1. NIH Risk Management Program Acquisition Assessment Update: R&D Contracts Vendor Pay January 30, 2014

2. Background The current cycle of “Risks Selected for Further Assessment” includes six risks. We are presently assessing two risks focused on acquisition-related processes. These risks are: 1.Research and Development (R&D) Contracts (focused on human subjects and animals protections in research) 2.Vendor Pay Our purpose is to discuss the objectives of this acquisition-related assessment, provide an updated timeline on related activities, and introduce remaining logistical requirements. 1

3. Acquisition-Focused Risks Controls Under Review – R&D Contracts Assessment We have selected 11 controls that span all phases of the R&D contracts acquisition process. These controls reflect the major approvals and documentation required by policy throughout the acquisition life cycle with a particular focus on those relevant to human subjects protection and animal welfare. 2

4. Acquisition-Focused Risks Controls Under Review – R&D Contracts Assessment The following are the 11 controls that will be reviewed as part of the R&D Contracts Assessment. 3

5. Acquisition-Focused Risks Controls Under Review – Vendor Pay Assessment We have selected 6 controls that span the invoice payment process. These controls reflect the major approvals and documentation throughout the acquisition life cycle, in support of the proper payment of invoices. Responsibility for these processes is shared among the Acquisition and Accounts Payable Communities, CORs, and AOs. 4

6. Acquisition-Focused Risks Controls Under Review – Vendor Pay Assessment The following are the 6 controls that will be reviewed as part of the Vendor Pay Assessment. 5

7. Project Next Steps and Timelines We have solicited support to conduct these assessments by requesting access to contract files and invoice processing documents for review. We will utilize the following timeline for conducting the acquisition-focused assessments. 6