Although CDC Implemented Corrective Actions To Improve Oversight of the President's Emergency Plan for AIDS Relief Recipients, Some Internal Control Weaknesses Remained

Why OIG Did This Audit

The U.S. Congress authorized the President's Emergency Plan for AIDS Relief (PEPFAR) to receive $48 billion in funding for the 5-year period beginning October 1, 2008, to assist foreign countries in combating HIV/AIDS, tuberculosis, and malaria. Congress authorized additional funds to be appropriated through 2023.

The Tom Lantos and Henry J. Hyde United States Global Leadership Against HIV/AIDS, Tuberculosis, and Malaria Reauthorization Act of 2008 (the Act) requires the Department of Health and Human Services (HHS), Office of Inspector General (OIG), among others, to provide oversight of the programs implemented under the Act, including PEPFAR. To meet this requirement, we have conducted a series of audits of organizations receiving PEPFAR funds from HHS, Centers for Disease Control and Prevention (CDC). In audits of PEPFAR recipients, some findings indicated common trends among the recipients.

Our objectives were to identify: (1) trends related to findings in our prior audits of CDC PEPFAR recipients, (2) CDC's actions to improve oversight of PEPFAR recipients, and (3) internal control weaknesses in CDC's post-award oversight of PEPFAR recipients.

How OIG Did This Audit

Our audit covered the budget periods from October 1, 2007, through September 29, 2016 (audit period). We analyzed the results of the 21 PEPFAR audit reports during the audit period and reviewed CDC internal controls over post-award oversight.

What OIG Found

Our analysis of 21 prior audit reports on PEPFAR recipients identified the following 6 trends in which recipients:

1. had either inadequate or no policies and procedures related to management of PEPFAR funds (19 of 21 reports),
2. did not comply or may not have complied with HHS regulations regarding value added tax (18 of 21 reports),
3. had transactions that were either not supported (16 of 21 reports) or unallowable (15 of 21 reports),
4. did not accurately report PEPFAR expenditures on the financial reports or did not file reports on time (11 of 21 reports),
5. did not have annual audits performed or submitted on time (9 of 21 reports), and
6. could not reconcile PEPFAR expenditures to amounts reported on their financial reports (7 of 21 reports).

In response to the 6 trends identified in our prior audits, CDC took action to improve its oversight of PEPFAR recipients. Finally, CDC had two internal control weaknesses in its post-award oversight that it did not adequately address in its in-country office Standard Operating Procedures (SOPs).

What OIG Recommends and CDC Comments

We recommend that CDC implement requirements for CDC in-country offices to have SOPs for Cooperative Agreement (CoAg) management and periodically review and update CDC in-country office SOPs for CoAg management.

In written comments to our draft report, CDC officials concurred with our recommendations. CDC stated that it has developed minimum standards for all in-country CoAg management SOPs. CDC will start implementing these minimum standards in January 2021. In addition, CDC is developing a process to annually review and update in-country SOPs for CoAg management. CDC will also start this process in January 2021.

CDC also provided technical comments that we addressed as appropriate.