GAO urges NIH to add fraud risk assessment for foreign interference
The recommendation targets the National Institutes of Health and requires its director to act, pending NIH's response.
The Government Accountability Office issued a recommendation that the Director of the National Institutes of Health conduct and document a fraud risk assessment tailored to the agency's extramural research program and that considers foreign interference risks. The recommendation, identified as Recommendation 1 in GAO report GAO-27-107848, remains open.
GAO found that NIH has implemented 14 of the 15 federal research security requirements it reviewed, covering disclosure, malign foreign talent recruitment, training, and information sharing. The agency is still working with an interagency group to meet the remaining requirement concerning certification by certain recipient institutions that they have established and operate research security programs.
NIH's current risk management relies heavily on self-reported disclosures from researchers and institutions and does not routinely verify those disclosures unless a foreign interference allegation is received. From 2017 through 2025, NIH recorded 697 allegations of potential foreign interference, identified violations in 264 cases, and took actions in 223 of those cases, such as prohibiting individuals from participating on awards.
In fiscal year 2025 alone, NIH awarded about $35 billion in extramural funding, underscoring the scale of the research enterprise that could be vulnerable to undisclosed foreign affiliations. GAO noted that NIH's annual risk inventory includes fraud but lacks a documented, program-specific assessment of fraud schemes, controls, and residual risks, limiting the agency's ability to adjust controls as risks evolve.
NIH concurred with the recommendation and has not yet reported the completion of the required assessment. GAO will update the status when NIH confirms the actions taken.
Further reading