DOE O 224.3A, Audit Coordination, Resolution, and Follow-Up

AVAILABLE ONLINE AT: INITIATED BY: www.directives.doe.gov Office of Chief Financial Officer U.S. Department of Energy ORDER Washington, DC Approved: 10-22-2020 SUBJECT: AUDIT COORDINATION, RESOLUTION, AND FOLLOW-UP 1. PURPOSE. a. Establish policies, procedures, and responsibilities for the coordination of audit activities with the Office of Inspector General (OIG) and the Government Accountability Office (GAO). This order does not establish requirements relating to cooperation with the OIG; OIG access rights to Department of Energy (DOE) records, facilities, and personnel; or other OIG authorities. Department of Energy (DOE) O 221.2, Cooperation with the Office of Inspector General, current version, addresses Departmental requirements for cooperation with the OIG and OIG authorities. The OIG is the Office of Primary Interest for DOE O 221.2. b. Establish policies, procedures, and responsibilities for responding to draft and final OIG and GAO audit reports. c. Establish an audit follow-up program for OIG and GAO audits in accordance with Office of Management and Budget (OMB) requirements in OMB Circular A-50, Audit Follow Up, and other references cited in section 7 of this Order. 2. CANCELS/SUPERSEDES. This Order supersedes DOE O 224.3, Audit Resolution and Follow-up Program, dated 1-24-05; and cancels DOE O 2340.1C, Coordination of General Accounting Office Activities, dated 6-8-92, and DOE O 221.3A, Establishment of Management Decisions on Office of Inspector General Reports, dated 4-19-08. Cancellation of a directive does not, by itself, modify or otherwise affect any contractual or regulatory obligation to comply with the directive. 3. APPLICABILITY. a. Departmental Elements. (1) This Order applies to each DOE Departmental Element, including the Power Marketing Administrations and the National Nuclear Security Administration (NNSA). (2) This Order does not apply to the Federal Energy Regulatory Commission (FERC), an independent commission. (3) The Administrator of the National Nuclear Security Administration (NNSA) must require NNSA employees to comply with the employee responsibilities outlined in this directive. Nothing in this directive will be construed to interfere with the NNSA Administrator’s authority under DOE O 224.3A http://www.directives.doe.gov/ 2 DOE O 224.3A 10-22-2020 section 3212(d) of Public Law (P.L) 106-65 to establish NNSA-specific policies, unless disapproved by the Secretary. b. Contractors. This Order does not apply to contractors. Departmental Elements are responsible for providing GAO with access to contractor information and personnel consistent with contract requirements. Contractors are required to provide access to information and personnel in support of GAO audits by applicable contract provisions, including Federal Acquisition Regulation (FAR) 52.215-2 (48 CFR 52.215-2), Audit and Records—Negotiation, and Department of Energy Acquisition Regulation (DEAR) 970.5204-3 (48 CFR 970.5204-3), Access to and Ownership of Records, or successor provisions. c. Equivalencies and Exemptions for DOE O 224.3A . Requests for equivalencies and exemptions to this Order should follow the process outlined in DOE O 251.1, Departmental Directives Program, current version. (1) Exclusions. This Order excludes: (a) Audits of contracts or grants requested by contracting officers. (b) Audits of financial assistance awards performed in accordance with the Single Audit Act and the Uniform Financial Assistance Guidance (2 CFR 200) and DOE financial assistance regulations (2 CFR 910).

(c) Audits of subcontracts performed by DOE management and operating contractors. (d) OIG reports requiring immediate delivery to the Secretary regarding “particularly serious or flagrant problems, abuses, or deficiencies relating to the administration of programs and operations” in accordance with the provisions of the Inspector General Act of 1978; as amended, 5 United States Code (U.S.C), Appendix 3, section 5(d). (e) OIG investigations. (f) OIG activities that do not result in published reports. (g) GAO contract bid protests. (h) GAO audits of DOE OIG activities. (i) Whistleblower disclosures protected by 5 U.S.C. 2302, or other applicable statutes. (2) Equivalency. In accordance with the responsibilities and authorities assigned by Executive Order 12344, codified at 50 sections 2406 and 2511 DOE O 224.3A 3 10-22-2020 and to ensure consistency through the joint Navy/DOE Naval Nuclear Propulsion Program, the Deputy Administrator for Naval Reactors (Director) will implement and oversee requirements and practices pertaining to this Directive for activities under the Director's cognizance, as deemed appropriate. d. GAO Assessment Reports. The Department will treat GAO assessment reports and GAO audit reports in the same manner. e. OIG Inspection Reports. The Department will treat published OIG inspection reports and OIG audit reports in the same manner. 4. REQUIREMENTS. a. Audit Coordination. (1) Responsible Offices for Audit Coordination. Responsible offices for audit coordination are offices that perform audit coordination, resolution, and follow-up responsibilities as described in this Order. Each Departmental Element will designate a responsible office for audit coordination. Site and field offices may serve as a responsible office for audit coordination when designated by the cognizant Headquarters Departmental Element. (2) Designating an Audit Coordinator for DOE Offices. The Head of the Departmental element will assign an audit coordinator for each responsible office for audit coordination. The audit coordinator has responsibility for coordinating the audit process from initiation of the audit to completion of corrective actions. Key audit coordinator responsibilities include: (a) Serving as the primary liaison with the GAO audit team or the OIG audit or inspection team during audit engagements; scheduling interviews and site visits; and providing documents to the auditors as requested. (b) Coordinating with supporting offices or other offices on audit matters as needed. (c) Coordinating responses and comments to audit reports. (d) Providing approved status updates on audit recommendations for incomplete corrective actions in the Departmental audit follow-up system. The designation of an audit coordinator does not affect the OIG’s statutory authority to directly meet with or obtain information and documentation directly from DOE and contractors as discussed in DOE O 221.2, current version. 4 DOE O 224.3A 10-22-2020 As appropriate, the Head of the Departmental Element, the cognizant Under Secretary, or the Deputy Secretary may designate an individual to serve as the audit coordinator for a specific audit. The OCFO shall be notified when such designations are made.

(3) Lead and Supporting Offices for Audit Engagements. The Office of the Chief Financial Officer (OCFO) will designate a lead office for each audit engagement. The lead office is responsible for coordinating OIG or GAO requests for documents and information, scheduling requested meetings, and also coordinating site visits. The OCFO may also designate supporting offices for audits involving multiple offices. Supporting offices coordinate closely with the lead office during the audit, and must provide the lead office with any documents provided to the auditor. (4) Coordination of Audit Activities with GAO. Note: Provisions of this section pertain to GAO Audits. Requirements relating to cooperation with the Office of Inspector General are discussed in DOE O 221.2, current version. (a) General Requirements. GAO is an agency of the legislative branch of the Federal Government with the statutory authority to conduct independent surveys, reviews, studies, and audits of the activities of Federal agencies, including DOE. Consistent with applicable laws, Departmental Elements will make available the appropriate staff and contractors for meetings and discussions with GAO audit team(s) and provide GAO audit team(s) access to documents or other requested information needed to perform audit functions. The provision of documents and other information to GAO and scheduling of meetings with GAO staff must be coordinated with the appropriate designated audit coordinator. The Head of the Departmental Element, the cognizant Under Secretary, or the Deputy Secretary may specify the appropriate individuals for meetings and discussions requested by GAO. (b) Designating Attorneys for GAO Audit Engagements. The Office of General Counsel (OGC) designates attorney(s) to assist with GAO audits, as appropriate. The designated attorney(s) facilitate OGC review of sensitive documents and other information (see paragraph (e) of this section) before providing to GAO, and will coordinate the internal OGC review of the responses to GAO reports. As appropriate, the designated attorney(s) shall also provide other assistance and counsel to the audit coordinator and DOE management officials during the audit engagement. NNSA and the Bonneville Power Administration (BPA) will designate an attorney, as appropriate, when NNSA or BPA is the lead office. DOE O 224.3A 5 10-22-2020 (c) Entrance and Exit Conferences. GAO schedules entrance conferences with DOE when initiating the start of an audit engagement. GAO schedules exit conferences after they have completed their audit work and have provided a Statement of Facts or other preliminary draft document to DOE. The audit coordinator is responsible for scheduling the entrance and exit conferences. The appropriate management officials for the lead office must attend the entrance and exit conferences. The OCFO, supporting offices, and the designated attorney should be invited to entrance and exit conferences. The Head of the Departmental Element, the cognizant Under Secretary, or the Deputy Secretary may specify the individuals to be included in GAO entrance and exit conferences.

(d) Role of the Audit Coordinator. The audit coordinator is responsible for coordinating the entire audit process, from initiation of the audit to completion of any agreed-upon corrective actions. The audit coordinator for the lead office serves as the primary liaison between the Department (including Departmental contractors) and the GAO audit team(s) during the audit engagement. The audit coordinator is also responsible for retaining copies of documents provided to GAO during the audit; coordinating the legal review of sensitive documents or other information by the designated attorney; and ensuring that draft audit reports discussing classified or Unclassified Controlled Nuclear Information subject matters receive classification and UCNI reviews by the appropriate authorities. The audit coordinator for the supporting office assists in scheduling interviews with officials from the supporting office, and providing documents requested from the supporting office. Information provided to GAO must also be provided to the lead office. Detailed requirements for Audit Coordinators are listed in section 5.d. of this order. (e) Provision for Sensitive Documents and Other Information Requiring Legal Review prior to Release to GAO. The audit coordinator must provide sensitive documents as described in this section to the designated attorney for legal review and must handle the documents in accordance with guidance provided by the designated attorney. Sensitive documents include: 1 Information that would be withheld under a Freedom of Information Act (FOIA) request, including trade secrets and commercial or financial information that is obtained from a person and is privileged or confidential; inter- 6 DOE O 224.3A 10-22-2020 agency or intra-agency memoranda or letters; attorney- client privilege information; attorney work products; draft or pre-decisional documents; personnel and medical files and similar files, the disclosure of which would constitute an unwarranted invasion of personal privacy; and investigatory records or information compiled for law enforcement purposes. 2 Personally Identifiable Information (PII) and other information designated as Controlled Unclassified Information. 3 Requests for documents involving communications with White House or OMB officials. 4 Information that might affect or relate to litigation. 5 Proprietary corporate information. 6 Documents provided to DOE by a foreign government or international organization. If the foreign government or international organization provided the documents with the expectation of confidentiality, a review by the Office of Classification is also required. (f) Document and Information Requests to Refer to OCFO. The following requests should be referred to the OCFO for a Departmental response or appropriate coordination. 1 Pre-decisional budget documents. 2 Financial reports and information obtained from the Department’s accounting system. (g) Requests for Classified Information. Refer requests for classified information to the Departmental Element responsible for the requested information. (h) Requests for Unclassified Controlled Nuclear Information (UCNI). Refer requests for UCNI to the Departmental Element responsible for the requested information. (i) Requests for Non-public Documents Originating from Other Agencies. Refer GAO requests to DOE for non-public documents that originated from another Federal agency, to the originating agency for a determination regarding the document(s).

DOE O 224.3A 7 10-22-2020 (j) GAO Surveys and Questionnaires. GAO frequently uses surveys and questionnaires to ask for DOE input on specific matters relating to GAO audits and reviews. When GAO plans to report the responses to surveys and questionnaires as responses by DOE, OCFO must be provided the opportunity to review proposed responses to ensure appropriate coordination and management review. (k) Resolving Questions Regarding GAO Audit Engagements. Questions regarding the provision of sensitive documents must be referred to the designated attorney; other questions should be referred to the OCFO. b. Audit Resolution and Responding to Audit Reports. (1) Lead Office for Report Responses. OCFO designates the Departmental Element(s) responsible for responding to draft and final audit reports. This is generally the Departmental Element responsible for responding to the largest number of report recommendations or the office with program or functional responsibility for the program that is the focus of the audit. The OCFO will serve as the lead office for Department-wide audits or when no other office has programmatic responsibility for the matter(s) under review. (2) Supporting Offices for Report Responses. OCFO designates other supporting offices that must approve the response. The Director, Audits and Internal Affairs (AIA), or successor position, designates NNSA offices that review and approve NNSA audit responses. The Director, AIA, or successor position, will coordinate with the OCFO as necessary for audits involving DOE elements. (3) Protecting Pre-Decisional Audit Reports. Draft OIG and GAO audit reports are pre-decisional documents provided by the auditor for review and comment by Departmental management. Report distribution is on a- need-to-know basis and public release of the report is prohibited. DOE contractors may receive draft reports or portions thereof on a need-to- know basis. DOE offices are responsible for the protection of draft report content (including contractor protection of the draft report content) consistent with the protection(s) used by the OIG or GAO when transmitting the report. Recipients of FOIA requests or requests for copies of draft reports must refer the requests to the OIG or GAO. (4) Corrective Action Plans. Corrective action plans should address the root cause of the audit finding. Planned corrective actions should provide 8 DOE O 224.3A 10-22-2020 reasonable assurance of preventing or detecting recurrence of the audit finding. Corrective action plans must include a timeline for completion of the corrective actions and designate responsibilities for implementing the plan. Corrective actions for issues identified by auditors should not be delayed until issuance of a draft or final audit report. As appropriate, management should begin corrective actions when management agrees with concerns identified by the auditor during the course of the audit but prior to issuance of a draft or final report. The response to the audit report should note key corrective action plan information including the planned actions, timelines for completion, and the management official or office responsible for implementing the corrective action plan. Management officials should develop more detailed implementation plans as needed to support completion of the planned corrective actions. After approval, corrective action plans and milestone dates may be amended through an approved quarterly status update (see section 4.c.(5) of this policy).

(5) Departmental Element Approval for Responses to Audit Reports. Responses to draft and final audit reports must be approved and signed by the Head of the Departmental Element preparing the response. This may be delegated for responses to OIG reports at the discretion of the Departmental Element. (6) Form and Content of Responses. The OCFO provides current guidance on the form and content of audit report responses. (7) Specific Requirements for Responding to GAO Reports. (a) GAO Statements of Fact and Other Draft Work Products. GAO may provide the Department with a statement of facts, draft presentations or testimonies intended for Members of Congress, or other draft work products for review and comment. The lead office is responsible for providing any necessary technical or factual comments on the draft documents, in coordination with supporting offices, and obtaining a classification review for draft work products in a classified or Unclassified Controlled Nuclear Information subject matter. Comments may be provided verbally at the exit conference or in writing, at the discretion of the lead office. Written comments for non-NNSA audits should be provided to OCFO for review. DOE O 224.3A 9 10-22-2020 For NNSA audits, comments on the statement of facts and other draft work products are coordinated through NNSA AIA. For NNSA audits that also involve DOE elements, NNSA AIA will coordinate proposed comments with the OCFO and supporting offices. (b) GAO Draft Reports. DOE will respond to each draft report with recommendations to the Secretary and perform a classification review for draft reports in a classified or Unclassified Controlled Nuclear Information subject matter. 1 Due Dates. GAO generally provides 30 calendar days for a response. OCFO provides specific timelines for the preparation and coordination of the response to each audit report consistent with the amount of time provided by GAO for comments. Requests to GAO for additional time to respond to the report should be the exception and must be made by OCFO or NNSA AIA, or successor position, as applicable. GAO is not required to grant additional time for a response and GAO can issue the final report without DOE’s input. 2 Departmental Approval and Signature. The CFO reviews the response for transmittal to GAO on behalf of the Secretary. Responses are signed by the head of the Departmental Element for the lead office. OCFO coordinates approval of the response with Office of the Executive Secretariat as appropriate. The NNSA Director AIA, or successor position, approves or disapproves responses for the Administrator’s signature when NNSA is the lead office. A copy is to be provided to OCFO. 3 Recommendations Made Jointly to DOE and Other Agencies. When GAO makes joint recommendations to DOE and other agencies, the lead office should coordinate with the other agencies to determine if there is general agreement among the agencies regarding a response to the recommendation. The lead office should inform the OCFO and supporting offices if a planned response to a recommendation conflicts with the planned response of other agencies, and the reason(s) for the disagreement when providing the proposed response for review. 4 Reports without Recommendations. GAO provides draft reports to DOE for review and comment that do not have 10 DOE O 224.3A 10-22-2020

recommendations to DOE. No formal response or comments are required for such reports. The lead office may provide technical and general comments or may choose to provide a formal response intended for publication in the final report. Technical and general comments must be reviewed by OCFO, and formal responses must follow the standard Departmental approval process. (c) GAO Final Reports. When GAO issues final reports with recommendations to the Secretary (or “head of the agency” as specified by statute), the Department “shall submit a written statement (response) on action(s) taken or planned on the recommendation” to relevant Congressional committees (31 U.S.C. 720). The OCFO maintains the current list of recipients, in consultation with the Office of Congressional and Intergovernmental Affairs. The response constitutes the Department’s management decision regarding corrective actions and satisfies the requirements for audit resolution outlined in OMB Circular A-50. No response is required for GAO final reports that do not have recommendations to DOE. 1 Due Dates. The response should be approved and transmitted within 90 calendar days of the date of the final report, unless additional time is granted by OCFO in response to a written request for an extension. OCFO provides specific timelines for the preparation and coordination of each audit report. As specified by the Good Accounting Obligation in Government Act (known as the GAO-IG Act) (P.L. 115- 414), agency responses to GAO final reports must be provided to Congress no later than 180 calendar days after issuance of the report. 2 Departmental Approval and Signature. The CFO reviews the response for transmittal to the relevant Congressional committees on behalf of the Secretary. Responses are signed by the head of the Departmental Element for the lead office. OCFO coordinates approval of the response with Office of the Executive Secretariat as appropriate. The NNSA Director AIA, or successor position, approves or disapproves responses for the Administrator’s signature DOE O 224.3A 11 10-22-2020 when NNSA is the lead office. A copy is to be provided to OCFO. 3 Recommendations Made Jointly to DOE and Other Agencies. If disagreements persist between DOE and other agencies on implementation of joint recommendations, the lead office must note the reason(s) for the disagreement when providing the proposed response to the OCFO and other concurring offices. (8) Specific Requirements for Responding to OIG Reports. (a) OIG Preliminary Draft Reports. OIG may provide the Department with a preliminary draft report for review and discussion. The lead office is responsible for providing any necessary technical or factual comments on the draft documents, in coordination with supporting offices. Comments may be provided verbally at a meeting or in writing prior to the meeting. OCFO or NNSA AIA will coordinate with lead offices on written comments to preliminary reports as needed. If responsible management officials disagree with the facts or conclusions in a preliminary draft report, the management officials should fully explain the reasons for disagreement and present applicable supporting documentation or other factual support. OIG will consider management’s comments on the preliminary draft report, as well as any additional facts and documentation provided, make changes as appropriate, and issue an official draft report for formal comment.

(b) OIG Draft Reports. The Department will respond to each draft OIG report with recommendations that are provided for review and comment. 1 Due Dates. The OIG normally provides at least 15 business days for management to review and comment on draft reports. Requests for extensions should be in writing and directed to the official designated by the OIG. The request must include the reason for the request and projected delivery date. Offices must notify the OCFO of any extensions to the comment period. 2 Content of the Response. The response should clearly indicate the Departmental Element’s agreement or disagreement with the report’s findings and recommendations. When concurring with the 12 DOE O 224.3A 10-22-2020 recommendations, the response should describe the planned corrective actions and provide estimated completion date for those actions. When agreeing with the report findings while disagreeing with specific recommendations, the response should explain reasons for the disagreement and describe any planned alternative corrective actions. 3 Approval. The response must be approved by the head of the Departmental Element designated to respond to the report, or delegated official. 4 Exit Conferences. After receiving the Department’s response and before the release of the final report, the OIG generally provides the opportunity for a formal exit conference to discuss the disposition of the Department’s comments. 5 Reports without Recommendations. There is no requirement to respond to IG reports that do not contain recommendations. However, there may be instances where a response is beneficial and desired. Departmental Elements should coordinate with their respective DOE or NNSA audit office for a final decision on whether to respond to reports with no recommendations. (c) OIG Final Reports. 1 Acceptance of the Management Response to the Draft Report as a Management Decision. A management decision is the official position taken by a program or functional management official on the unresolved findings and recommendations contained in a final OIG report. The purpose of the management decision is to specify the actual or planned corrective actions. The OIG may choose to accept the response to the draft report as the Department’s management decision for that report. 2 Separate Management Decisions. When the OIG does not accept the response to the draft report as the management decision, management must prepare a separate management decision for the recommendations in the final report. a Due Dates. Management decisions should be provided to the OIG within 90 calendar days of issuance of the final report. OCFO provides specific timelines for the preparation and coordination of each management decision. DOE O 224.3A 13 10-22-2020 b Review, Approval, and Signature. The DOE CFO serves as the DOE Audit Follow-up official and works to resolve disagreements between the OIG and the Department. The CFO reviews, signs, and transmits management decisions to the OIG. The cognizant Under Secretary (if applicable) approves or disapproves the management decisions for non- NNSA audits. Management decisions for Departmental Elements reporting directly to the Deputy Secretary are approved or disapproved by the Head of the Departmental Element. For NNSA audits, the Director AIA, or successor position, reviews and approves or disapproves the management decision for signature by the NNSA Administrator, coordinating with the OCFO for audits that involve DOE elements. NNSA will provide a copy of the management decision to OCFO.

For BPA audits, the BPA Administrator and cognizant Under Secretary reviews and approves or disapproves management decisions, coordinating with the OCFO for audits that involve DOE elements. The BPA Administrator signs the management decision. BPA will provide a copy of the management decision to OCFO. c Resolution of disagreements. The Inspector General may refer disagreements regarding management decisions to the Deputy Secretary. (d) Potential Cost Avoidance Identified by the OIG. To satisfy reporting requirements in the Inspector General Act, the response must state management’s agreement or disagreement with any cost avoidance amounts identified by the OIG, explaining the reasons for any disagreement. (The term cost avoidance, as used in this Order, is synonymous with “funds put to better use” referenced in the Inspector General Act.) Program and functional management should consult with the OIG to understand the methodology used to calculate cost avoidance amounts if necessary. Supporting offices must advise the lead office of the supporting office’s agreement or disagreement with any cost avoidance amounts that relate to the supporting offices. 14 DOE O 224.3A 10-22-2020 c. Audit Follow Up. (1) Management Responsibility. Responsibility for effective audit follow-up rests with the head of the DOE organization. Resolution of GAO and OIG audits is an important element of the Department’s management system, consistent with the requirements of OMB Circular A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control (07- 15-2016), the GAO Standards for Internal Control in the Federal Government (the GAO Green Book), and OMB Circular A-50, Audit Follow Up. Consistent with OMB Circular A-123, section II (D) and the Department’s current internal controls guidance, offices should consider audit findings when assessing risks and evaluating internal controls. (2) Role of the Audit Follow-up Official. OMB Circular A-50 requires the CFO, as the DOE Audit Follow-up official, to monitor the completion of corrective actions. Audit follow-up activities cease when the actions meet the closure requirements specified in this Order. (3) Assignment of Audit Recommendations for Follow-up. The OCFO determines which offices have required follow-up actions relating to audit reports. The OCFO assigns follow-up actions based on the Department’s management decision. When the approved management decision states that corrective actions are completed or unnecessary, the audit report is closed upon issuance of the management decision and there is no formal follow-up process for that report. (4) Departmental Audit Follow-up System. The OCFO maintains the Department’s audit follow-up system as required by OMB Circular A-50. The system tracks audit recommendations and questioned costs identified in audit reports until corrective actions are completed. (5) Required Status Updates. Departmental offices must provide quarterly status updates to the OCFO through the Departmental audit follow-up system on open recommendations (recommendations with planned corrective actions not yet completed) and unresolved questioned costs. (a) Form and Content of the Status Updates. The status updates must contain the status of corrective actions, including a description of progress made and an explanation for any delays in completing the corrective actions. Updates should be understandable to a non- technical expert, define any acronyms, and omit references to prior updates.

(b) Comments by the OIG on Audit Status Updates. Each quarter the OIG reviews the quarterly status updates and may provide comments regarding the audit team’s evaluation of the status of the DOE O 224.3A 15 10-22-2020 corrective actions. Offices should address the OIG’s prior quarter comments, if any, when providing the quarterly status update and closing recommendations. The CFO will resolve, as needed, substantial disagreements between the OIG and the office assigned, consistent with CFO responsibilities as the Audit Follow- up official. (c) Approval of Status Updates. The head of the Departmental Element or a designated management official must approve quarterly status updates. The OCFO retains records of the approvals made, as well as records of delegations of authority to approve the quarterly updates. (6) Recording Completion of Corrective Actions. Departmental offices must report completion of planned corrective actions quarterly in the Departmental audit resolution system. When corrective actions are complete, the quarterly status update must: (a) Provide a summary of actions taken in accordance with the corrective action plan. This final narrative for the closed corrective action plan must be complete, without referencing prior updates, and address the corrective action plan to document closure. (b) Explain the reasons for any alternate actions taken instead of the original corrective action plan. (c) Describe the status of any questioned cost amounts, if applicable. The status update should describe: 1 the total amount questioned, 2 the total amount pending an allowability determination; and 3 the amount for which an allowability determination has been made. When an allowability determination has been made, the status update should specify the amounts determined to be allowable or unallowable by the Contracting Officer. A record of the allowability determinations made by the Contracting Officer should be included in the Department’s audit resolution system. (d) Identify the official approving the closure of the audit recommendation. 16 DOE O 224.3A 10-22-2020 (e) As appropriate or when requested by OCFO, upload relevant documents demonstrating the completion of corrective actions in the audit follow-up system. (7) GAO Review of Corrective Actions. GAO reviews the status updates describing the completed corrective actions and indicates whether the completed corrective actions address audit recommendations. As a result of this review, GAO characterizes each recommendation on the GAO website as either open, or closed-implemented or closed-not implemented. As the DOE Audit Follow-up official, the CFO may consider GAO’s review of the corrective actions and may reopen recommendations in the DOE audit follow-up system after consultation with the relevant DOE offices. CFO makes the final determination on closure of the GAO reports. (8) OIG Review of Corrective Actions. The OIG reviews the status updates describing the completed corrective actions and indicates agreement or disagreement that the corrective actions have been completed. OIG agreement that planned corrective actions were taken does not necessarily reflect a determination that the corrective actions effectively addressed the underlying audit finding. OIG may perform follow-up audits, at its discretion, to assess the effectiveness of corrective actions.

When the OIG indicates corrective actions have not been completed or otherwise fail to address the OIG’s recommendations, DOE management should address the OIG’s concerns in subsequent quarterly status updates. The status updates should also document any additional corrective actions taken in response to OIG comments. In the case of disagreements between the OIG and the Department, the CFO determines closure of the report. (9) Timeframe for Audit Closure. The target dates in the management decision determine the expected closure date of an audit report. The Departmental Element must provide written justification and updated target completion dates when corrective actions are not completed by the expected completion dates stated on the management decision. CFO will notify DOE offices when target completion dates have not been met and new target completion dates need to be provided. (10) Criteria for Audit Closure. OCFO records closure of OIG and GAO audits upon completion of the corrective action plan and upon finalization of allowability determinations on any questioned costs identified by the audit. For OIG audits, closure will not occur until OIG comments are considered. DOE O 224.3A 17 10-22-2020 (11) Resolution of Questioned Costs. The cognizant Contracting Officer must resolve contract and financial assistance costs questioned by the OIG before the audit report can be closed. Questioned costs are resolved when the Contracting Officer has made a final determination on the allowability of the questioned costs. (12) Supplemental Reporting on Recoveries of Disallowed Costs. After audit closure, offices must report actual collections of disallowed costs, costs deemed to be allowable after appeal, and amounts later determined to be uncollectible. The Inspector General Act requires this information for reporting purposes. To the extent practical, CFO will satisfy this reporting requirement through the existing improper payment reporting process. d. Annual Audit of the Department’s Consolidated Financial Statements. (1) Background. The CFO Act requires an annual audit of the Department’s financial statements and systems that support financial reporting. OMB Bulletin 14-02, Audit Requirements for Federal Financial Statements, or successor policy, describes in detail the requirements for financial statement audit. (2) Review of Proposed Findings before Issuance by the Auditor. The auditor may provide management an opportunity to provide informal comments on a proposed finding before issuance. To provide a consistent departmental approach, management should coordinate informal comments with the Office of Finance and Accounting (for financial reporting findings) and the Office of Corporate Information Systems (for financial management system findings). (3) Responses to Financial Statement Audit Findings and Recommendations. The OIG provides notice of an audit finding to management for review and response throughout the course of the audit, and management provides responses to the findings and associated recommendations as recommendations are issued. (a) Form and Content of the Responses. The management response must agree or disagree with the finding and describe planned corrective actions. 1 When agreeing (concurring) with the finding, the response must also address associated recommendations. If management agrees with (concurs with) a recommendation, the response must describe planned corrective actions and the timeline for completing corrective actions. The corrective action plan should address the underlying cause of the audit finding.

18 DOE O 224.3A 10-22-2020 2 When disagreeing (non-concurring) in whole or in part with a recommendation, the response must explain the reason(s) for the disagreement and any alternative corrective actions planned or undertaken that are relevant to any portion of the recommendation with which the office agrees. 3 There is a short time frame for responding to financial statement findings; management may provide an initial corrective action plan as part of the response and develop a more detailed plan for later action as appropriate. The Department’s audit resolution system must reflect management’s revision or approval of corrective action plans. (b) Responsibility for Preparing the Management Response. 1 Findings that Relate to Financial Reporting. The program or functional office with direct responsibility for a finding drafts and the management official responsible for that office signs the management response. The CFO Office of Finance and Accounting drafts and signs management responses for findings relating to the OCFO’s direct responsibilities. 2 Findings that Relate to Financial Management Systems. The program or functional office with direct or oversight responsibility for the affected system(s) drafts the management response; concurrence with the response within that office should follow the signing office's procedures. (c) Reviewing the Management Response. 1 Findings that Relate to Financial Reporting. The DOE CFO Office of Finance and Accounting reviews management responses before finalization. 2 Findings that Relate to Financial Management Systems. The DOE CFO Office of Corporate Business Systems (CF- 40) reviews management responses before finalization. (d) Timing of the Management Response. The program or functional office will provide responses to individual findings within the time frame requested by the OIG. (e) Corrective Actions for Financial Statement Audit Findings. Offices shall begin implementing and tracking corrective actions as soon as the response to a formal audit finding, which includes a DOE O 224.3A 19 10-22-2020 commitment to correct the issue, is signed by the responsible office(s). Actions should not be delayed pending inclusion of final findings in the formal management letter. Offices shall provide quarterly status updates until completion of corrective actions. (f) Reissued Findings. The auditor will evaluate prior-year findings in the current year audit. The auditor may reissue a prior-year audit finding if the auditor determines the finding still requires corrective action. Quarterly status updates shall continue (or resume) for reissued findings. (g) Closure of Prior-Year Financial Statement Audit Findings. The Department may close a prior-year financial statement audit finding and associated recommendation(s) if the auditor determines the finding closed, i.e., the auditor has completed the audit work for the current year without issuing a repeat finding. (h) The DOE Annual Financial Report (AFR). The AFR includes the DOE financial statements, which are the representation of management, and the OIG’s Independent Auditor’s Report, which provides the audit opinion on the DOE financial statements as required by the CFO Act. The OCFO coordinates and completes the preparation of the AFR in accordance with the requirements of OMB Circular A-136, Financial Reporting Requirements.

(i) Management Letter. To close the financial statement audit, the OIG provides a management letter to the Department that transmits the final audit findings and recommendations. Final audit findings and recommendations included in the management letter will be updated quarterly until closed [see paragraph 4.h.(4)]. 5. RESPONSIBILITIES. a. DOE Chief Financial Officer. (1) Leads the Department’s audit resolution program and advises the Secretary and Departmental senior leadership of significant audit issues. (2) Leads Departmental coordination with the OIG and GAO and assists offices with ongoing audit engagements as needed. Within NNSA Director, AIA, leads coordination with the OIG and GAO and assists offices with ongoing audit engagements as needed. (3) Serves as the Agency’s Audit Follow-up Official, as defined by OMB Circular A-50, Audit Follow-Up. 20 DOE O 224.3A 10-22-2020 (4) Provides reports on the status of audit recommendations as required, including reports required by the Good Accounting Obligation in Government Act (known as the GAO-IG Act, P.L. 115-414). (5) Collaborates with the OIG to meet reporting requirements contained in the Inspector General Act. (6) Designates the lead office and supporting offices, as needed, for audit engagements and notifies the relevant Departmental Elements of audit starts and audit reports. As necessary, coordinates the Department’s responses to audit reports affecting one or more Departmental Elements and resolves any substantive disagreements on the responses. (7) Reviews the Department’s responses to GAO draft reports, GAO final reports, and OIG final reports on behalf of the Secretary (for elements other than NNSA and BPA). As necessary, coordinates Departmental responses to informal reports and presentations provided by the OIG and GAO for Departmental comment. (8) Maintains the Department’s audit resolution system and tracks the closure of GAO and OIG audit reports. (9) Reviews quarterly status reports and assesses the timeliness and responsiveness of milestones established and corrective actions taken or planned. As necessary, provides reports to senior Departmental managers on significant audit follow-up issues. b. Director, Audits and Internal Affairs, NNSA (or successor position). (1) Leads audit coordination, resolution, and follow-up activities for NNSA. (2) Coordinates with the DOE OCFO and other DOE offices on audit matters as required. (3) Approves responses to OIG and GAO draft and final reports for NNSA related audits, consistent with current NNSA policy and delegations, and provides copies to OCFO. c. Heads of Departmental Elements. (1) Maintain overall management authority for coordinating audit activity affecting the Departmental Element. (2) Provide quarterly reporting on the status of open audit recommendations and completion of corrective actions to the OCFO through the DOE Audit Follow-up system. DOE O 224.3A 21 10-22-2020 (3) Provide the OCFO information as needed to meet required internal and external reporting of the status of audit reports and audit recommendations. (4) Confirm that audit resolution activities are compliant with established audit resolution requirements and processes. (5) Review and approve responses for assigned audit reports. (6) Designate an audit coordinator for the DOE element and, if applicable, approves the designation of audit coordinators for site and field offices responsible audit offices, if applicable.

(7) Consider audit findings when identifying risks for the organization’s internal controls testing and evaluation in accordance with the Department’s internal control guidance. (8) Provide annual certification, or current organizational policy, to the OCFO of: (a) any field or site office designated as a responsible audit office; (b) designated audit coordinators for responsible audit offices; (c) management officials responsible for approving quarterly status updates on open audit recommendations; (d) management officials designated authority to approve closure of audit recommendations; and (e) designated officials for approving audit responses and management decisions for the Departmental Element. (9) When designated as a supporting office: (a) Coordinate with lead offices in providing requested information and documentation to GAO or OIG and provides lead offices with copies of documents sent to GAO. (b) Review and provide concurrence on responses to audit reports within established timeframes. (c) Write the response to a recommendation assigned to the supporting office by GAO or OIG. d. Audit Coordinator(s). (1) Serve as the primary liaison with the audit team during audit engagements with responsibility for scheduling interviews, scheduling site visits, and 22 DOE O 224.3A 10-22-2020 coordinating timely response to auditors’ requests for information and documents. (2) Transparently keeps Heads of Departmental Elements informed of activities and decisions relating to ongoing audit engagements, as appropriate. Provide advance notification of sensitive issues that may be included in audit reports to OCFO and senior management. (3) Coordinate with other DOE offices as needed during the course of an audit and refer significant disagreements or concerns relating to ongoing audit engagements to the OCFO for resolution. (4) For GAO Audits, coordinate the legal review of sensitive documents and other information by the designated attorney and handles sensitive documents and other information in accordance with guidance provided by the designated attorney. (5) Retain copies of documents and other information provided to GAO. (6) Coordinate responses to informal reports and presentations provided by the OIG and GAO with supporting offices. (7) Assist in drafting responses to OIG preliminary draft reports, GAO statements of fact, informal reports, questionnaires, presentations, draft and final audit reports and coordinate responses with supporting offices as appropriate. (8) Provide responses to OIG preliminary drafts, GAO statements of fact, draft reports, final reports, informal reports, questionnaires, and presentations for review and concurrence by the Under Secretary, the Office of General Counsel (OGC), the Office of Congressional and Intergovernmental Affairs (CI), and the Office of Public Affairs (PA) in accordance with the requirements of DOE O 224.3A. (9) Obtain concurrence of the OCFO on responses to draft GAO reports, final GAO reports, and final OIG reports. (10) Provide quarterly status updates on audit recommendations for incomplete corrective actions and confirms the management official designated by the head of the Departmental Element approved the updates. e. Office of the Assistant Secretary for Congressional and Intergovernmental Affairs (CI). Review proposed Departmental responses to draft and final GAO reports as appropriate. For NNSA lead audits, the NNSA Office of External Affairs performs this function.

DOE O 224.3A 23 10-22-2020 f. Office of Public Affairs (PA) (or NNSA Office of External Affairs when NNSA is lead office). Review proposed Departmental responses to draft and final GAO reports as appropriate. g. Office of General Counsel (OGC) (or the NNSA or BPA Office of General Counsel when NNSA or BPA is the lead office). (1) Designate an attorney for GAO engagements. (2) Review written responses to GAO reports. (3) Review sensitive documents and other information from Departmental Elements and provides guidance regarding the proper handling of the information. h. Contracting Officers. (1) Resolve questioned costs identified by audits. (2) Provide information to the audit coordinator on the resolution of questioned costs as required to support quarterly reporting. i. Office of Classification. Provide classification and declassification services regarding GAO and OIG reports and related management comments. 6. DEFINITIONS. This Order defines most terms when first mentioned. a. Audit. As used in the order, includes non-audit surveys, attestation engagements, reviews, assessments, or studies performed by the OIG or GAO, including OIG inspections. An audit engagement is an announced audit. b. Cost avoidance. As used in the order, refers to amounts identified by an OIG “recommendation that funds be put to better use” as discussed in section 5 of the Inspector General Act. c. Departmental Element. Departmental Element, as used in this Directive, has the same definition as in DOE Order 251.1, Departmental Directives Program, current version. 7. REFERENCES. a. Public Law 95-452, Inspector General Act of 1978, dated 10-12-78, as amended by Public Law 100-504 and Public Law 110-409 (5 U.S.C). b. Public Law 96-226, the General Accounting Office Act of 1980, Title 1, as amended by Public Law 91-510, the Legislative Reorganization Act of 1970, Section 236 (31 U.S.C. 701-720). c. Public Law 101-576, Chief Financial Officers Act of 1990 (31 U.S.C. 901-903). 24 DOE O 224.3A 10-22-2020 d. Public Law 106-65, National Nuclear Security Administration Act, as amended, dated 10-5-99, (50 U.S.C. 2401). e. The Good Accounting Obligation in Government Act (known as the GAO-IG Act) (P.L. 115-414). f. 5 U.S.C. Section 552 and 5 U.S.C. Section 552a, the Freedom of Information Act and Privacy Act. g. 42 U.S.C. Section 7137, Functions of the Comptroller General, as specified in the Department of Energy Organization Act, Section 207. h. 10 CFR Part 1017, Identification and Protection of Unclassified Controlled Nuclear Information. i. OMB Circular No. A-50 (revised), Audit Follow-up, dated 9-29-82. j. OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control. k. OMB Bulletin No. 19-03, Audit Requirements for Federal Financial Statements, dated 08-02-19, or successor policy. l. GAO-19-55G, GAO's Agency Protocols, dated 8-27-19. m. DOE O 206.1, Department of Energy Privacy Program, current version. n. DOE O 221.2, Cooperation with the Office of Inspector General, current version. o. DOE O 251.1, Departmental Directives Program, current version. p. DOE O 471.1, Identification and Protection of Unclassified Controlled Nuclear Information, current version. q. DOE O 471.3, Identifying and Protecting Official Use Only Information, current version. r. DOE O 475.2, Identifying Classified Information, current version. s. DOE O 520.1, Financial Management and Chief Financial Officer Responsibilities, current version.

8. CONTACT. Address questions concerning DOE O 224.3A to the Office of the Chief Financial Officer, Office of Financial Policy and Audit Resolution. BY ORDER OF THE SECRETARY OF ENERGY MARK W. MENEZES Deputy Secretary 1.PURPOSE. 2. CANCELS/SUPERSEDES 3. APPLICABILITY a. Departmental Elements. b. Contractors c. Equivalencies and Exemptions for DOE O 224.3A d. GAO Assessment Reports e. OIG Inspection Reports 4. REQUIREMENTS. a. Audit Coordination. b. Audit Resolution and Responding to Audit Reports. c. Audit Follow Up. d. Annual Audit of the Department’s Consolidated Financial Statements. 5. RESPONSIBILITIES a. DOE Chief Financial Officer. b. Director, Audits and Internal Affairs, NNSA (or successor position). c. Heads of Departmental Elements. d. Audit Coordinator(s). e. Office of the Assistant Secretary for Congressional and Intergovernmental Affairs (CI). f. Office of Public Affairs (PA) (or NNSA Office of External Affairs when NNSA is lead office). g. Office of General Counsel (OGC) (or the NNSA or BPA Office of General Counsel when NNSA or BPA is the lead office). h. Contracting Officers. i. Office of Classification 6. DEFINITIONS a. Audit b. Cost avoidance c. Departmental Element 7. REFERENCES 8. CONTACT