Indirect costs  represent an organization’s general support expenses that cannot be  specifically attributed to a specific research project or function. As noted above, OMB and HHS have designated  three primary cognizant agencies to negotiate indirect cost rates for  research organizations that receive NIH-funded grants: (1) CAS, (2) NIH- DFAS, and (3) ONR. The cognizant agencies are responsible  for ensuring that the negotiated indirect cost rates comply with OMB  guidance and the FAR, as applicable. CAS and NIH-DFAS review proposals whereas ONR  generally sends proposals to the Defense Contract Audit Agency (DCAA)  to be audited. Consequently, NIH relies on the  cognizant agencies to design adequate internal controls over their  processes for negotiating indirect cost rates with research organizations  that support the various types of NIH extramural research programs. Our review determined that while the three cognizant agencies had  designed some controls for setting indirect cost rates, deficiencies in the  design of these controls could result in the waste of federal resources. The deficiencies we identified are as follows:  internal guidance at all three cognizant agencies was not updated to  reflect current OMB guidance or changes in agency requirements,  such as documentation requirements or formalizing agency internal  guidance;
ONR’s internal guidance lacked adequate review procedures over  DCAA’s advisory audit function when a DCAA audit was significantly  delayed or resulted in a qualified opinion or when DCAA rescinded a  previously issued opinion;  internal guidance at all three cognizant agencies lacked detailed  instructions to supervisors on their review responsibilities over the  indirect cost rate process;
CAS and ONR had not developed internal guidance addressing  differences in negotiating indirect cost rates with certain types of  research organizations; and
ONR and NIH-DFAS had not developed mechanisms to track key  milestones for the indirect cost rate-setting process. If these  deficiencies are not addressed, there is an increased risk that the  cognizant agencies may not properly and consistently negotiate indirect  cost rates and that the rates negotiated may not comply with applicable  federal regulations. Thus, there is an increased risk that the indirect cost  rates used to reimburse NIH research organizations will include costs that  are not allowable, allocable, and reasonable and may result in wasted  federal resources. To improve the design of internal controls over the indirect cost rate- setting process, we recommend that the Director of ONR take the  following five actions:  implement the May 2014 policy requiring an annual review of  guidance so that internal guidance is updated when changes are  made to applicable regulations and procedures to reasonably assure  that the guidance reflects current requirements;  include in its internal guidance acceptable DCAA audit completion  time frames and identify supplemental procedures to be performed by  negotiators if DCAA cannot perform its audits timely or if DCAA issues  a qualified opinion or rescinds one of its previously issued audit  opinions, to reasonably assure that the indirect cost rate proposal has  been adequately reviewed and the negotiated rate complies with  applicable regulations; develop detailed procedures for the completion and documentation of  supervisory review of the indirect cost rate negotiation process to  provide reasonable assurance that required certifications and  assurances are obtained and follow-up with the research organization  is documented;  finalize and issue internal guidance for negotiating indirect cost rates  with universities and nonprofit organizations, including establishing a  time frame for issuance of the internal guidance, to help ensure that  the procedures are implemented in a timely manner; and update ONR’s existing process for tracking key milestones in the  indirect cost rate-setting process to include information such as when  indirect cost rate proposals are overdue and when DCAA’s audit  reports are due. Appendix l: Objective, Scope, and Methodology

The objective of this review was to determine the extent to which the  cognizant agencies have designed internal controls to mitigate fraud,  waste, and abuse in the indirect cost rate-setting process for National  Institutes of Health (NIH) grants. However, the Office of Management and  Budget (OMB) and the Department of Health and Human Services (HHS)  have designated three primary cognizant agencies to negotiate indirect  cost rates for grants funded by NIH: (1) HHS’s Cost Allocation Services  (CAS), (2) NIH’s Division of Financial Advisory Services (NIH-DFAS), and  (3) the Department of Defense’s (DOD) Office of Naval Research (ONR).
Why GAO Did This Study

NIH spent over $23 billion to support extramural research in 2015, including $6.3 billion for indirect costs, which are costs not directly attributable to a specific research project or function, such as utilities expenses, for grants and cooperative agreements. NIH relies on designated cognizant agencies to design adequate internal controls over the processes for negotiating indirect cost rates with research organizations. Once set, these rates must be accepted by NIH and all federal awarding agencies.
GAO was asked to review the internal controls for overseeing the validity of indirect cost rates for NIH's research organizations. This report examines the extent to which the three primary cognizant agencies (CAS, NIH-DFAS, and ONR) that set indirect cost rates on NIH's behalf have designed internal controls to mitigate the potential for fraud, waste, and abuse in the indirect cost rate-setting process. GAO reviewed OMB guidance, the FAR, and the cognizant agencies' internal guidance on indirect cost rate negotiation; interviewed staff at the cognizant agencies; and reviewed a nongeneralizable sample of negotiation case files to obtain an understanding of the design of controls.

What GAO Found

Research organizations that apply for National Institutes of Health (NIH) funding participate in an indirect cost rate-setting process, which involves submitting a rate proposal; reviewing the proposal and having it audited by a third-party agency at the cognizant agency's request; and finalizing (negotiating) the rate for the organization. The Office of Management and Budget (OMB) and the Department of Health and Human Services (HHS) have designated three primary cognizant agencies to set indirect cost rates for federal financial assistance funded by NIH:
HHS's Cost Allocation Services (CAS),
NIH's Division of Financial Advisory Services (NIH-DFAS), and
the Department of Defense's (DOD) Office of Naval Research (ONR).
These cognizant agencies are responsible for ensuring that negotiated indirect cost rates comply with OMB guidance and the Federal Acquisition Regulation (FAR), as applicable.
GAO found that while the three agencies had designed controls for setting indirect cost rates, deficiencies in the design of some of these controls could result in the waste of federal resources. The deficiencies GAO identified are as follows:
None of the three agencies has updated its internal guidance to reflect current OMB guidance or changes in agency requirements, such as documentation requirements.
ONR relies on audits by the Defense Contract Audit Agency to ensure the adequacy and compliance of indirect cost proposals that it processes, but ONR has not included acceptable time frames in its internal guidance for when these audits are to be completed or what steps are to be taken when audits result in qualified opinions or when a prior audit opinion is rescinded.
All three cognizant agencies' internal guidance lacks detailed instructions to supervisors on their review responsibilities over the indirect cost rate process.
CAS and ONR have not developed internal guidance addressing differences in negotiating indirect cost rates with certain types of research organizations, such as universities and hospitals.
ONR and NIH-DFAS have not developed mechanisms to track key milestones for the indirect cost rate-setting process.
If these deficiencies are not addressed, there is an increased risk that these cognizant agencies may not properly and consistently negotiate indirect cost rates and that the rates negotiated may not comply with applicable federal regulations. Thus, there is an increased risk that the indirect cost rates used to reimburse NIH research organizations will include costs that are not allowable, allocable, and reasonable, and may result in wasted federal resources.

What GAO Recommends

GAO is making 12 recommendations to improve controls over their indirect cost rate process. HHS concurred with GAO's 7 recommendations to CAS and NIH-DFAS and described ongoing and planned actions to address them. DOD concurred with 4 recommendations to ONR and partially concurred with 1. GAO continues to believe that action is needed, as discussed in the report.