NIH Risk Management Program

1. NIH Risk Management Program Acquisition Assessment Update: R&D Contracts Vendor Pay January 30, 2014

2. Background • The current cycle of “Risks Selected for Further Assessment” includes six risks. We are presently assessing two risks focused on acquisition-related processes. These risks are: • Research and Development (R&D) Contracts (focused on human subjects and animals protections in research) • Vendor Pay • Our purpose is to discuss the objectives of this acquisition-related assessment, provide an updated timeline on related activities, and introduce remaining logistical requirements.

3. Acquisition-Focused Risks Controls Under Review – R&D Contracts Assessment • We have selected 11 controls that span all phases of the R&D contracts acquisition process. • These controls reflect the major approvals and documentation required by policy throughout the acquisition life cycle with a particular focus on those relevant to human subjects protection and animal welfare.

4. Acquisition-Focused RisksControls Under Review – R&D Contracts Assessment The following are the 11 controls that will be reviewed as part of the R&D Contracts Assessment.

5. Acquisition-Focused Risks Controls Under Review – Vendor Pay Assessment • We have selected 6 controls that span the invoice payment process. • These controls reflect the major approvals and documentation throughout the acquisition life cycle, in support of the proper payment of invoices. • Responsibility for these processes is shared among the Acquisition and Accounts Payable Communities, CORs, and AOs.

6. Acquisition-Focused RisksControls Under Review – Vendor Pay Assessment The following are the 6 controls that will be reviewed as part of the Vendor Pay Assessment.

7. Project Next Steps and Timelines • We have solicited support to conduct these assessments by requesting access to contract files and invoice processing documents for review. • We will utilize the following timeline for conducting the acquisition-focused assessments.