Summary

  • GAO found that NIH implemented 14 of 15 selected federal research-security requirements. The remaining institutional-program certification depends on an unfinished interagency arrangement. NIH's enterprise risk-management program met all 15 key considerations GAO assessed.
  • NIH normally relies on researchers' and institutions' disclosures and does not routinely verify them against additional external sources beyond required pre-award checks unless a foreign-interference allegation arrives. In seven selected, nonrepresentative awards, GAO found public affiliation and coauthorship information missing from award files but no clear policy violations.
  • NIH received 697 potential foreign-interference allegations involving personnel on its awards from 2017 to 2025 and found disclosure-policy violations in 264. These are outcomes among allegations, not a rate for all grants. GAO recommended a recurring fraud-risk assessment tailored to NIH's extramural program; NIH agreed and the recommendation remains open.

The compliance checklist is mostly complete

NIH is the largest public funder of biomedical research. In fiscal 2025 it made about $35.3 billion in grants and other extramural research awards, roughly 73% of its total funding. That scale makes its award process an important public gate. Researchers and institutions submit information about support, affiliations and other commitments; NIH screens applications, monitors awards and can open compliance cases. The Government Accountability Office's October 2026 report found NIH had implemented 14 of the 15 selected federal research-security requirements it examined. The remaining requirement, certification that certain recipient institutions operate research-security programs, was delayed while an interagency arrangement was being worked out.

The tally is real. NIH also aligned with every one of the 15 key considerations in GAO's six enterprise risk-management practices. Its forms, certifications, training requirements, sanctions and reporting channels amount to considerable machinery. The machine has a particular operating sequence, however. It relies heavily on what applicants and recipients disclose. Beyond the sources required in pre-award risk assessments, NIH generally does not verify those statements against outside sources until it receives an allegation. It has a well-built door for a tip; GAO asks what happens before anyone rings the bell.

That distinction matters because the risk under examination often begins with information left off a disclosure. NIH does not require every past affiliation to be reported. A foreign component of a grant is reportable when a significant element or segment of NIH-funded work occurs outside the United States. Foreign collaboration, an international coauthor or an affiliation can be entirely legitimate; each must be judged under the applicable rule and dates. A checkbox cannot reveal an omitted item it never asked for, and an allegation-led search cannot measure what no one has thought to allege.

Seven files show the shape of the blind spot

GAO looked closely at seven NIH awards selected because they could illuminate heightened foreign-interference risk. Five were associated with publications that brought together NIH-supported researchers and coauthors at institutions on a Defense Department list; two were awards NIH itself identified because it had already imposed mitigations. The cases were selected deliberately, not randomly. GAO found publicly available information on affiliations and coauthored publications that did not appear in the award documentation it examined. It found no clear violation of NIH policy in those seven cases.

For some affiliations, the active dates were uncertain; for some collaborations, the formal definition of a foreign component may not apply.

Those seven files do something more useful than supply a sensational count: they show how an outside source can add a question that the award file did not contain. NIH officials told GAO they would likely review some personnel after receiving that information. The point is a verification design, not a verdict on those people. If the grant process checks an institution's eligibility and records a declaration but does not test potentially material disclosures against additional public evidence as a routine risk-based practice, it may learn about a gap only after someone else notices it.

The agency has other safeguards. Required pre-award checks examine eligibility information, including restrictions in a federal awards database. NIH controls access to its grant systems and conducts post-award monitoring. A compliance review can use databases and institutional records after an allegation. GAO's finding is narrower and more consequential than a claim that NIH performs no screening: the disclosure-dependent stage lacks a documented decision about which declarations deserve independent verification before a tip arrives.

A numerator without the denominator

From 2017 through 2025, NIH recorded 697 allegations of potential foreign interference involving personnel on its awards. Its Office of Extramural Research found at least one disclosure-policy violation related to potential foreign interference in 264 of those allegations; 433 had no such finding. NIH classified 238 of the 264 as serious violations, with 26 involving only an undisclosed foreign affiliation. The GAO product page gives the current status of its recommendation.

These are the outcomes of allegations received, not a survey of all NIH-funded research. GAO says NIH's data do not estimate the prevalence of foreign interference across its awards, and a disclosure violation does not itself establish theft of research or a fraudulent intent. The number that should guide a preventive control is the risk left after current checks; the allegation ledger cannot provide it. Counting the people who came to the front desk will never tell an agency how many doors its building has.

GAO found NIH fully aligned with general enterprise risk-management practices. It has an annual risk inventory and an agency-level fraud risk profile that names foreign influence. But it has not conducted a documented, recurring fraud-risk assessment tailored to the whole extramural program, mapping specific schemes, existing controls and residual exposure. NIH had assessed a narrower Clinical and Translational Science Awards program, but that is not the same portfolio. It also did not demonstrate that it measures the outcomes of its fraud controls, rather than just their outputs: tips, cases and actions.

That is the missing decision document. A program-specific assessment could say which omissions matter, which sources can reasonably test them, when to verify before an award, and how to judge whether those checks work. GAO recommended a regular, documented extramural fraud-risk assessment that includes foreign interference. NIH agreed. The recommendation is currently open. A future assessment with dated risk choices and measured control results would change the picture.

Until it exists, 14 checked requirements and an excellent enterprise score tell Congress that NIH has a process, but not whether the process asks the right questions of its grant files.

Sources