Legal Services Corporation: Improved Internal Controls Needed in Grants Management and Oversight

GAO will follow up on LSC actions in this area as part of an engagement planned to begin in November 2009. Subsequently, LSC issued an OCE procedures manual that addresses the coordination of information with other offices, including visit coordination between OCE and OPP. Additionally, the OCE procedures established a protocol for OCE and the OIG to exchange information. OPP also issued a procedures manual that describes information sharing, specifying when OCE is to provide notice to OPP or to consult with OPP in such matters as --Providing prior approvals to recipients for major expenditures; -- Reviewing and responding to grantees' requests for waivers related to Private Attorney Involvement (PAI) requirements, fund balances and fund deficits; -- Investigating complaints referred by Members of Congress to LSC management pertaining to LSC grantees; -- Reviewing, assessing and responding to public complaints; -- Providing follow up to the referrals of findings by the OIG through the A-50 referral process; and -- Investigating grantees' compliance with the regulations recipients agreed to abide by when accepting Federal funding. In addition, the OPP Procedures Manual includes a protocol for exchanging information with the OIG. As a result of LSC's guidance on information sharing and communication among OPP, OCE and the OIG can enable them to be more effective and should improve LSC's ability to monitor and oversee grants.

In our 2007 report on the Legal Services Corporation (LSC), we found that LSC did not use a structured or systematic approach for assessing risk associated with its 138 grantees as a basis for determining the timing and scope of its grantee oversight visits. In determining which grantees to visit, both the Office of Program Performance (OPP) and the Office of Compliance and Enforcement (OCE) use an approach based primarily on time between site visits and the respective office director's judgments. The director of OCE also said OCE attempts to visit every grantee on a 5 and a half year cycle. However, this time-based cycle is not consistently followed. For example, the second largest grant recipient, receiving over $13 million in 2006, has not been visited by OCE since at least 1996. In addition, we noted there was a 7-year lapse between OCE visits to a grantee in Las Vegas, Nevada, for which OCE, recently opened an investigation after discovering several significant compliance-related findings. Without a more structured process for selecting grantees to review, LSC does not have an analytical basis to know whether it is has the proper level of staff resources assigned to the grantee review function or whether it is gaining an adequate level of assurance for the number of staff assigned to grantee review activities. Also, when a significant time period exists between OCE visits the risk increases that non-compliance issues may not be detected and remediated in a timely manner. GAO recommended that LSC management develop and implement an approach for selecting grantees for internal control and compliance reviews that is founded on risk-based criteria, uses information and results from oversight and audit activities, and is consistently applied. During 2010, LSC developed two documents: (1) OPP Steps for Program Selection and (2) OCE Steps for Compliance Visit Selection to complement its OPP and OCE Procedures Manuals. The OCE guidance refers to the risk factors listed in the OCE Procedures Manual in the "Criteria to Select Programs for Visits". Both the OPP and OCE guidance documents for program visit selection provide a risk-based, concise description of the process to select programs for reviews. Further, in 2010, LSC revised OCE Office Procedures Manual to emphasize the top risk criteria for selecting grantees for visits, and in 2011, documented program quality and compliance examination visit selection based on a review of risk factors to include both primary and secondary risk factors. Primary risk factors included date of last site visit, and significant programmatic issues identified by LSC or other reliable source. Secondary risk factors included significant complaints filed or pending against a program, transition in program leadership, results of financial statement reviews and others. LSC's actions demonstrate that LSC has developed and implemented risk-based steps for program visit selection and, therefore, has increased the effectiveness and efficiency of its program oversight.

In our December 2007 report on Legal Services Corporation (LSC) we found that the roles and division of responsibilities between the Office of Inspector General (OIG) and Office of Compliance and Enforcement (OCE) for oversight of grantee financial controls and compliance were not clearly defined. With compliance oversight and monitoring responsibilities divided between OCE and OIG and program oversight activities being performed by Office of Program Performance (OPP), strong coordination and communication among the three offices and a clear understanding of their roles and responsibilities is critical for achieving effective grantee and program oversight. OCE staff expressed confusion about their own roles and responsibility for the more limited fiscal compliance reviews they perform, and there was contention between OCE and OIG over unclear areas of responsibility that dates back to 1995. To help LSC improve its internal control and oversight of grantees, we recommended that LSC develop and implement policies that clearly delineate organizational roles and responsibilities for grantee oversight and monitoring, including grantee internal controls and compliance. During 2010, LSC developed and issued an April 2, 2010 memorandum which defined the responsibilities of the OIG and OCE for grantee oversight and monitoring, including grantee internal controls and compliance. The memo provided that the LSC Board of Directors adopted the "Roles and Responsibilities of LSC Offices Responsible for Grantee Oversight", to include the responsibilities of OPP, OCE and OIG. LSC resolution no. 2008-008 also specified the respective responsibilities for OPP and OCE in the oversight of internal financial controls at grantees. As a result of LSC's actions, LSC increased clarity over roles and responsibilities for grantee oversight, thus providing greater assurance that staff are not duplicating efforts and conducting more effective grantee and program oversight.

Both management and the board are preparing status updates that they plan on delivering on September 1, 2009. GAO will follow up on LSC actions in this area as part of an engagement planned to begin in November 2009. Subsequently, in November 2007, the LSC President referred eight of the nine programs to the LSC Office of Inspector General (OIG) for follow-up. The ninth program, Nevada Legal Services (NLS), was followed up with by the Office of Program Performance and the Office of Compliance and Enforcement (OCE). In a summary report, the LSC OIG concluded that the issues specifically identified by GAO had been sufficiently corrected at each of the eight grantees visited. In addition, the OIG issued eight individual reports demonstrating that follow-up occurred with the eight grantees contributing to the resolution of the recommendation. During 2008, LSC took oversight actions over NLS. In June 2008, as a result of an OCE investigation, NLS was placed on month to month funding along with monthly reporting requirements. In September 2009, a joint OPP and OCE review of NLS was completed which reviewed progress against specific grant conditions. As a result of LSC's and OIG's follow-up efforts on the nine LSC grantees, LSC has a more informed basis for its grant management actions.

In our December 2007 report of the Legal Services Corporation (LSC), we found that LSC's fiscal reviews did not contain sufficient scope of work to adequately assess grantee internal control or fiscal compliance for purposes of achieving effective oversight. LSC fiscal reviews are intended to determine whether LSC grant recipients demonstrate effective discharge of their stewardship responsibilities. Specifically, fiscal reviews are to examine accountability of LSC funds, and on a limited basis, the effectiveness of the recipient's internal controls. LSC's Office of Program Performance (OPP) performs program site visits to evaluate and develop programs, gather information, and develop new strategies for expanding access and enhancing quality. However, the LSC reviews we observed left out important follow-up to issues that surfaced during LSC's interviews with grantee personnel and did not address outstanding auditor findings. As a result, GAO found that an OCE analyst did not question grantee officials about a $30,000 payment to a subgrantee that lacked supporting documentation. In addition, our review of documentation that LSC officials had also reviewed found that LSC staff did not always follow up on apparent improper transactions, such an improper transaction involving a grantee's sale of a building. To help LSC improve its internal control and oversight of grantees, we recommended that LSC management develop and implement procedures to improve the effectiveness of the current LSC fiscal compliance reviews by revising LSC's current guidelines to provide a direct link to the results of site visit reviews audit findings and responses from grantee interviews, and also provide examples of appropriate fiscal and internal control review procedures. During 2009, LSC revised its On-site Fiscal Review Policies and Procedures to provide comprehensive and the on-site fiscal review policies and procedures, including numerous examples of the types of appropriate procedures to perform and whom to interview. During 2010, LSC updated its manuals to include revised guidance for performing interviews including follow-up on responses from grantee interviews. In addition, procedures were updated in 2010 to provide that on-site reviews are to be conducted in accordance with the approved work plan, and each work plan should identify, in the "Basis for Review" section, the specific risk factors that led to the program being selected for review. For example, the results of financial statement reviews and compliance or other reviews are to be considered as risk factors and incorporated in the approved work plan. With these actions, LSC has developed and implemented procedures to strengthen the effectiveness of its grantee fiscal compliance reviews.