Although CDC Implemented Our Prior Audit Recommendations, Its Corrective Actions Did Not Effectively Address Findings Related to 3 of Our 13 Recommendations

Why OIG Did This Audit

The U.S. Congress authorized the President's Emergency Plan for AIDS Relief (PEPFAR) to receive $48 billion in funding for the 5-year period beginning October 1, 2008, to assist foreign countries in combating HIV/AIDS, tuberculosis, and malaria. Congress authorized additional funds to be appropriated through 2023.

Federal law requires the Department of Health and Human Services (HHS), Office of Inspector General (OIG), among others, to provide oversight of the programs implemented under the law, including PEPFAR. To meet this requirement, we have conducted 30 PEPFAR audits of Centers for Disease Control and Prevention (CDC) or recipients in 9 countries on 3 continents.

Our objective was to determine whether CDC implemented the recommendations from our prior audit. As part of this audit, we reviewed the actions taken by CDC to implement our recommendations to determine whether they effectively addressed our findings.

How OIG Did This Audit

Our audit covered 33 Notices of Funding Opportunity (NOFOs) that CDC issued and funded from October 1, 2017, through September 30, 2018 (audit period). The 33 NOFOs resulted in 42 funded awards for a total of $191 million awarded during FY 2018. From the 33 NOFOs, we selected a judgmental sample of 20 NOFOs, representing 27 of the 42 funded awards for $178.6 million. To determine whether CDC implemented our 13 prior recommendations, we evaluated each of the 20 NOFOs and the corresponding 27 awards.

What OIG Found

CDC implemented the 13 recommendations from our prior audit; however, CDC's corrective actions for the following 3 recommendations were not effective in addressing our previous findings:

1. Conduct quality assurance reviews of NOFOs and funded grant applicant information to monitor compliance with HHS and CDC policies when awarding PEPFAR funds.
2. Perform adequate cost analyses and business management evaluations of funded applicants.
3. Include necessary and accurate requirements in the Notices of Award (NOAs).

For our current audit, CDC (1) did not comply with one or more HHS or CDC policies when awarding PEPFAR funds, (2) did not perform cost analyses before issuing some of the grant awards, and (3) issued several NOAs with missing or incorrect reporting requirements.

What OIG Recommends and CDC Comments

We recommend that CDC: (1) develop and implement a written policy requiring periodic internal review of PEPFAR award files for compliance with HHS and CDC policies; (2) fully implement its Cost Analysis Standard Operating Procedure (SOP) by establishing a formal date of effectiveness, updating the SOP periodically, and enforcing its use through regular compliance testing as part of the internal reviews of PEPFAR award files; (3) and establish a policy requiring periodic reviews of, and updates to, the NOA link to ensure functionality, accuracy, and relevance of the content.

In written comments on our draft report, CDC officials concurred with our recommendations. CDC stated that it has developed and implemented an updated internal control review process that includes a monthly review of sampled awards. CDC is currently updating the Cost Analysis SOP and developing cost analysis training. The SOP revision and the training are expected to be completed by September 2021. In accordance with CDC Web Policy's requirement to review and certify web content annually, CDC conducted a review of external facing web pages and documents including the terms and conditions, which are included in the NOA in June 2021.