Federal Communications Commission Washington, D.C. 20554 January 25, 2011 DA 11-128 Mr. Scott Barash Acting CEO Universal Service Administrative Company 2000 L Street, NW Washington, DC 20036 Dear Mr. Barash, With this letter, we direct the Universal Service Administrative Company (USAC) to take steps to implement the recommendations in the October 2010 U.S. Government Accountability Office Report, entitled, “Telecommunications: Improved Management Can Enhance FCC Decision Making for the Universal Service Fund Low-Income Program.” 1 We specifically direct USAC to take the steps described below to identify risks, strengthen internal controls, and improve the efficiency and effectiveness of administration for the low-income program. In its report, the GAO, among other things, recommends that, to improve management of the low- income program, the Commission should conduct a robust risk assessment of the low-income program and implement a systematic process for considering the results of eligible telecommunications carrier (ETC) audits and improper payment assessments in evaluating internal controls of the low-income program.2 We recognize and appreciate USAC’s efforts to date to improve the low-income program’s internal control structures through assessing risk in the program related to financial reporting and fraud. In addition to these efforts, as GAO recognized, the low-income program’s internal controls could be further improved by conducting a robust risk assessment that considers program vulnerabilities and associated consequences and identifies opportunities to mitigate those risks.3 Accordingly, we direct USAC to conduct a robust risk assessment consistent with GAO’s recommendations. These include GAO’s recommendation that the risk assessment be conducted under the procedures set forth in the November 1999 GAO Report entitled, Internal Control in Federal Government Report.4 This report establishes, among other things, three steps to conducting an effective risk assessment: · Objectives - establishing clear, consistent agency objectives as a precondition to effective risk assessment; · Identification of Risks - identifying relevant risks associated with achieving the objectives; and 1 Government Accountability Office, Telecommunications: Improved Management Can Enhance FCC Decision Making for the Universal Service Fund Low-Income Program, GAO-11-11 (Oct. 2010) (GAO Report). 2 GAO Report at 42. In addition to these recommendations, the GAO recommends that the Commission define specific performance goals of the program and subsequently develop quantifiable measures that can be used in determining the program’s success in meeting its goals. The GAO also recommends that, if the Commission establishes any pilot programs to examine funding broadband under the low-income program, the Commission first conduct a needs assessment and develop implementation and evaluation plans. Id. 3 GAO Report at 35. 4 GAO Report at 37, n. 96 (citing Government Accountability Office, Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 (Nov. 1999) (available at, http://www.gao.gov/archive/2000/ai00021p.pdf)). 2 · Analysis – analyzing those risks for their possible effect and remediation. Two well established goals of the low-income program are to: (1) ensure that telecommunications services are available to low-income customers at reasonable rates; and (2) protect the fund against waste, fraud, and abuse.5 Consistent with GAO’s guidelines and recommendations in the above-referenced report, the risk assessment conducted by USAC shall examine the effectiveness and efficiency of USAC’s operations by identifying risks associated with the above two programmatic objectives. Specifically, we instruct USAC to work with FCC in examining, through an independent and objective consultant, the following areas to identify potential risks to achievement of these objectives: · ETCs’ initial certification and subsequent verification of customer eligibility to participate in the low-income program;6 · Preventing resellers and wholesellers from seeking reimbursement under the low-income program for the same connection and ensuring only one Lifeline discount is provided per household;7 · Reviewing USAC’s organizational structure and organizational culture; policies, procedures, and mechanisms; and internal information and communication flow, including training provided to USAC employees and its subcontractors designed to ensure they are providing the correct information to ETCs or other parties; information and communications flow between USAC employees (and its subcontractors) and ETCs or other parties, including ETC or service provider training;8 · Evaluating how discrete ETC audit findings, and any recurring audit findings should be considered in developing internal controls;9 and · The ability of USAC and its databases and software to conduct data processing, including complex analysis of consumer and ETC information. After completing the risk assessment, USAC, subject to FCC oversight and approval, shall examine the overall design of the low-income program’s internal control structure and recommend modifications to business practices and internal controls that are necessary to cost-effectively address programmatic risks. Consistent with GAO’s next recommendation, we recognize that USAC already has begun a process, per the October 13, 2010 letter (October 2010 Audit Letter) from the Commission, to implement a systematic approach to assess internal controls that appropriately considers the results of universal service audits, including those related to low-income, and that is supported by a documented and approved set of policies and procedures.10 We emphasize that USAC’s audit activities must be consistent with its written policies and procedures and that USAC must reconcile any inconsistencies between the two. In addition, the October 2010 Audit Letter instructs USAC to establish goals and performance 5 See 47 U.S.C. §254(b)(3)(c); In the Matter of Telecommunications Carriers Eligible for Universal Service Support, WC Docket No. 09-197, Order, FCC 10-178, para. 20 (rel. Oct. 1, 2010); In the Matter of Telecommunications Carriers Eligible for Universal Service Support, WC Docket No. 09-197, Order, 25 FCC Rcd. 10510, para. 20 (2009). 6 GAO Report at 36. 7 GAO Report at 35. As 8 GAO Report at 37. 9 GAO Report at 37. 10 See GAO Recommendation at 40; Letter from Dana R. Shaffer, FCC, to Scott Barash, USAC, at 3 (Oct. 13, 2010) (available at http://www.fcc.gov/omd/usac-letters/2010/101310CPA-USAC.pdf) 3 measures to reduce the time elapsed between the date on which audit fieldwork is completed and the date on which the USAC Board approves the audit report.11 We recognize and appreciate USAC’s efforts to date concerning the low-income internal controls structure. As GAO recommends, implementation of the risk assessment and processes outlined above are critical in further improving the low-income program’s internal control structure. If you have any questions or wish to discuss these issues further, please do not hesitate to contact me. Sincerely, Steven VanRoekel Managing Director Cc: Sharon Gillett Mark Stephens Dana Shaffer 11 See id.