DOE O 224.3, Audit Resolution and Follow-Up Program

U.S. Department of Energy ORDER Washington, D.C. DOE O 224.3 Approved: 1-24-05 This directive was reviewed and certified as current and necessary by Susan J. Grant, Director, Office of Management, Budget and Evaluation/Chief Financial Officer, 1-24-05. S UBJECT: AUDIT RESOLUTION AND FOLLOW-UP PROGRAM 1. OBJECTIVES. a. Establish requirements and responsibilities for the timely, efficient, and effective resolution of open Inspector General (IG) and Government Accountability Office (GAO) audit findings and recommendations. b. Assign accountability to senior program element managers for the management of their respective audit resolution processes. c. Establish requirements and processes for reporting status of open audit findings and recommendations. d. Establish, and inform senior managers of, the authorities and processes for corporate oversight, review, and resolution of audit issues. 2. CANCELLATIONS. DOE 2300.1B, Audit Resolution and Followup, dated 6-8-92. Cancellation of a directive does not, by itself, modify or otherwise affect any contractual obligation to comply with the directive. Cancelled directives that are incorporated by reference in a contract remain in effect until the contract is modified to delete the references to the requirements in the cancelled directives. 3. APPLICABILITY. a. Primary DOE Organizations and the National Nuclear Security Administration (NNSA). This Order applies to all Primary DOE Organizations and their cognizant field activities, and the NNSA. However, certain exceptions or modifications to specific requirements are applicable to NNSA and have been noted as appropriate throughout the Order. This Order also applies to the resolution of IG and GAO audits. Primary DOE Organizations are listed in Attachment 1. This Order also automatically applies to primary DOE organizations created after it is issued. b. Site/Facility Management Contractors. This Order does not apply to contractors. c. Exclusions. None. AVAILABLE ONLINE AT: INITIATED BY: http://www.directives.doe.gov Office of Management, Budget and Evaluation/ Chief Financial Officer http://www.directives.doe.gov 2 DOE O 224.3 1-24-05 4. REQUIREMENTS. a. Audit Resolution and Follow-up Program. Audit resolution and follow-up are integral parts of good management and, therefore, are key elements of senior management responsibilities. Prompt and proper corrective actions are implemented to resolve findings, to address recommendations, and to improve the effectiveness and efficiency of DOE operations. (1) The Office of Management, Budget and Evaluation/Chief Financial Officer (OMBE/CFO) provides corporate leadership for the Department’s audit resolution and follow-up program and advises the Secretary on the status of the program. (2) Primary responsibility for effective audit resolution and follow-up, including the responsibilities listed below, rests with the head of each primary DOE organization or, within NNSA, the Associate Administrator for Management and Administration, including: (a) Establishing and managing processes and procedures to resolve audit findings and recommendations to ensure all audit issues are addressed; (b) Reporting the status of open audit recommendations quarterly in the corporate tracking system, Departmental Audit Report Tracking System (DARTS); (c) Conducting follow-up assessments and/or reviews to ensure corrective actions have been fully implemented in accordance with management commitments established in final reports and/or management decisions;

(d) Ensuring cognizant field activities are compliant with established audit resolution and follow-up requirements and processes; (e) Ensuring site and facility management contractors under their cognizance have systems in place to ensure resolution and settlement of audits, including subcontract audits conducted by other audit agencies such as the Defense Contract Audit Agency; (f) Reviewing IG and GAO report findings and recommendations assigned to other organizations to determine whether those findings and recommendations may be applicable within their organizations and whether actions need to be taken to resolve identified issues. b. Audit Reports. (1) IG audits and inspections and GAO audits resulting in public reports are management tools used to detect fraud, waste, and abuse in the DOE O 224.3 3 1-24-05 Department and to promote economy and efficiency in the administration of the Department’s programs and operations. Public inspection reports will be treated in accordance with the policies and procedures specified for audit reports herein. (2) Open IG audit findings and recommendations shall be resolved within 6 months after issuance of the final audit report [Office of Management and Budget (OMB) Circular A-50, paragraph 8.a.(2)]. For IG audits, resolution is the point at which the primary organization and the auditors agree on actions to be taken on reported findings and recommendations (i.e., management concurs with the final audit report findings and recommendations or a management decision is issued). For GAO audits, resolution occurs within 60 days after formal issuance of the report and is defined as the point at which the Agency responds to Congress [OMB Circular A-50 paragraphs 6.b.(3) and 8.b.(4)]. “Resolution” is not to be confused with “closure” which is explained in paragraph 4b(7) of this Order. (3) When an audit report contains recommendations for only one primary organization, audit resolution and follow-up responsibilities are assigned to that organization to prepare a management decision. This organization is the Primary Action Activity (PAA). (4) When an audit report contains recommendations for multiple organizations, a PAA is designated by OMBE/CFO to coordinate audit resolution and follow-up and prepare the management decision. The PAA coordinates the final management decision with other organizations cited in the report and other appropriate organizations impacted by the management decision. Other organizations that are identified in the audit report or are required to coordinate on the final response are known as a Secondary Action Activity (SAA). NNSA may provide a separate management decision, whether the PAA or SAA, when deemed appropriate by NNSA (with copy to OMBE/CFO). (5) A corrective action plan that addresses each open recommendation is developed whenever an audit report contains at least one open recommendation and/or, for contract audits, contains questioned costs that need to be resolved. The PAA approves action plans and ensures that milestones have been established and completed. Corrective action plans are not required for preaward audits and audits performed solely to determine indirect cost rates. NNSA is responsible for the development, approval, and completion of its own action plans. (6) Audit reports remain open until all recommendations have been closed and an assurance certification is issued by the head of the Primary DOE 4 DOE O 224.3 1-24-05

Organization or NNSA documenting that an assessment or review has been conducted and necessary corrective actions have been completed. (7) Closure of audit reports should generally take no longer than 1 year after issuance of the final report. For closures that are scheduled to take longer than 1 year, a written justification is required in DARTS, subject to audit. c. Departmental Audit Report Tracking System. (1) Quarterly status reports on an organization’s open audit recommendations are submitted to DARTS. This system is maintained by OMBE/CFO and is a tool for tracking/monitoring the Department’s progress in resolving audit recommendations. (2) A complete record of actions taken and milestones for all findings and recommendations, monetary and nonmonetary, is maintained in DARTS. (3) Field and/or Headquarters PAAs or NNSA input audit tracking and follow-up data into DARTS as required. (4) Audit reports remain open in DARTS until the assurance certification is received by OMBE/CFO. d. Departmental Internal Control and Audit Review Council (DICARC). (1) DICARC is a council established to provide senior management oversight of the audit resolution and follow-up program. The council convenes semiannually or when requested by the chairperson. (2) Membership includes the Director OMBE/CFO (Chairperson); the IG; the Principal Deputy Administrator for NNSA; the Assistant Secretary for Environmental Management; and a Headquarters Secretarial Officer appointed on a rotating basis by the Chairperson. A nonvoting technical advisor from the Office of the Secretary will also serve on DICARC. (3) DOE and NNSA Senior Procurement Executives attend council meetings when requested to address audit follow-up matters pertaining to procurement, acquisitions, or contracts. (4) Heads of primary organizations, or their designees, attend council meetings when requested to address audit follow-up matters pertaining to their organizations. 5. RESPONSIBILITIES. a. Departmental Internal Control and Audit Review Council. (1) Provides guidance on corrective actions to be taken when designated officials have failed to make such determinations within the prescribed DOE O 224.3 5 1-24-05 time frames (e.g., audit reports not resolved after 6 months or IG reports not closed after 1 year following the dates of the final reports). (2) Requires and/or recommends additional corrective actions when completed actions have not been sufficiently responsive to audit findings and recommendations. (3) Coordinates development of a management decision when the head of the primary organization is unable to resolve major disagreements with the IG. b. Director, Office of Management, Budget and Evaluation/Chief Financial Officer. (Note: The NNSA Associate Administrator for Management and Administration has delegated authority for carrying out the responsibilities in paragraphs 5b(1), (3), (4), (5), and (6) below on behalf of NNSA to the Director, Policy and Internal Controls Management, where applicable.) The Director, OMBE/CFO, is designated by the Secretary as the Audit Follow-up Official to ensure the Department’s audit follow-up activities result in prompt and proper resolution of audit recommendations. In addition, the Director, OMBE/CFO, chairs, and provides support to, DICARC; plans and schedules DICARC meetings; and notifies appropriate officials, including heads of primary organizations, when the meetings involve issues pertinent to their organizations.

(1) Develops, implements, and maintains Department-wide audit resolution and follow-up policy, procedures, and tracking and reporting systems. NNSA develops and implements internal policies and procedures to support the Departmental process. (2) Notifies heads of primary organizations of specific audit reports for which a DARTS status report must be provided. (3) Reviews DARTS reports quarterly and assesses whether milestones established and corrective actions taken or planned are timely and responsive. Provides periodic reports to Departmental senior management. (4) Provides copies of DARTS status reports quarterly to the IG for review and comment. (5) Seeks resolution of differences regarding actions taken to effect closure of audit findings or recommendations. Refers unresolved differences to DICARC. (6) Analyzes audit follow-up activity periodically to determine trends and system-wide problems and to recommend solutions. 6 DOE O 224.3 1-24-05 c. Inspector General. (1) Reviews DARTS status reports and notifies the Director, OMBE/CFO, of concerns or disagreements with corrective actions taken or planned. The NNSA Director, Policy and Internal Controls Management, is also notified when issues involve NNSA. (2) Evaluates audit follow-up systems periodically and assesses whether the systems result in effective, prompt, and proper resolution and corrective action on audit recommendations. (3) Conducts follow-up reviews of closed audits, when appropriate, to assess whether corrective actions have been implemented. (4) Conducts audits of closure milestones for report closures scheduled to take longer than 1 year beyond issuance of the final report, as deemed appropriate. d. Heads of Primary DOE Organizations and Cognizant Field Activities and the Associate Administrator for Management and Administration, NNSA. (Note: The NNSA Associate Administrator for Management and Administration has delegated authority for carrying out the following responsibilities on behalf of NNSA to the Director, Policy and Internal Controls Management, where applicable.) (1) Develop and manage effective audit resolution and follow-up programs and provide mechanisms for maintaining up-to-date reporting in DARTS. (a) Maintain operating procedures and systems for audit resolution and follow-up. (b) Ensure controls are developed to provide timely, accurate, and complete responses to audit reports. (c) Provide instruction on audit follow-up processes and procedures to personnel within the primary organization or NNSA to ensure the prompt and proper resolution of audit findings and recommendations. (d) Track audit follow-up and confirm that necessary corrective actions have been completed. (2) Designate audit follow-up coordinators to serve as liaisons for their respective organizations with OMBE/CFO to coordinate and track audit resolution and follow-up activities. The Director, Policy and Internal Controls Management, is the single audit coordinator for NNSA. DOE O 224.3 7 1-24-05 (3) Designate audit action officers for each audit report that contains findings and recommendations pertaining to areas of the audit action officers’ assigned responsibilities, and ensure that action plan milestones are met. (For audit recommendations related to contracts and financial assistance agreements, the audit action officer is normally the contracting officer administering the award.)

(4) When designated as the PAA, prepare management decisions to audit reports. Where audit recommendations apply to more than one activity, the PAA must request comments from, and coordinate the final consolidated response with, the SAAs. (5) Provide advance notification to the Associate Deputy Secretary and OMBE/CFO of sensitive issues that will be included in audit reports. This includes controversial findings, recommendations, or other issues of which senior management should be aware. (6) Ensure effective corrective actions have been implemented and have addressed audit report recommendations: (a) Conduct audit follow-up assessments or reviews and provide an Assurance of Effectiveness of Corrective Actions Taken (assurance certification) to OMBE/CFO to close out audit report recommendations. Assurance certifications are signed by the head of the primary organization or his/her designee. The Associate Administrator for Management and Administration is the certifying official for NNSA. Field activities submit their assurances through their headquarters primary organization element. (b) Include the following statement in the assurance certification when all recommendations in operational audit reports have been subjected to an audit assessment or review. “This is to confirm that an audit follow-up assessment or review has been completed on the subject audit report or recommendations contained in the audit report, and necessary corrective actions, if any, have been completed.” The above statement should be followed by the name, title, date, and signature of the head of the primary organization or his/her designee. (c) Submit assurance certifications along with the corresponding DARTS Status Report for the quarter in 8 DOE O 224.3 1-24-05 which all corrective actions have been completed and follow-up assessments or reviews have been conducted. (7) Attend or provide representation at DICARC meetings upon request when items on the agenda pertain to their organizational areas of responsibility. (8) Ensure accountability of appropriate officials for effectiveness in carrying out audit resolution and follow-up activities. 6. DEFINITIONS. The following terms are used in this Order. Because audit resolution and follow-up are the responsibilities of individuals from a variety of professional disciplines, some definitions may differ from generally accepted custom and usage. a. Assurance of Effectiveness of Corrective Actions Taken. An assurance that audit follow-up assessments or reviews have been conducted on each recommendation in the audit report to ensure that corrective actions have satisfactorily addressed audit report recommendations. The assurance must be provided before the audit report can be closed in DARTS. b. Audit. Work performed following the Government Accountability Office’s Government Auditing Standards in examining financial statements and in reviewing (1) compliance with laws and regulations, (2) economy and efficiency of operations, (3) effectiveness in achieving program results, and (4) allowable costs claimed against the Department. c. Audit Follow-up Assessment. An independent examination of operational audit status reports to determine whether audit recommendations have been adequately addressed and corrective actions implemented. This may include an onsite verification review. The assessment is performed by individuals not directly responsible for implementing the corrective actions.

d. Audit Report. For purposes of this Order, audit reports are limited to final reports detailing the results of IG and GAO audits. Types of audit reports include (1) Financial audit report—include a review of the fairness of presentation of financial information, the effectiveness of related internal controls, and compliance with applicable laws and regulations; (2) Operational audit reports— include reviews of the operation and management of Departmental programs and administrative functions and generally involve actual or potential fraud, waste, error, or procedural deficiencies applicable to Departmental elements; and (3) Contractual audit reports—include both contract and financial assistance agreements. Contractual audit reports generally review costs claimed in the determination of allowable costs. Those reports could also include fraudulent claims, compliance, economy, and efficiency audits of contract organizations when DOE is responsible for ensuring the necessary corrective actions are taken. DOE O 224.3 9 1-24-05 e. Audit Resolution. For IG audits, resolution is the point in the audit follow-up process when a management decision is made to act on audit findings, recommendations, or advice (as opposed to the completion of agreed upon actions). For financial and operational audit reports, resolution normally takes place when the official management response on the audit recommendations is signed. For contractual audit reports, audit resolution usually is evidenced when the contracting officer sends written notification to the audited organization initiating appropriate corrective actions, submitting a renegotiation memorandum/plan, or setting forth the basis and rationale for accepting or rejecting the audit report recommendations. An audit report may be considered resolved despite the right of persons outside the Department to negotiate, appeal, or litigate. For GAO reports, resolution is the point at which the Agency responds to Congress. f. Corrective Action Plan. A formal written document that describes the specific steps and milestones necessary for completion of corrective actions. The plan is submitted with management comments on the audit report or with the management decision, whichever is applicable. g. Inspection. Work performed by the IG following the President’s Council on Integrity and Efficiency’s Quality Standards for Inspection in evaluating and reviewing the Department’s programs and operations for economy, efficiency, and effectiveness in achieving program results. h. Management Decision. The final position taken by the PAA on the findings and recommendations identified by the IG and GAO in formal audit reports. i. Primary Action Activity (PAA). The organization assigned primary management responsibility for the functional activity or program that is the principal subject of an audit report. j. Questioned Cost. Any cost proposed or claimed for payment or reimbursement that is recommended for disallowance by the auditor because it does not appear to meet one or more of the following criteria: reasonableness; allocability; cost accounting standards, where applicable; generally accepted accounting principles; applicable cost principles; or specific contract or financial assistance agreement provisions. Questioned cost does not include audited costs which are questioned only because total incurred costs exceed the limit established in the contract or financial assistance agreement.

k. Recommendation. A course of action intended to correct a deficiency that was identified in an audit. Recommendations include questionable costs in contractual audit reports. l. Secondary Action Activity (SAA). Heads of primary organizations responsible for ancillary, technical, or legal aspects covered in an audit report. 10 DOE O 224.3 1-24-05 7. REFERENCES. a. Public Law 95-452, Inspector General Act of 1978, dated 10-12-78, and Public Law 100-504, Inspector General Act Amendments of 1988, dated 10-18-88, which establish Offices of Inspector General in specified departments and agencies. b. Public Law 101-576, Chief Financial Officers Act of 1990, dated 11-15-90, which strengthens financial management in the Federal Government by establishing a Chief Financial Officer in each cabinet level Agency and assigning to this position responsibility for budget, accounting, pricing, internal controls, and other financial management functions. c. Public Law 106-65, National Nuclear Security Administration Act, as amended, dated October 5, 1999, which establishes NNSA as a separately organized agency within the Department of Energy with the authorities and responsibilities for all programs and activities of the administration. d. Office of Management and Budget (OMB) Circular No. A-50 (revised), Audit Followup, dated 9-29-82, which provides the policies and procedures for use by executive agencies when considering reports issued by auditors where follow-up is necessary. The Circular requires prompt resolution within 6 months of issuance (or 6 months after receipt if non-Federal audit) and prompt corrective actions on audit recommendations. The circular further describes the role of the Agency audit follow-up official and strengthens procedures for audit resolution and follow-up. e. DOE O 221.3, Establishment of Management Decisions on Office of Inspector General Reports, which establishes the responsibilities and requirements for management decisions on Office of Inspector General audit and public inspection reports. f. DOE 2340.1C, Coordination of General Accounting Office Activities, dated 6-8-92, which prescribes policies, responsibilities, and procedures for the coordination of GAO activities and actions required when GAO reports contain recommendations pertaining to the Department. 8. CONTACT. Requests for further information or assistance should be directed to the Office of the Director, Office of Management, Budget and Evaluation/Chief Financial Officer. BY ORDER OF THE SECRETARY OF ENERGY: KYLE E. McSLARROW Deputy Secretary DOE O 224.3 Attachment 1 1-24-05 Page 1 (and Page 2) PRIMARY DOE ORGANIZATIONS TO WHICH DOE O 224.3 IS APPLICABLE This Order applies to the Departmental organizations identified below and, by agreement, the National Nuclear Security Administration. Requirements of this Order also apply to the cognizant field activities of the primary organizations.

Office of the Secretary Office of the Chief Information Officer Office of Civilian Radioactive Waste Management Office of Congressional and Intergovernmental Affairs Office of Counterintelligence Departmental Representative to the Defense Nuclear Facilities Safety Board Office of Economic Impact and Diversity Office of Electric Transmission and Distribution Office of Energy Assurance Office of Energy Efficiency and Renewable Energy Energy Information Administration Office of Environment, Safety and Health Office of Environmental Management Office of Fossil Energy Office of General Counsel Office of Hearings and Appeals Office of the Inspector General Office of Intelligence Office of Legacy Management (Formerly Office of Worker and Community Transition) Office of Management, Budget and Evaluation/Chief Financial Officer Office of Nuclear Energy, Science and Technology Office of Policy and International Affairs Office of Public Affairs Office of Science Secretary of Energy Advisory Board Office of Security and Safety Performance Assurance Bonneville Power Administration Southeastern Power Administration Southwestern Power Administration Western Area Power Administration 1. OBJECTIVES 2. CANCELLATIONS 3. APPLICABILITY a. Primary DOE Organizations and the National Nuclear Security Administration (NNSA) b. Site/Facility Management Contractors c. Exclusions 4. REQUIREMENTS a. Audit Resolution and Follow-up Program b. Audit Reports c. Departmental Audit Report Tracking System d. Departmental Internal Control and Audit Review Council (DICARC) 5. RESPONSIBILITIES a. Departmental Internal Control and Audit Review Council b. Director, Office of Management, Budget and Evaluation/Chief Financial Officer c. Inspector General d. Heads of Primary DOE Organizations and Cognizant Field Activities and the Associate Administrator for Management and Administration, NNSA 6. DEFINITIONS a. Assurance of Effectiveness of Corrective Actions Taken b. Audit c. Audit Follow-up Assessment d. Audit Report e. Audit Resolution f. Corrective Action Plan g. Inspection h. Management Decision i. Primary Action Activity (PAA) j. Questioned Cost k. Recommendation Secondary Action Activity (SAA) 7. REFERENCES 8. CONTACT ATTACHMENT 1. PRIMARY DOE ORGANIZATIONS TO WHICH DOE O 224.3 IS APPLICABLE