However, the Foundation did not have formal written policies related to  the hiring and separation of employees. Design of internal controls over employee hiring and  separations. Foundation officials stated that they had not yet documented these  internal control policies and procedures because they focused their  efforts during fiscal year 2015 on (1) developing formal written internal  control policies and procedures that were identified by the FLT’s risk  assessment survey and (2) implementing control activities in areas in  which the Foundation has not yet had the opportunity to develop  formal written internal control policies and procedures. Conclusions

Since the release of GAO’s report in December 2013, the Foundation has  made significant progress in improving its internal control environment,  risk assessment, and monitoring activities; designing and implementing  internal control activities over certain of its personnel and contracting  practices; and designing and implementing internal control activities over  its receipts and disbursements activity. In addition, the Foundation had not fully updated and finalized formal  written internal control policies and procedures for its contracting  practices, including all key internal control activities, such as evidence of  management’s receipt and review of contractors’ invoices, and had not  established a date by which it planned to complete the action to finalize  its policies and procedures for its contracting practices. Until the  Foundation fully documents its internal control policies and procedures for  certain of its personnel practices, and updates and finalizes its draft  guidance for its contracting practices, there is an increased risk that  procedures in these areas may not be consistently carried out, which in  turn increases the risk that (1) employees could be hired or separated  improperly and applicable laws and implementing regulations may not be  consistently followed and (2) the Foundation may pay for erroneous  amounts billed. Recommendations for Executive Action

We recommend that the Foundation’s Executive Director take the  following two actions:
Fully document the Foundation’s internal control policies and  procedures related to the hiring and separation of employees. Update the Foundation’s draft written policies and procedures over its  contracting practices to include all key internal control activities, issue  them in final form, and establish a date by which these actions will be  completed. Agency Comments

We provided a draft of this report to the Foundation for comment. Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine the extent to which the Morris K. Udall  and Stewart L. Udall Foundation (Foundation) has (1) made progress in  improving its internal control environment, risk assessment, and  monitoring activities; (2) designed and implemented effective internal  control over certain of its personnel and contracting practices; and   (3) designed and implemented effective internal control over its receipts  and disbursements activity (consisting of payroll, contracting, and other  expense transactions). We  also obtained, analyzed, and summarized the Foundation’s written  internal control policies and procedures related to receipts and  disbursements activity for the 9-month period July 1, 2014, through   March 31, 2015, and compared them to the criteria in Standards for  Internal Control in the Federal Government to determine whether these  key control activities were consistent with federal internal control  standards.
Why GAO Did This Study

In December 2013, GAO issued a report that described the Foundation's actions to improve its internal control assessment process and its controls over personnel and contracting.
A fiscal year 2015 congressional directive includes a provision for GAO to conduct a follow-up evaluation of the Foundation's internal controls. This report examines the extent to which the Foundation has (1) made progress in improving its internal control environment, risk assessment, and monitoring activities; (2) designed and implemented effective internal control over certain of its personnel and contracting practices; and (3) designed and implemented effective internal control over receipts and disbursements activity.
For the 9-month period July 1, 2014, through March 31, 2015, GAO reviewed relevant Foundation documents, interviewed Foundation management, reviewed key processes, performed observations, and tested transactions for key internal control activities.

What GAO Found

The Morris K. Udall and Stewart L. Udall Foundation (Foundation), an executive branch agency, provides educational opportunities related to environmental policy and Native American health care and tribal policy and assists in resolving environmental disputes that involve federal agencies. Since GAO's 2013 report, the Foundation has made significant improvements to several key areas as detailed below.
The Foundation also has made significant progress designing and implementing internal control activities over certain of its personnel and contracting practices. However, the Foundation has not, as called for under federal internal control standards, (1) fully documented its policies and procedures related to the hiring and separation of employees and (2) updated and finalized its policies and procedures over its contracting practices to include all key internal control activities, such as providing evidence of management's receipt and review of contractors' invoices. Foundation officials stated that they had not yet performed these actions as they have focused their efforts during fiscal year 2015 on developing formal written internal control policies and procedures in areas that were previously identified by Foundation management as significant risks. However, the Foundation's Corrective Action Plan does not include steps to document hiring and separation policies and does not have a completion date for finalizing its contracting policies. Until this is addressed, there is an increased risk that procedures in these areas may not be consistently carried out, which in turn increases the risk that (1) employees could be hired or separated improperly and applicable laws and implementing regulations may not be consistently followed and (2) the Foundation may pay for erroneous amounts billed.
The Foundation also effectively designed and implemented internal controls over its receipts and disbursements activity. The Foundation designed formal written internal control policies and procedures in these areas consistent with federal internal control standards. Based on tests of randomly selected statistical samples of transactions, GAO found that the Foundation effectively implemented key internal control activities over the processing of its receipts and disbursements activity.

What GAO Recommends

GAO recommends that the Foundation (1) fully document its internal control policies and procedures related to the hiring and separation of employees and (2) update its draft written policies and procedures over its contracting practices to include all key internal control activities, issue them in final form, and establish a date for completion. In commenting on a draft of this report, the Foundation concurred with the recommendations and stated that they will be included in its 2016 Corrective Action Plan.