Volume 14, Number 2 • February 2017
News and Analysis for Colleges, Universities, AMCs and Other Non-Federal Entities
Contents
Lauer Offers
4 NIH’s
Strategies for Valuing
Research at FDP Meeting
Louisville Balks at
4 U.HHSof OIG
Request for
$1.3 Million Repayment
State Passes
7 Ohio
First Post-UG Audit;
Monitoring Was Focus
ICARE
8 Inaugural
Academy Offers ‘HandsOn’ Learning for IACUCs
Our Regulation Is
10 FDA:
Coming
Provisions in New
11 Major
Common Rule
12 In This Month’s E-News
Final Common Rule Emerges After Six
Years, Omitting Most Controversial Ideas
It could have been worse, but it should have better seems to be the consensus of the
research community upon greeting the final Common Rule revision published in the
waning days of the Obama administration, ending nearly six years of rule making
marked by controversy and criticism.
The regulation governing human subjects research, published in the Jan. 19 Federal Register, dropped earlier proposals, such as creating a new category of “excused”
research and requiring consent for the use of biospecimens regardless of whether they
are identified, thus sidestepping a few controversies (RRC 1/19/17).
Many weren’t sure HHS would be able to pull a final regulation out of the regulatory morass that has engulfed it since an advance notice of proposed rule making
(ANPRM) was published in July 2011. But because the rule came out so late — barely
48 hours before President Trump was sworn in — its future is uncertain. The new
president and Republican-controlled Congress have vowed to overturn especially latebreaking laws and regulations (RRC 11/16, p. 1).
What began early in President Obama’s term as a promise to impose the most
sweeping update to the regulations in more than 30 years has come down to a set of
“minimal but significant” changes, in the words of Gary Chadwick, a member of a
government advisory subcommittee and senior consultant with the HRP Consulting
Group.
In fact, HHS and the other 15 agencies that published the regulation devoted 459 of
the PDF document’s 543 pages explaining their response to comments; the text of the
regulation itself takes up just the last 84 pages.
continued on p. 9
Expanding Certificates of Confidentiality
Among NIH’s Urgent Tasks Under ‘Cures’
Editor
Theresa Defino
[email protected]
While some provisions in the new 21st Century Cures Act have the potential to
reduce administrative tasks for institutions, investigators and NIH itself, the agency
also has to ramp up a number of new initiatives in a short period of time.
The sweeping, 312-page legislation was signed into law by President Obama on
Dec. 15 (RRC 1/17, p. 1). It contains a number of provisions that will keep NIH busy
for the “next several months to a year,” Michael Lauer, deputy director for extramural
research, told RRC in a Jan. 13 interview.
The work goes on amid uncertainty as to who will be the NIH director under
President Trump. In January, Trump interviewed current Director Francis Collins, who
was appointed in 2009 and is willing to continue serving, as well as Rep. Andy Harris
(R-Md.). If Collins is not reappointed, an acting director may be named prior to a permanent director. As of RRC’s deadline, no decisions had been announced.
continued Published by the Health Care Compliance Association, Minneapolis, MN • 888.580.8373 • www.hcca-info.org
2 Report on Research Compliance A few requirements under the Cures Act have an
implementation deadline of “not later than 180 days after
the date of enactment,” and those are at the top of NIH’s
to-do list. Others have a one-year timetable, such as a requirement to create a “working group” to develop policy
recommendations to enhance the “rigor and reproducibility” of NIH-funded research. (Other deadlines follow.)
To begin, NIH officials are working with the Office of
Legislative Policy and Analysis (OLPA) in the director’s
office to create “legislative implementation action plans”
for the tasks that NIH is required to do, Lauer explained.
“We go through these items [in the law] one by one and
give out assignments to appropriate people within the
agency to take charge of these and make sure that a plan
is put together. The plan is then reviewed by NIH leadership and approved.”
The following are the sections NIH is currently
implementing, according to Lauer:
Sec. 2012, Privacy protection for human research
subjects. The Cures Act expands and makes mandatory
certificates of confidentiality to be issued to individuals
“engaged in biomedical, behavioral, clinical, or other
research, in which identifiable, sensitive information
is collected (including research on mental health and
research on the use and effect of alcohol and other psychoactive drugs)” funded by the U.S. government, and,
Report on Research Compliance is published monthly by Health
Care Compliance Association, 6500 Barrie Road, Suite 250,
Minneapolis, MN 55435. 888.580.8373, www.hcca-info.org.
Copyright © 2017 by the Health Care Compliance Association.
All rights reserved. It is permissible to forward portions of this
publication to small groups of employees on the same campus in
order to distribute content to those who can use it most effectively.
It is not permissible to photocopy, fax or email an entire print or
email issue, share your password to the subscriber-only website,
or to post even portions of a print or electronic newsletter on a
website or intranet, without permission. Contact Justin Allbee at
888.580.8373 x 7938 or Justin.allbee@corporatecompliance.
org if you’d like to review our very reasonable rates for bulk or site
licenses that will permit redistributions of entire issues.
Contact customer service at [email protected] or
888.580.8373.
Report on Research Compliance is published with the understanding that the publishers are not engaged in rendering legal, accounting or other professional services. If legal advice or other expert
assistance is required, the services of a competent professional
person should be sought.
Editor: Theresa Defino
Subscriptions to Report on Research Compliance include this
monthly newsletter, weekly email newsletters and access to a
subsciber-only website, which contains article archives and other
practical tools. To order an annual subscription ($461), call
888.580.8373 (major credit cards accepted) or order online at
www.hcca-info.org.
February 2017
upon request, by those not conducting federally funded
applicable studies. This goes into effect in June, or not
“later than 180 days” after the Cure Act became law.
Lauer called the revisions to certificates of confidentiality “a fairly big change.” He said he does not have
data on how many NIH has issued in the past compared
to how many will be required under the new law. NIH is
not the only agency that issues certificates.
NIH needs to “work on” how it is going to implement the provisions and will be providing “specific
instructions” in the future. The law also makes changes
to what the certificates mean, and it is not clear whether
current certificates will need to be modified and reissued.
Previously, investigators had “the option of not involuntarily turning over information to law enforcement,”
Lauer said. “The new version of the law actually requires
them to not turn information over” as specified in the
law.
NIH: Protections Will Be Stronger
In an opinion piece in the New England Journal of
Medicine, NIH Director Francis Collins and then-Deputy
Director Kathy Hudson called the changes “the most
significant advances in research privacy protections in
two decades.”
Certificates will “now be provided to all NIH-funded
scientists conducting research that involves the collection of identifiable, sensitive information. The certificates
will provide stronger protections against the disclosure
of the names of participants or any other identifiable
data gathered during research. In addition, the Cures Act
will allow the NIH to withhold biomedical information
about individuals that could be used to reidentify them
through requests for records filed under the Freedom of
Information Act,” they wrote.
Sec. 2038, Appropriate age groupings in clinical
research. This provision also has a deadline of 180 days
from enactment. The law requires NIH to “convene a
workshop of experts on pediatric and older populations
to provide input on—(A) appropriate age groups to be
included in research studies involving human subjects;
and (B) acceptable justifications for excluding participants from a range of age groups from human subjects
research studies.” Lauer said NIH plans to hold the
workshop sometime in the spring.
The law further requires that within 180 days after
the workshop is held, the director of NIH will “make a
determination with respect to whether the policies….
on the inclusion of relevant age groups in clinical studies need to be updated, and shall update such policies as
appropriate.”
Sec. 2035, The paperwork reduction act exemption.
Lauer cited this as an item on the list of provisions affect-
EDITORIAL ADVISORY BOARD: THOMAS A. COGGINS, University of South Carolina, MELINDA COTTEN, The University of Alabama at Birmingham, SHEILA ROSE GARRITY, JD, MPH,
MBA, The George Washington University, MADISON GRAY, JD, CRA, CCRP, Emory University, GARRY R. SANDERS, AssistLeadership, LLC, ALICE A. TANGREDI-HANNON, Yale University,
DEBORAH K. VETTER, University of Nebraska Medical Center, MARIANNE R. WOODS, Johns Hopkins University
February 2017
ing NIH in the short term; it seems to take effect immediately. This may be a situation where NIH’s new processes
will simply call for the elimination of requirements that
had been imposed, and it is not clear how much the extramural research community will be affected.
The Cures Act amended Section 301 of the Public
Health Service Act by adding that the Paperwork Reduction Act “shall not apply to the voluntary collection of
information during the conduct of research by” NIH.
This change, according to Collins and Hudson, “liberated
science from this red tape” and “will help speed the initiation of research and the generation of new knowledge.”
As Collins and Hudson wrote, the Paperwork Reduction Act applied to NIH, requiring “multiple levels
of government review and public comment on any set
of questions that NIH researchers propose to ask of 10 or
more persons in a scientific study supported by contracts,
the Intramural Research Program, and many cooperative
agreements.” Compliance “rarely results in substantive
changes, but it delays the start of research for 9 months,
on average — dissuading investigators, especially trainees, from undertaking important studies,” they said.
Sec. 2039, Enhancing the rigor and reproducibility
of scientific research. NIH has more time for this section
than for the certificates and age grouping provisions,
but not too much. Instead of six months, NIH has a year
from the date of passage to “convene a working group
under the Advisory Committee to the Director…to develop and issue recommendations through the Advisory
Committee for a formal policy, which may incorporate or
be informed by relevant existing and ongoing activities,
to enhance rigor and reproducibility of scientific research
funded by” NIH.
The act lays out the issues the working group “shall
consider, as appropriate”: the “preclinical experiment
design, including analysis of sex as a biological variable” and “clinical experiment design, including—(A)
the diversity of populations studied for clinical research,
with respect to biological, social, and other determinants
of health that contribute to health disparities; (B) the circumstances under which summary information regarding biological, social, and other factors that contribute to
health disparities should be reported; and (C) the circumstances under which clinical studies, including clinical
trials, should conduct an analysis of the data collected
during the study on the basis of biological, social, and
other factors that contribute to health disparities.”
The working group also may consider “applicable
levels of rigor in statistical methods, methodology, and
analysis” and “data and information sharing in accordance with applicable privacy laws and regulations.”
The NIH director then must work quickly, and “consider the recommendations developed by the working
Report on Research Compliance
3
group and issued by the Advisory Committee…and
develop or update policies as appropriate” within 18
months of the date of Cures Act passage (or six months
after the working group convenes, if it takes a year to
establish). Within two years of enactment, NIH must submit a report to HHS and the Senate Health, Education,
Labor, and Pensions and House Energy and Commerce
committees “regarding recommendations developed…
and any subsequent policy changes implemented” under
this section.
Sec. 2034, Reducing administrative burden for researchers. This section requires HHS to undertake a
variety of reviews within two years that could lead to
changes in NIH’s financial conflict of interest (COI)
regulations; in its requirements for monitoring of subrecipients of grants by primary awardees; in financial
reporting requirements for HHS agencies; and in governmentwide regulations and policies for the care and use of
laboratory animals.
Review Has Eye Toward Harmonization
Regarding this latter review, NIH is directed to work
with the U.S. Department of Agriculture, the Secretary of
Agriculture and the Commissioner of Food and Drugs
to “complete a review of applicable regulations and policies for the care and use of laboratory animals and make
revisions, as appropriate, to reduce administrative burden on investigators while maintaining the integrity and
credibility of research findings and protection of research
animals.”
The NIH director “shall—
“(1) identify ways to ensure such regulations and
policies are not inconsistent, overlapping, or unnecessarily duplicative, including with respect to inspection and
review requirements by Federal agencies and accrediting
associations;
“(2) take steps to eliminate or reduce identified inconsistencies, overlap, or duplication among such regulations and policies; and
“(3) take other actions, as appropriate, to improve
the coordination of regulations and policies with respect
to research with laboratory animals.”
In a related development, NIH, USDA, the National
Science Foundation and the Veterans Administration are
collaborating to sponsor a new “active-learning” training program for members of institutional animal care
and use committees and other officials who work with
IACUCs. Registration for the first “academy,” to be held
this month in Texas, is now open. (See story, p. 8.)
Link to law text: http://tinyurl.com/jvx9uhd
Link to NEJM article: http://www.nejm.org/doi/
full/10.1056/NEJMp1615745 G
Subscribers who have not yet signed up for Web access — with searchable newsletter archives and more — should click
the blue “Login” button at http://www.hcca-info.org/Resources/HCCAPublications/ReportonResearchCompliance.aspx,
then follow the “Forgot your password?” link to receive further instructions.
4 Report on Research Compliance NIH’s Lauer Offers Strategies for
Valuing Research at FDP Meeting
At a recent gathering of the Federal Demonstration
Partnership (FDP), Michael Lauer, deputy director at
NIH, presented a number of methods to “measure the
value and output of research.”
In his second presentation to the organization composed of university research compliance officials, principal investigators and federal agency representatives,
Lauer continued some of the themes from his first presentation in May 2016. At that time, Lauer talked about
moving NIH toward what he calls “evidence-based
funding” and finding ways to ensure that funding results
in measurable outcomes (RRC 6/16, p. 3).
It is part of NIH’s mission to be “effective stewards
of taxpayer money and that we seek to excel as a federal
science funding agency that manages for results,” Lauer
told RRC after the talk on Jan. 9.
He recommended that the FDP attendees read a
report produced by the Association of American Medical Colleges and the Rand Corp., “100 Metrics to Assess
and Communicate the Value of Biomedical Research: An
Ideas Book.”
The report, which Lauer called “very well done”
and “thoughtful,” offers ways institutions that perform
research can “communicate the value of what they do to
their constituencies and to the public.”
Metrics Stress Accountability
When selecting metrics to measure their results, institutions (and NIH) need to focus on those that “clearly
are related to the work that they do, and we then say that
that work, in turn, will contribute to the societal goals,”
Lauer said at the meeting.
Institutions, if they haven’t already, should be looking at their performance. “Our understanding is a number of institutions are already doing this, have already
been doing this,” said Lauer, told RRC, noting that Cleveland Clinic, where he worked from 1993 to 2007, measured and reported its outcomes, both patient-specific
and research-based. “That was something that we considered to be an important part of running a world-class
organization,” he added.
Lauer offered a framework described as “PQRST,”
published in a 2014 article in the Journal of the American
Medical Association authored by John Ioannidis, whose
titles include professor of medicine, professor of health
research and policy, and director of the Stanford Prevention Research Center at the School of Medicine, and
Muin Khoury, director of the Office of Public Health Genomics at the Centers for Disease Control and Prevention
and senior advisor to the National Cancer Institute. The
February 2017
article describes the system as an “Index for Appraising
and Rewarding Research.”
The PQRST framework “is one that I thought would
be particularly helpful for institutions thinking about
institution- or agency-based performance metrics.” NIH,
Lauer said, “is interested in all of these” and is “already
doing all of these.”
u P stands for productivity. An example of such a measure is “publications in the top tier % of citations for the
scientific field and year”;
u Q stands for “quality of scientific work”;
u R stands for reproducible;
u S stands for “sharing of data and other resources”; and
u T stands for “translational sharing of research.”
Lauer noted that “rigor, reproducibility and transparency” are concerns NIH “has put front and center”
and that NIH has also taken steps to increase the sharing
of research results, including through its new clinicaltrials.gov policy (RRC 10/16, p. 1).
It will be doing more in this regard as required under
the Cures Act. Section 2014 of the act amended the Public
Health Service Act to permit NIH to “require recipients
of National Institutes of Health awards to share scientific
data, to the extent feasible,” that is “generated” from
NIH awards, and in compliance with other laws and
regulations such as those governing privacy.
(For Lauer’s view on other aspects of the Cures Act
that NIH is implementing, see story p. 1).
Link to Lauer’s slides: http://tinyurl.com/jk34cgd
Link to Rand report: http://www.rand.org/pubs/
research_reports/RR1606.html
Link to PQRST article: http://tinyurl.com/
zd4u4ms G
U. of Louisville Balks at HHS OIG
Request for $1.3 Million Repayment
For the first time in several years, the HHS Office
of Inspector General has issued an audit report recommending repayment from a university based on OIG’s
assessment that costs that should have been included as
facilities and administrative (F&A) expenses were instead charged directly to grants.
In this case, OIG is seeking $1.3 million from the University of Louisville (UofL) for questioned transactions
including both salary and non-salary transactions, such
as for cell phones, laptops and microscopes. Like most
other universities facing similar findings, the university
opposed the repayment and a recommendation that it
beef up its financial oversight.
Call Justin Allbee at 888.580.8373 x 7938 or [email protected] to find out about
our very reasonable rates for bulk subscriptions and site licenses for your entire campus.
February 2017
The audit contains a number of pointed disagreements between OIG and UofL.
For example, UofL disputed OIG’s characterization
of some employees as administrative or clerical if their
job duties included “ordering supplies,” saying the auditors had “taken the extreme view that any indication
of any administrative or clerical activity warrants questioning an entire salary charge.” UofL also stated that
OIG had found some labor costs unreasonable, “without
providing any supporting analysis of which we are
aware.”
UofL also took issue with OIG’s justification for the
audit, which referenced findings from a previous audit.
UofL described a number of improvements it has already
made since the 2012 audit period ended.
Issued Dec. 22, the audit encompassed $114 million
in HHS funding from September 2010 to 2012. It was
one of two OIG posted in late December; both concerned
indirect costs. The other was of Ohio State University,
which found compliance and made no recommendations
(RRC 1/12/17).
OIG: No ‘Unusual’ Circumstances
According to OIG, its “sample of 120 salary transactions” found that “102 were allowable but 18 were not,
for a total of $85,065 in unallowable salary transactions.”
OIG used the “sample” results to calculate that there
were “overcharges of at least $878,488 to HHS awards
during our audit period ($585,659 in salary costs plus
$292,829 in related F&A costs).” The majority of the unallowable salary costs were for amounts OIG said should
have been included in F&A categories.
Similarly, in its “sample of 100 nonsalary transactions, 61 were allowable but 39 were not, for a total of
$104,302 in unallowable nonsalary transactions.” OIG
then estimated that “these unallowable nonsalary transactions resulted in overcharges of at least $432,579 to
HHS awards during our audit period ($348,379 in nonsalary costs plus $84,200 in F&A costs).”
Except in a few instances, OIG did not list the
amount of each questioned transaction.
Of the 18 unallowable salary transactions, 15 were
for “salary costs for administrative and clerical work
such as ordering supplies, reconciling accounts, and
caring for lab mice,” OIG said. “These costs should not
have been charged directly to the award because they
involved salaries of administrative and clerical staff, and
neither the nature of the work performed on the projects
nor any other circumstances justified any unusual degree
of administrative support or showed that the employees
were necessary for the performance of the awards.”
UofL “argued that 15 transactions related to individuals that worked on a major project, or held positions
Report on Research Compliance
5
that were approved by the awarding agency or prime
grantee, or performed technical and programmatic
work,” OIG said. However, OIG contended that auditors “do not agree with the University’s contention that
listing individuals’ names and positions in the approved
budget is persuasive evidence that the individuals’ salary
costs are allowable charges to an award.”
“To be allowable as a direct charge to an award, the
administrative activities that an individual performed
must be solely related to the project to which their salary
was charged,” OIG said. “The employees’ administrative
duties benefited multiple activities and could not always
be tied to an individual project.”
Effort Reports Lacked Appropriate Signatures
The remaining three transactions “were for salary
costs for which the University did not have a properly
signed effort report. Effort reports that supported one
transaction had no signature. Effort reports supporting
two other transactions were signed by administrative
staff rather than the Principal Investigator responsible
for the award. However, the Principal Investigator subsequently signed effort reports for the two transactions
over a year later. Salary costs should be claimed on the
basis of an effort report signed by a responsible person
with suitable means of verifying that the work was performed (2 CFR part 220, App. A § J.10b(2)(b)).”
“Of the 100 transactions totaling $3,316,063 in our
sample of nonsalary costs, 39 transactions totaling
$104,302 were not allowable.”
Of the 39:
u For seven, “the University could not provide original
invoices or any means to tie the cost to the award.”
u 18 were “specialized service centers [that] were not
charged in accordance with Federal regulations.” Specifically, the university “did not provide a schedule of rates
that supported charges for its physical plant center,”
some “invoices had additional fees for hardware and
administrative costs even though these costs duplicated
costs that were already included in the specialized
service centers’ schedule of rates,” and a “specialized
service center did not provide an invoice to support a
transaction.”
According to OIG, the “costs of services provided
by specialized facilities must be charged on the basis of
actual usage of the services and on the basis of a schedule of rates or established methodology (the Circular §
J.47.b.).”
u “Four transactions were for general-purpose equipment and office supplies that should have been treated as
F&A costs and not charged as direct costs to the award.
Items such as office supplies, postage, local telephone
costs, and memberships shall normally be treated as F&A
Subscribers who have not yet signed up for Web access — with searchable newsletter archives and more — should click
the blue “Login” button at http://www.hcca-info.org/Resources/HCCAPublications/ReportonResearchCompliance.aspx,
then follow the “Forgot your password?” link to receive further instructions.
6 Report on Research Compliance February 2017
costs” (the Circular § F.6.b.(3)). Furthermore, beginning
in October 2010, the Grants Policy Statement (GPS), section 7.9.1, specifically stated: “Office equipment (copiers,
laptops, desktop computers, personal handheld computers, fax machines, scanners, etc.) that is used for general
office purposes (rather than justified as a specific research
purpose) are not allowable as direct costs; they are allowable as an F&A cost.”
u “Ten transactions did not meet the Circular’s criteria
for allocable costs. For example, the University charged
multiple cell phones, which were rarely used, against a
single award. The University also charged an award for a
subscription to an online meeting service and the postage
cost of a visa to enter Japan,” OIG said. “The University
did not provide documentation that showed these costs
benefitted the award. A cost is allocable to a sponsored
agreement if it benefits both the sponsored agreement
and other work of the institution in proportions that can
be approximated through use of reasonable methods (the
Circular § C.4.(a)).”
Even Reason for Audit Disputed
In explaining why it conducted the audit, OIG referenced findings from a previous audit that it “conducted
at the University (as the cognizant Federal agency),”
which it said “included significant findings. In that review of a $7 million award that the University received
from another Federal agency, we identified $1.5 million
in costs that was unallowable. Our audit of the $7 million award covered costs the University claimed for the
66-month period ended June 2009.”
The OIG added that, “Therefore, we are concerned
that the University’s grant management is a high-risk
area and performed an audit of subsequent costs charged
to HHS awards.”
But UofL argued (unsuccessfully) that this statement
didn’t belong in the report.
In comments submitted in response to the draft audit
report — auditees do not get to see or comment on a final
report before it is published — UofL said it “takes issue”
with the idea that this earlier audit “caused DHHS to
view the University as high-risk. As DHHS knows, the
University challenged that disallowance and amicably
resolved it for less than a quarter of what DHHS claimed
was improperly charged. We respectfully suggest that the
reference to the prior audit should be removed from the
final report.”
RRC asked UofL to comment on the final audit.
“We continue to work with the Office of the Inspector General to address the issues raised in its audit,”
spokesman John R. Karman, III, told RRC. “Our response
to HHS will be forthcoming in the next month. Since the
audit period of 2010-2012, we’ve refined and tightened
processes and procedures to ensure greater compliance
with federal regulations, including implementing best
practices related to cost allocation.”
UofL Details Changes
Reflective of Karman’s comments, at the conclusion
of its comments, UofL described a number of “enhancements….made since the 2010-2012 audit period.”
These include the following:
u Reorganization of the Grants and Contracts Accounting Office.“Effective April 1, 2013, the Grants and
Contracts Accounting Office was merged with the Office
of Grants Management to create the Office of Sponsored
Programs Administration (SPA). SPA is a combined pre­
award/post-award office that was created in order to
enhance the oversight and management of sponsored
programs, primarily federally sponsored grants and contracts. SPA is managed by a single director as opposed to
the previous structure wherein there were two directors
(one for pre-award grants management and one for postaward accounting).”
u Strengthening of effort reporting controls. “As part of
the strengthened procedures, a post collection monitoring has been implemented in order to provide reasonable
assurance that the institutional process is complete.”
UofL did not detail what it is doing differently.
u Grant and contract spot check program. “Periodic spot
checks” are conducted on “federal grants and contracts…
to assess the health of fiscal management of federal
programs and when required, to recommend corrective
measures.” Following implementation in fall 2013, “the
spot check program has reviewed federal awards totaling over $39 million.” UofL did not say what problems, if
any, have been uncovered.
u Gap analysis of internal controls. Internal auditors
conducted a review of UofL’s controls, including “the
policies and identifying key controls that help ensure
compliance using the COSO (Committee of Sponsoring
Organizations of the Treadway Commission) model.”
COSO is referenced in the UG. “No significant gaps or
internal control deficiencies were identified.”
u Alignment of policies, revision of handbook. UofL
revised its policies as necessary to comply with the UG
with the help of a work group that also gave “numerous
presentations.” A handbook that “provides assistance
and guidance to faculty and staff who are involved in the
preparation of proposals to and in the administration of
awards received from external sponsors, including the
federal government” was revised to comply with the UG.
(See http://louisville.edu/research/support/researchhandbook/toc.)
For other HCCA resources visit www.hcca-info.org.
February 2017
The UofL audit appears to be the first since 2015 in
which HHS OIG auditors cited a university for unallowable direct costs.
Looking back over the recent past, in 2012, OIG
recommended Florida State University (FSU) repay
$2.9 million related to unallowable salary and nonsalary transactions associated with grants in fiscal years
2009 and 2010. FSU disputed most of the findings (RRC
7/26/12).
HHS OIG sought repayment of $1.419 million from
the University of Colorado Denver for “indirect costs
claimed as direct costs” and $93,000 from Thomas Jefferson University for “indirect administrative costs charged
as direct costs,” based on audits issued in 2013.
Both universities contended at least some of the costs
were allowable (RRC 6/20/13, RRC 7/11/13).
Previous Audits Unresolved?
OIG issued three such audits in 2014. In April 2014,
OIG sought repayment of $6.4 million from the University of South Florida (USF) for unallowable salary and
nonsalary transactions. USF disagreed with most of the
findings, stating that auditors had misunderstood the
nature of the work being done. It noted that “most” of
the salary costs that OIG deemed “administrative and
clerical” were “actually associated with individuals performing technical work” on clinical trials (RRC 5/15/14).
OIG issued two audits in June 2014. On June 26, OIG
recommended that HHS seek repayment of $3,765 from
the University of California, San Diego (UCSD), while
the university agreed to refund $1,766.
OIG also recommended that the university “enhance
oversight of administrative and clerical payroll costs
charged directly to HHS awards to ensure compliance
with Federal regulations.”
In a June 27 audit, HHS OIG sought a repayment
of $352,843 from the University of North Carolina at
Chapel Hill, but this one broke the mold in that UNCCH did not object to a repayment request. In total, OIG
sought repayment of $352,843, of which $298,275 were
costs that “were not adequately documented;” $34,557
were costs that “were not reasonable;” and $3,042 were
costs that “were not treated consistently.” In addition,
OIG said UNC-CH “claimed unallowable F&A costs
totaling $16,969 that were associated with the unallowable costs.” Among the costs the auditors said were not
adequately documented were expenditures attributed
to “research related equipment, supplies and services”
(RRC 8/14, p. 5).
A year later, OIG conducted another, related audit
of UCSD that found much higher unallowable costs.
UCSD was asked in an April 30, 2015, audit report to
repay $202,401 for “$148,803 in unallowable nonpayroll
Report on Research Compliance
7
costs and $53,598 in unallowable F&A costs related to
the unallowable direct costs and the misclassification of
a capital expenditure as maintenance and repairs.” The
amounts were costs claimed on HHS grants from Oct.
1, 2008, through Sept. 30, 2010. UCSD agreed to repay
just $27,519 in questioned costs but did accept OIG’s
other recommendations that it “reclassify maintenance
and repair costs as a capital expenditure” and “enhance
oversight of nonpayroll administrative and clerical costs
charged directly to HHS awards to ensure compliance
with Federal regulations (RRC 5/14/15).”
No information appears to have been issued regarding the resolution of these audits.
Link: https://oig.hhs.gov/oas/reports/region4/41301022.asp G
Ohio State Passes First Post-UG
Audit; Monitoring Was the Focus
In what appears to be the first audit following implementation of the Office of Management and Budget’s
uniform guidance (UG), the HHS Office of Inspector
General (OIG) concluded that Ohio State University
(OSU) correctly “monitored [its] subrecipients and
claimed costs as a subrecipient in accordance with NIH
grant policies and Federal regulations.”
But the seven-page audit report provides no information on how OSU conducts risk assessment and monitoring of subrecipients, details that could be helpful to
other awardees as it is a new area of focus under the UG
(RRC 11/14, p. 10).
As the audit itself explains, the UG “requires a prime
Federal award recipient to perform preaward subrecipient risk assessments and monitor the programmatic
activities of subrecipients throughout the life of each
subaward.”
HHS “implemented the Uniform Guidance at 45
CFR part 75…effective for awards and award increments
made on or after December 26, 2014,” the audit states.
OSU’s audit “covered 83 NIH grants for which OSU
was the prime recipient and issued subawards to various
colleges, universities, and private entities for a portion
of the grant funds,” OIG said in the audit dated Dec. 23,
2016. “For these 83 grants, OSU’s subrecipients claimed
expenditures totaling $11 million during the period of
January 2015 through March 2016 (audit period). In addition, our audit covered 169 NIH grants that were awarded to various colleges, universities, and private entities
that issued a subaward to OSU. For these 169 grants,
OSU claimed costs as the subrecipient totaling $18 million during the audit period.”
continued Subscribers who have not yet signed up for Web access — with searchable newsletter archives and more — should click
the blue “Login” button at http://www.hcca-info.org/Resources/HCCAPublications/ReportonResearchCompliance.aspx,
then follow the “Forgot your password?” link to receive further instructions.
8 Report on Research Compliance The finding was based on a sample of 30 awards,
half for which OSU was the prime and half for which it
was a subrecipient.
For those where it was the prime, OIG “reviewed a
total of $120,052 in costs incurred by OSU’s subrecipients
and OSU’s risk assessment and monitoring activities of
the subrecipient” and OSU’s facilities and administrative
(F&A) costs for each selected grant. The audit provides
no details about how OSU conducts risk assessment,
how it monitors subrecipients, nor what types of costs
made up the $120,052.
For those awards where OSU was the subrecipient,
OIG reviewed a total of $640,897 in costs OSU claimed,
the report said. OIG provided more detail, stating the
costs OSU claimed as a subrecipient included “salary and
wages, equipment, supplies, and travel.”
“We limited our internal control review to obtaining
an understanding of OSU’s policies and procedures for
monitoring subrecipients and claiming costs as a subrecipient,” OIG said.
NSF OIG Also Concerned
Auditors found OSU’s costs and monitoring acceptable. “OSU monitored subrecipients and claimed costs
as a subrecipient in accordance with NIH grant policies
and Federal regulations. Accordingly, this report contains
no recommendations,” OIG said. Given there were no
negative findings or questioned costs, the audit does not
contain a response from OSU.
This audit is part of OIG’s plan “to review colleges’
and universities’ controls over the subcontracting” of
NIH grants and contracts, the report states, echoing information in OIG’s fiscal year 2017 work plan.
OIG intends to “determine whether colleges and
universities effectively monitor the services subcontracted to other organizations and ensure that Federal
funds are spent on allowable goods and services in compliance with selected cost principles and the terms and
conditions of the grants and subcontracts,” the work plan
states (RRC 12/16, p. 3).
The National Science Foundation (NSF) OIG also
plans to take a closer look at internal controls, according
to Mark Bell, its new assistant inspector general for audit.
In November, Bell described OIG’s efforts to the
National Science Board and to RRC. His office, he said, is
“looking at whether we are including sufficient information about the control environment in our reports with
specific recommendations (RRC 12/16, p. 1).
HHS OIG issued a second audit in December, which
was of the University of Louisville (see story, p. 4).
Link: https://oig.hhs.gov/oas/reports/region5/51600039.asp G
February 2017
Inaugural ICARE Academy Offers
‘Hands-on’ Learning for IACUCs
On the heels of three “train-the-trainer” institutes
held last year, the HHS Office of Laboratory Animal
Welfare (OLAW) and other agencies have opened up
registration for their first two-day ICARE Academy, to be
held later this month in Texas.
ICARE stands for the Interagency Collaborative Animal Research Education, a project created to “improve
the welfare of animals used in research, reduce regulatory burden, and increase compliance with federal standards,” Susan Silk, director of OLAW’s Division of Policy
and Education, told RRC. Silk conceived the program in
2014 and brought together various federal agencies to
support it (RRC 11/15, p. 4).
This month’s academy will be held at the DoubleTree
in Arlington, Texas, Feb. 22-28. It will be followed by two
others this year, in July in Philadelphia and in Richmond,
Va., in August. Trainer institutes are four days long; just
one is scheduled for this year, in Seattle May 1-5.
Two of last year’s training institutes were supported
by a National Science Foundation grant to Public Responsibility in Medicine and Research (PRIMR) that was
funded by OLAW, the Animal and Plant Health Inspection Service of the U.S. Department of Agriculture and
the Food and Drug Administration. This year’s program
has these sponsors and one more: the U.S. Department of
Veterans Affairs.
IACUC Trainers Were Trained First
“Active learning,” Silk explained, “is a method of
instruction that has been shown to increase effectiveness
of adult education in factual and theoretical understanding of scientific and ethical issues by engaging the learner
in activities that require the application of high-level
concepts.” This strategy may prove especially useful in
engaging younger IACUC members, according to Silk.
“We are hoping to make training more effective and
more fun.”
During the three training institutes held last year,
some 100 “national and institutional trainers were
trained to use active learning pedagogy [for] the development of IACUC training for U.S. research institutions,”
she said.
The four-day institutes “train IACUC members and
institutional and animal program personnel to meet their
responsibilities for animal welfare oversight,” Silk said.
They “empower the learner to assume accountability for
facts and conceptual understanding of federal standards
through the study of realistic problems encountered in
animal care and use programs.”
Call Justin Allbee at 888.580.8373 x 7938 or [email protected] to find out about
our very reasonable rates for bulk subscriptions and site licenses for your entire campus.
February 2017
Report on Research Compliance
At least two of the participants spoke highly of the
trainer institutes they attended, and of the goals of the
program.
Ernie Prentice sees the ICARE program as a complement to existing training programs. Prentice, associate
vice chancellor for academic affairs and the Institutional
Official for the Animal Care and Use Program at the University of Nebraska Medical Center, said training offered
online or only as lectures doesn’t do the full job. “Part
of the problem with lectures is there are very few who
are charismatic or engaging enough to have an audience
hanging on their every word,” he said. “After about 15
minutes or so students begin to tune out, they’re not listening. When that happens you do not have an effective
learning technique.”
Prentice attended the trainer institute as a participant
but is a paid faculty member for the academy.
High Praise for Program
Allyson Bennett, an associate professor of psychology and faculty director of the animal program at the University of Wisconsin Madison, attended one of the trainer
institutes. She called it “expertly run, with a diverse team
that has exceptional expertise to train the trainers in what
active learning really means, which is a thoughtful and
thorough design of training that tightly integrates objectives, assessment of mastery, and active engagement by
the learner.” Overall, it is an “exceptionally valuable and
unique effort that brings contemporary best practices in
education to improve training in the diverse communities that play roles in animal care, scientific research, and
oversight of those activities.”
Added Bennett, “The active learning approach has
strong empirical support and is used widely in college
and other classrooms to ensure that learners master
learning objectives and are able to engage with the concepts and material at a higher cognitive level.”
Active learning, she said, is “substantially different
than simply adding a ‘game’ to an existing training. At its
core, active learning is focused on meaningful outcomes
and outcomes that are measured: learners who emerge
with higher level cognitive engagement and mastery of
concepts and material. By using active learning training, the community can be better positioned to engage
deeply, critically evaluate, and create novel approaches
and solutions that benefit the balance of scientific objectives, consideration of animal welfare, and compliance
with regulations.”
Among the topics to be addressed at the academies,
either as modules or in discussions, include:
u The scope of IACUC oversight. “Participants will learn
to distinguish what is within an IACUC’s scope of re-
9
sponsibilities and what is within the jurisdiction of other
components of the institution,” Silk said.
u Effective communication “within the IACUC, between
the IACUC and the institutional official, and between the
IACUC and principal investigators,” according to Silk.
This is being added by request of the ICARE faculty.
u Lessons learned to improve animal welfare. “This is a
brainstorming session. The material will come from the
participants,” Silk said.
u “[R]egulatory drift” and investigator burden. During this module, “participants will explore investigator
burden and one of its major causes, regulatory drift,”
said Silk. “After identifying and evaluating causes of
regulatory drift, participants will collaborate in creating
solutions.”
“Participation in ICARE Academies is open to those
involved in animal care and use programs, including
IACUC members and staff, institutional officials, veterinarians, animal facilities personnel, administrators,
consultants, and compliance and regulatory personnel
involved in the humane use of animals in research,” Silk
said. Registration is $600, which includes training materials and breakfast and lunch for the two days. Faculty hail
from academic institutions as well as associations and
private entities.
Link: http://tinyurl.com/gmmkxjk G
Final Common Rule Published
continued from p. 1
The final regulation refers to the current Common
Rule as the “pre-2018 requirements.” The new rule goes
into effect on Jan. 19, 2018, for provisions other than a
mandate for the use of a single institutional review board
(sIRB) for research with more than one U.S. site. Some
provisions may achieve the stated goals and reduce burdens while applying appropriate protections based on
the nature of the risks posed by the research. But new
requirements may have the opposite effect.
The government, however, estimated the changes
won’t be costly. “We calculate the costs of the proposed
changes to the Common Rule over 2017-2026 to institutions with an FWA [federal wide assurance]. The estimated annualized cost to institutions with an FWA, on
average, is $2,516 using a 3 percent discount rate,” the
rule states. In particular, the government estimates required changes to consent forms (other than related to
broad consent) will take investigators just 15 minutes to
complete.
The first response to the final regulation seemed to
be glee over the omission of the biospecimens provisions.
Others were immediately exuberant about the changes
Subscribers who have not yet signed up for Web access — with searchable newsletter archives and more — should click
the blue “Login” button at http://www.hcca-info.org/Resources/HCCAPublications/ReportonResearchCompliance.aspx,
then follow the “Forgot your password?” link to receive further instructions.
10 Report on Research Compliance February 2017
to the research category. Posting a photo of the Statue of
Liberty on his blog, George Mason University history
professor Zachary Schrag proclaimed “United States of
America Frees Oral History!”
The new regulation “preserves and clarifies…deregulation of oral history. This is a great victory for freedom
of speech and for historical research,” he enthused.
“For historians, this was a 15-year project,” Schrag,
who commented to HHS over the course of the rule making, told RRC. “IRB oversight has never been a good fit
for oral history, and since 2002, historians’ organizations
have been asking that oral history be freed from regulation as a matter of definition. The new rule gives us what
we’ve sought all this time.”
Schrag expressed disappointment that the final rule
doesn’t provide for a method for researchers to appeal
IRB decisions. This idea was floated in the ANPRM but
did not make it into the NPRM; it was endorsed in a
report by the National Research Council in 2013 (RRC
10/15, p. 8).
Chadwick himself publicly branded the NPRM
an “under-developed” product of lengthy “black-box
dithering” (RRC 12/15, p. 1). Chadwick is a member of
subcommittees of the Secretary’s Advisory Committee
on Human Research Protections and a former member of
SACHRP itself.
While SACHRP counsels HHS and the Office for
Human Research Protections, the agency that enforces
compliance with the Common Rule, OHRP did not
involve SACHRP in drafting the regulation. SACHRP
ended up rejecting many of the provisions in the ANPRM and the NPRM and was among commenters recommending that the final rule be withdrawn (RRC 6/16,
p. 1).
The bumpy path to the final rule was somewhat to
be expected, given the number of agencies involved. But
the government moved forward with an NPRM that
enshrined many proposals in the ANPRM that seemed to
draw the most “no” comments. The ANPRM drew more
than 1,000 comments, while the NPRM led to twice that.
The government had to analyze and respond to all of
them, ensuring resolution would not be swift. In Chadwick’s view, this was compounded by “the loss of the
Presidential championship.”
For Chadwick, his “biggest disappointment” is “the
lack of common expectations for investigators — FDA
[Food and Drug Administration] and international standards have these and so should the federal agencies.”
Still, he had somewhat more praise for the final rule
versus the early versions, saying it contains “careful crafting of language” and is more “clear and appropriate.”
Chadwick added he is displeased with the single IRB
mandate. This “forced behavioral change seems inappropriate for regulation,” he said. He also termed the optional broad consent concept “ethically flawed. Justifying
actions that go beyond the floor of the regulations is just
FDA: Our Regulation Is Coming
Assuming it is not negated by Congress or the
Trump administration, the revised Common Rule
issued last month has the approval of 16 federal agencies, including HHS (see story, p. 1). But it doesn’t
apply to all parts of HHS, notably the Food and Drug
Administration (FDA).
The FDA and the Office for Human Research
Protections (OHRP), the primary HHS agency that
oversees compliance with the Common Rule, do work
together on issues; most recently they issued joint
guidance on the use of electronic informed consent
(RRC 1/17, p. 6).
But the FDA has been formally sitting out the
process of revising the Common Rule, with plans to do
its own regulations in the future.
“The FDA plans to harmonize its regulations with
the final Common Rule, to the extent appropriate and
permissible, based on the FDA’s and OHRP’s missions
and statutory authorities,” FDA spokeswoman Lauren
Smith Dyer confirmed to RRC on Jan. 19. “For example, certain types of research described in the Common Rule (e.g., behavioral observations or educational
interventions) are not regulated by the FDA.”
She noted that the “FDA’s authority is focused on
FDA-regulated products, including drugs, biologics
and medical devices.”
The agency will “follow notice and comment rulemaking procedures,” Dyer said, but could not offer a
“specific timeframe for completing rulemaking.”
The following departments have signed on: Agriculture, Commerce, Defense, Education, Energy,
Homeland Security, Housing and Urban Development,
Justice, Labor, Transportation, and Veterans Affairs. In
addition, NASA, the National Science Foundation, the
Social Security Administration, the Environmental Protection Agency and the Agency for International Development are listed as adopting the final regulation.
For other HCCA resources visit www.hcca-info.org.
February 2017
Report on Research Compliance
plain silly and reflects an inappropriate schoolmarmish
slap-your-hand mentality,” he argued.
Universities that belong to the Council on Governmental Relations (COGR) also have a mixed response,
according to Lisa Nichols, director of research and regulatory reform. “The final rule is obviously far more palat-
11
able than the proposed rule, but, generally speaking, I
don’t think our members consider this an improvement
over the existing rule,” said Nichols. “The general feeling is that it will add, not reduce burden in many cases…
although changes with respect to continuing review and
additional exemptions are helpful.” For example, the
Major Provisions in New Common Rule
On Jan. 19, the federal government published a
final regulation revising 45 CFR Part 46, which governs
human subjects research (see story, p. 1). Future issues
of RRC will explore the provisions in more detail. The
following are some highlights:
u The regulation, as an option, permits “the use of
broad consent (i.e., seeking prospective consent to
unspecified future research) from a subject for storage, maintenance, and secondary research use of
identifiable private information and identifiable biospecimens. Broad consent will be an optional alternative that an investigator may choose instead of, for
example, conducting the research on nonidentified
information and nonidentified biospecimens, having
an institutional review board (IRB) waive the requirement for informed consent, or obtaining consent for a
specific study.”
u It also creates “new exempt categories of research
based on their risk profile,” although some “would be
required to undergo limited IRB review to ensure that
there are adequate privacy safeguards for identifiable
private information and identifiable biospecimens.”
u The final rule expands the definition of research
(what must comply with the Common Rule) to exclude “scholarly and journalistic activities (e.g., oral
history, journalism, biography, literary criticism, legal
research, and historical scholarship), including the
collection and use of information, that focus directly on
the specific individuals about whom the information is
collected.”
u It also contains “a requirement for U.S.-based institutions engaged in cooperative research to use a single
IRB for that portion of the research that takes place
within the United States, with certain exceptions.” This
is similar to the policy NIH put in place effective in
September (RRC 1/17, p. 3).
u The new rule “removes the requirement to conduct
continuing review of ongoing research for studies that
undergo expedited review and for studies that have
completed study interventions and are merely analyzing study data or involve only observational follow up
in conjunction with standard clinical care.”
u HHS is required to develop “guidance to assist IRBs
in assessing what provisions are adequate to protect
the privacy of subjects and to maintain the confidentiality of data.”
u Instead of requiring consent for the use of biospecimens, regardless of whether they are identifiable,
the final regulation requires one of the “following
statements be included for any research that involves
the collection of identifiable private information or
identifiable biospecimens: (1) A statement that identifiers might be removed from the identifiable private
information or identifiable biospecimens and that after
such removal, the information or biospecimens could
be used for future research studies or distributed to
another investigator for future research studies without additional informed consent from the subject or
the legally authorized representative, if this might be a
possibility; or (2) a statement that the subject’s information or biospecimens collected as part of the research,
even if identifiers are removed, will not be used or
distributed for future research studies.”
u Another new requirement is that “informed consent
must begin with a concise and focused presentation of
the key information that is most likely to assist a prospective subject or legally authorized representative
in understanding the reasons why one might or might
not want to participate in the research.” This is not
required in cases of “broad consent.”
u Three new “additional elements of consent…require
that a subject be informed of the following, when appropriate: That the subject’s biospecimens (even if
identifiers are removed) may be used for commercial
profit and whether the subject will or will not share
in this commercial profit; Whether clinically relevant
research results, including individual research results,
will be disclosed to subjects, and if so, under what conditions; For research involving biospecimens, whether
the research will (if known) or might include whole
genome sequencing (i.e., sequencing of a human germline or somatic specimen with the intent to generate
the genome or exome sequence of that specimen).”
Link: http://tinyurl.com/zpe3nt7
Subscribers who have not yet signed up for Web access — with searchable newsletter archives and more — should click
the blue “Login” button at http://www.hcca-info.org/Resources/HCCAPublications/ReportonResearchCompliance.aspx,
then follow the “Forgot your password?” link to receive further instructions.
12 Report on Research Compliance sIRB requirement is thought to increase administrative
work, she said.
To be sure, the final regulation will find fans and
foes, said David Borasky, vice president for quality management for WIRB-Copernicus Group, a private institutional review board firm. “Everyone can likely identify
something that they were happy to see in the rule, happy
to see omitted from the rule, or wish made it into the
rule.”
Borasky, who also is a member of SACHRP’s subcommittees, noted that “SACHRP has made many recommendations that were not incorporated. For example,
they recommended the inclusion of a section on investigator responsibilities in response to both the ANPRM
and the NPRM.”
“This rule definitely reduces some of the current burden, and a great deal compared to the NPRM,” Nichols
said. “We won’t be able to evaluate the regulatory burden of new requirements, like the limited IRB review for
certain types of proposed research, until we dig in and
begin preparing to implement the rule.”
All of those who spoke to RRC acknowledged as
positive that the rule, as Borasky put it, “requires that certain topics be revisited on a more systematic basis, which
should help sustain the relevance of the rule over time.”
For all its length, one issue the preamble to the regulation couldn’t address is what comes next: Will Congress
or the Trump administration seek to overturn or negate
February 2017
the regulation? No one knows and in the meantime,
most groups are advising their members to start revising
procedures to comply but to hold off putting them into
practice until more is known.
The regulation might get a second look, but could
survive intact, says Borasky. “I think it is generally accepted that OHRP and the regulations are non-partisan.
Having said that, there is still a very high level of uncertainty about what will happen with the new administration,” said Borasky. “Given the very late signing of the
rule, it would not be surprising if the rule was put on
hold and re-examined, along with other new regulations. On the other hand, some have speculated that
this will not get the attention of HHS leadership or the
administration, given the fact that it is non-partisan and
appears to reduce regulatory burden.”
Schrag agreed. “The [U.S.] House Freedom Caucus
opposed the regulation primarily as a matter of cost,
which in turn was largely due to the new biospecimens
rules. Now that those rules have been abandoned, the
rule is closer to the original 2011 goal of ‘reducing burden, delay, and ambiguity for investigators,’” he said. “I
hope that the Republicans see it in that way and allow it
to proceed.”
In the coming weeks or months, OHRP plans to
issue guidance on the regulation and hold educational
events to help explain it. No timetable has been set.
Link: http://tinyurl.com/zpe3nt7 G
In This Month’s E-News
The following are summaries of news transmitted to RRC subscribers this month in email issues, the date of which is
indicated in parentheses following each item. Weekly email and monthly print issues of RRC are archived on your subscriberonly website. Please call 888-580-8373 or email [email protected] if you require a password to access RRC’s subscriberonly website or are not receiving weekly email issues of the newsletter.
u On the heels of a revised scientific integrity
policy issued by the Department of Energy, the
Union of Concerned Scientists issued a new report that “characterizes the progress, missteps and
unfinished business of scientific integrity under the
Obama administration and considers what’s at stake
under the Trump administration.” The organization
also offered specific recommendations to Congress
and President-elect Trump, including that agencies
should issue guidance requiring the disclosure of
financial conflicts of interest among peer reviewers.
(1/19/17)
u The White House Office of Science and Technology Policy (OSTP) issued “policy guidance” for
“certain life research that could enhance a pathogen’s
virulence and/or transmissibility to produce a potential pandemic pathogen” (PPP), which is also called
gain-of-function research (GOF). The government,
with the aid of the National Science Advisory Board
for Biosecurity (NSABB), has been developing such a
policy since 2014 (RRC 1/16, p. 6). (1/12/17)
u NSF “needs to address shortfalls in information
security technology controls,” according to a summary posted Dec. 22. An outside auditor “issued one
new and four modified-repeat findings in the areas
of vulnerability remediation; privileged account
access; and U.S. Antarctic Program contingency planning, interconnection security agreements, and accreditation packages,” OIG said. (1/5/17)
Call Justin Allbee at 888.580.8373 x 7938 or [email protected] to find out about
our very reasonable rates for bulk subscriptions and site licenses for your entire campus.