
   5. Work with NIH officials to proactively gain an understanding of the information available to auditors in response to their requests and the most efficient way to provide the information to the auditors.
   6. Coordinate the preparation and review of oral briefings or other written documents and reports on the results and status of Audit Review activities.
   7. Coordinate with and keep the HHS Assistant Secretary for Legislation and the HHS Assistant Secretary for Financial Resources informed of ongoing audit activities and statuses as appropriate and necessary.
   8. Coordinate within the OD policy officials to ensure that NIH’s responses are consistent with the organization’s other external communications, as well as the NIH Risk Management Program.
   9. Coordinate comments to OIG or GAO Draft Audit Reports and any subsequent Audit Follow-up regarding recommendations or findings described in the Final Audit Report.
   10. Evaluate management’s corrective actions taken in response to OIG and GAO audit recommendations to ensure the corrective actions fully address the recommendation.
   11. Identify and appoint Audit-Follow-up Official and periodically check-in on the status of agreed-upon open corrective actions.
   12. Upon implementation of recommendations, prepare appropriate documentation for OIG or GAO.
   13. Respond to OIG and GAO inquiries regarding progress on the closure of open recommendations from a Final Audit Report.
   14. Provide briefings on the results and status of Audit Review activities for the NIH Director, NIH Principal Deputy Director, Deputy Director for Management, or OMA Director, and other senior NIH Management Officials, as well as NIH Management Officials involved in the audit.
   15. Establish and maintain an Audit Follow-up system to facilitate the prompt and proper resolution and implementation of audit recommendations.
   16. Track OIG and GAO Audit Reviews and maintain the official NIH files provided to auditors.
   17. On periodic basis, maintain and update Manual Chapter 1752 - Outside Audit Reviews and Follow-up.
4. NIH Office of Science and Policy Liaison will:
   1. Provide guidance and oversight, as needed, on NIH science policy and other issues to fulfill the responsibilities outlined within this policy.
5. NIH Office of the Director, Office of Communications and Public Liaison will:
   1. Provide guidance, as requested, on NIH communication with offices and agencies outside of NIH, including but not limited to the public, the media, the scientific and medical communities, and public advocacy groups, as needed to fulfill the responsibilities outlined within this policy.
   2. As needed, disseminate information that may pertain to upcoming, active, or completed Audit Reviews that OMA is coordinating on behalf of the NIH.
6. NIH Office of the Director, Office of Legislative Policy and Analysis will:
   1. Provide guidance, as requested, on NIH communication with the Congress and its committees to fulfill the responsibilities outlined within this policy.
   2. As needed, disseminate information on congressional inquiries or congressional interest that may pertain to upcoming, active, or completed Audit Reviews that OMA is coordinating on behalf of the NIH.
7. Department of Health and Human Services, Office of the General Counsel will:
   1. Provide advice to management on review topics, as needed.
   2. Review agency responses to draft reports, as needed.
8. NIH Institute, Center, and OD EO will:
   1. Serve as liaison, or designate staff to serve as a liaison, between OMA and their respective ICO to respond to OIG and GAO audits and inquiries throughout the audit lifecycle (Appendix C).
9. NIH Management Officials will, through their respective EO or its designated liaisons:
   1. Cooperate with OMA in their responsibility to coordinate Audit Reviews conducted by the OIG and GAO.
   2. Provide documentation and assistance as part of an official Audit Review. Examples of documentation and assistance may include providing program data, official comments to Draft Audit Reports, or updates on the status of corrective actions taken.
   3. Direct staff, as necessary, to fulfill their responsibilities as outlined in this policy.
   4. Work with OMA to resolve issues pertaining to OIG or GAO Audit Reviews.
   5. Provide OMA with prompt and responsive corrective actions to OIG and GAO report findings and recommendations.
   6. Implement corrective action(s) in response to OIG and GAO findings and recommendations.
   7. If contacted by OIG or GAO without prior notification from OMA, refer the OIG or GAO auditor to OMA to coordinate any request for information.

All records pertaining to this chapter must be retained and disposed of under the authority of NIH Manual 1743, “Managing Federal Records,” Appendix 4, Records Management Resources. These records must be maintained in accordance with current NIH Records Management and Federal guidelines. Contact your IC Records Liaison or the NIH Records Officer for additional information.