CDC's Internal Control Weaknesses Led to Its Initial COVID-19 Test Kit Failure, but CDC Ultimately Created a Working Test Kit

Why OIG Did This Audit

The Department of Health and Human Services (HHS) is the U.S. Government's principal agency for protecting the health of all Americans. Included in this role is the responsibility to respond to pandemics. The first cases of COVID-19 were identified in China and reported to the Centers for Disease Control and Prevention (CDC) in December 2019, and the first case in the United States was officially diagnosed on January 20, 2020. In mid-January 2020, CDC began developing a diagnostic test kit to detect COVID-19.

Our objective was to review CDC's process for developing the COVID-19 test kits and determine factors that contributed to the initial COVID-19 test kit failure.

How OIG Did This Audit

Using Federal internal control standards, we assessed the effectiveness of CDC's controls throughout the test kit development process. We interviewed HHS personnel who participated in the development of the COVID-19 test kits, focusing mainly on the CDC laboratories that developed the test kits. We requested and reviewed available documentation such as white papers, final and draft policies and procedures, strategies, and emails that were produced between January and March 2020. We also reviewed the results of CDC's Root Cause Analysis, in addition to HHS's Office of the General Counsel's report of its investigation into the initial test kit failure.

What OIG Found

Ultimately, CDC developed a viable COVID-19 test kit within 2 months of China publishing the genome sequence of the novel virus that caused the COVID-19 outbreak. However, some of the initial COVID-19 test kits that CDC developed and distributed to public health laboratories could not be verified by the public health laboratories, and CDC initially identified multiple potential causes of this failure. We identified weaknesses in CDC's COVID-19 test kit development processes and the agency-wide laboratory quality processes that may have contributed to the failure of the initial COVID-19 test kits.

Without effective internal controls, CDC may: (1) experience delays in the development of test kits when responding to future public health emergencies; (2) not identify problems in a timely manner when developing test kits; and (3) risk damaging public trust, which could undermine its ability to accomplish its mission.

What OIG Recommends and CDC Comments

We made several recommendations to CDC, including that CDC: (1) create policies and procedures for developing test kits, (2) ensure that the recently finalized Graduated Response Framework addresses our report findings, (3) develop and implement documented processes to ensure that adequate staffing and laboratory space can be obtained for future responses, (4) re-evaluate the Incident Management System structure at all levels of CDC's response framework and integrate positions or roles and responsibilities that provide effective oversight of a laboratory-based response effort, (5) implement a CDC-wide laboratory document control system, and (6) ensure that all infectious disease laboratories implement and periodically evaluate a laboratory quality management system.

In response to our draft report, CDC neither concurred nor non-concurred with our recommendations. Instead, CDC discussed actions it has taken or plans to take to implement our recommendations. CDC stated that it developed a Laboratory Quality Plan to address issues of quality and oversight. CDC also stated that it published documentation outlining laboratory functions during an emergency response, evaluated the operating effectiveness of its internal controls, and elevated oversight of emergency response efforts to ensure accountability. Finally, CDC stated that it is continuing to work on the implementation of the electronic quality management system, which facilitates laboratory quality activities. We commend CDC on the actions it has taken or is taking to address our recommendations.