OIG Reports

An OIG report is any audit, evaluation, investigation, or periodic report published by a federal agency's Office of Inspector General (OIG) -- an independent oversight unit created under the Inspector General Act of 1978 -- documenting findings, recommendations, questioned costs, or enforcement referrals concerning that agency's own programs, operations, grantees, or contractors.

ByCASRAI Editorial Board

· Last updated 17 Jul 2026

Worked examples

Is an instance

HHS-OIG's Office of Audit Services publishes an audit report finding that a university claimed unallowable salary costs on an NIH grant and recommends the institution refund a specific questioned-costs amount to the federal government.

Is an instance

NSF-OIG's Semiannual Report to Congress summarizes the audits, investigations, and cost-disallowance recommendations closed across NSF-funded institutions during the six-month reporting period.

An OIG report is any audit, evaluation, investigation, or periodic report issued by a federal agency’s Office of Inspector General (OIG) — an independent oversight unit, created within (but organizationally separate from) that agency, that examines the agency’s own programs, operations, grantees, and contractors for fraud, waste, abuse, and mismanagement. For research administrators, OIG reports matter most when they concern a specific institution’s federal awards (an audit finding that triggers a cost disallowance) or when they signal where an OIG intends to focus scrutiny next (a Work Plan entry that should shape internal compliance priorities).

What an OIG Actually Is

Offices of Inspector General were established government-wide by the Inspector General Act of 1978 (Pub. L. 95-452), which created independent units, each headed by an Inspector General, with a statutory mandate to conduct and supervise audits and investigations, promote economy and efficiency, and detect and prevent fraud and abuse in that agency’s programs. The Act protects that independence directly: neither the agency head nor anyone in the chain below them may prevent an Inspector General from starting, continuing, or completing an audit or investigation, or from issuing a subpoena. Most agencies that award federal research funding have their own OIG — HHS-OIG (covering NIH and other HHS operating divisions), NSF-OIG, and comparable offices at DOE, USDA, NASA, and DoD among others. Since 2008, the Council of the Inspectors General on Integrity and Efficiency (CIGIE), created by the Inspector General Reform Act of 2008, coordinates standards and cross-agency work across the roughly 70+ federal OIGs.

An OIG is not the same body as the Government Accountability Office (GAO) — a common point of confusion. GAO is a legislative-branch agency that works for Congress and reviews programs across the entire federal government; an OIG is embedded within a single executive-branch agency and reports on that agency’s own operations and award recipients specifically.

Main Types of OIG Reports Research Administrators Should Know

Audit reports on grantee institutions

OIG audit offices (e.g., HHS-OIG’s Office of Audit Services) conduct or oversee audits of specific universities, hospitals, and other award recipients — reviewing whether costs charged to a federal grant were allowable, allocable, and adequately documented under 2 CFR 200 (Uniform Guidance). A published audit report typically states questioned costs the auditor believes were improperly charged and a recommendation that the funding agency disallow and recover some or all of that amount. The awarding agency, not OIG itself, makes the final disallowance determination and is generally expected to resolve audit recommendations within a set period after the report is issued.

Semiannual Reports to Congress

The Inspector General Act requires every OIG to report to its agency head and to Congress twice a year, covering the six-month periods ending March 31 and September 30. These Semiannual Reports to Congress summarize audits and investigations completed, questioned costs and recommended disallowances, funds recommended for better use, and investigative outcomes across the whole reporting period — a useful single document for seeing an agency OIG’s overall enforcement posture, not just one institution’s exposure.

Work Plans

Many OIGs (HHS-OIG’s is the most closely watched in the health-research space) publish a forward-looking Work Plan listing the audits, evaluations, and reviews currently planned or underway. It is not itself an enforcement action, but it is the clearest public signal of where that OIG intends to look next — grant-compliance offices routinely cross-check active Work Plan items against their own award portfolio to anticipate risk.

Compliance guidance and fraud alerts

Some OIGs — HHS-OIG is the primary example relevant to research institutions with clinical or health-services activity — also issue non-audit guidance under separate statutory authority: Special Fraud Alerts and General Compliance Program Guidance describing practices OIG considers legally suspect (for example, certain financial arrangements between institutions and referral sources). These are advisory rather than case-specific findings, but institutions use them the same way they use Work Plans: as a map of where a regulator’s attention already is.

Investigative reports and evaluations

OIGs also conduct investigations (potential criminal or civil fraud, often referred to the Department of Justice, including False Claims Act referrals) and program evaluations (broader assessments of whether an agency program or process is working as intended, short of a financial audit). Investigative outcomes are usually summarized in the Semiannual Report rather than published as standalone institution-specific documents, for legal reasons.

Why Institutions Track OIG Reports

Two distinct reasons drive most sponsored-programs offices to monitor OIG output, even when their own institution isn’t the audit subject:

Direct exposure: an OIG audit finding against your own institution can trigger a real cost disallowance — a demand to return federal funds — plus, in serious cases (falsified data, knowing misrepresentation), referral for False Claims Act liability, which carries treble damages and per-claim penalties well beyond the disallowed amount itself.
Risk benchmarking: published OIG audit reports and Work Plan entries function as a real-world map of where federal audit scrutiny concentrates — effort reporting, subrecipient monitoring, cost transfers, time-and-effort certification, foreign-support disclosure, indirect cost rate application. Compliance offices routinely use recent OIG findings at peer institutions as the basis for their own internal-controls testing and training priorities, rather than waiting to be the audit subject themselves.

Where to Find OIG Reports

Oversight.gov, launched by CIGIE in 2017, is the single searchable clearinghouse for public reports from every CIGIE-member federal OIG — audits, evaluations, investigations, and Semiannual Reports, dating back to 2000. For research-funding purposes specifically, the two most relevant individual sites are oig.hhs.gov/reports (HHS-OIG, covering NIH and other HHS operating divisions) and oig.nsf.gov (NSF-OIG).

Frequently Asked Questions

Is an OIG audit report the same as a Single Audit?

No. A Single Audit is an annual, organization-wide audit every non-federal entity above a funding threshold must arrange for itself under 2 CFR 200 Subpart F. An OIG audit is a targeted review an agency’s own Inspector General initiates — often prompted by a Single Audit finding, a complaint, or a Work Plan item — and can happen independently of, and in addition to, an institution’s Single Audit cycle.

What happens after an OIG audit finding?

The report is issued with recommendations (typically including a specific disallowance amount); the institution is invited to respond, often included as an appendix to the final report; and the awarding agency — not OIG itself — issues the final management decision on whether, and how much, to recover.

Does every federal funding agency have an OIG?

Most do, but not every small agency. Where an agency lacks its own statutory IG, oversight may be handled by a “Designated Federal Entity” IG structure or another agency’s OIG under an interagency agreement — check the specific funder before assuming coverage.