Why It Matters
The National Institutes of Health (NIH) lacks a documented, extramural-program-specific fraud risk assessment, so it has no documented basis for determining whether its controls address the most significant fraud risks, a Government Accountability Office report found.
NIH awarded about $35 billion in extramural funding in fiscal year 2025 alone, and the agency's reliance on self-reported disclosures, without routine verification against outside sources, means risks can go undetected when relevant information is not required or is simply omitted.
The Big Picture
The U.S. has long maintained an open and collaborative research environment, but policymakers have raised concerns that foreign countries and entities may exploit that openness to misappropriate federally funded research, undermining national security and economic competitiveness.
Federal research security requirements, which apply across federal research agencies, address disclosures, malign foreign talent recruitment programs, research security training and programs, and collaboration and information sharing. These requirements apply across federal research agencies, and NIH has implemented 14 of the 15 that GAO reviewed.
NIH implemented 14 of the 15 federal research security requirements the U.S. Government Accountability Office (GAO) reviewed, leaving one requirement unmet: certification by certain recipient institutions that they have established and operate research security programs.
NIH is still working with an interagency group to implement the one requirement it has not yet met: certification by certain recipient institutions that they have established and operate research security programs.
GAO reviewed relevant legal authorities, policies, and NIH documentation; analyzed NIH foreign interference allegation data from 2017 through 2025; conducted seven non-generalizable case studies of NIH awards selected based on their potential for heightened foreign interference risk; and interviewed NIH and Department of Health and Human Services (HHS) officials.
In those case studies, GAO used outside sources to identify publicly available information about foreign affiliations and coauthored publications that did not appear in award documentation, illustrating potential limitations of NIH's disclosure-based process, though the cases do not establish the prevalence of undisclosed information or foreign interference across NIH awards.
From 2017 through 2025, NIH received 697 allegations of potential foreign interference involving personnel on NIH awards and identified disclosure violations in 264 of those cases. Of the 264 cases where violations were found, NIH or recipient institutions took action in 223 and took no action in 41. Violations were identified in roughly 38 percent of all allegations received over that period.
NIH's risk management program fully aligned with GAO's enterprise risk management practices but not with GAO's Fraud Risk Framework. NIH's annual risk inventory considered fraud but was not a documented extramural-program-specific assessment of fraud schemes, controls, and residual risks, leaving the agency without a documented basis for determining whether its controls address the most significant fraud risks as they evolve.
The Bottom Line
NIH received one recommendation: the Director of NIH should conduct and document, at regular intervals and in accordance with GAO's Fraud Risk Framework, a fraud risk assessment tailored to NIH's extramural research program that considers foreign interference risks.
NIH concurred with the GAO recommendation, and the recommendation remains open, with actions to satisfy it either not yet taken or still being planned, according to the report publicly released on Oct. 16.
A linked invitation to track related legislative activity on Legis1
Access the Legis1 platform for comprehensive political news, data, and insights.
Spot something wrong? Report an issue with this article
