The Department of Health and Human Services' First-Year Implementation of the Federal Managers' Financial Integrity Act

GAO reviewed the Department of Health and Human Services' (HHS) first-year efforts to implement the Federal Managers' Financial Integrity Act to assess the adequacy of HHS implementation efforts and to identify possible improvements needed for subsequent years' efforts.

GAO found that HHS has made progress in its first-year efforts to implement the act and, for its internal control evaluation and improvement effort, HHS essentially followed the sequence of steps established by the Office of Management and Budget (OMB). For performing accounting systems reviews, HHS assigned responsibilities and developed policies and procedures, conducted reviews of 10 of the 22 systems it identified, and reported the results. While the HHS written procedures for evaluating its accounting systems appear reasonable, its evaluations did not fully comply with its procedures and, consequently, were inadequate to properly determine whether the systems evaluated complied with GAO principles and standards. GAO found that some of the internal control areas which HHS should have included for vulnerability assessments were missed. In addition, changes are needed in the HHS vulnerability assessment process because GAO found that the assessments it reviewed were not a reliable basis for scheduling and guiding subsequent internal control reviews. Furthermore, although HHS conducted 1,135 internal control reviews during the first year, these reviews did not always result in adequate evaluations of internal controls and many missed important evaluation factors included in OMB guidelines. Finally, GAO found that HHS essentially excluded automatic data processing activities from its vulnerability assessments and internal control reviews.