Robert F. Fairweather, M-21-19 Memorandum for Heads of Executive Departments and Agencies (2021)
“ If a program that is on a three-year IP risk assessment cycle experiences a significant change in legislation and/or a significant increase in its funding level, agencies may need to reassess the program’s risk susceptibility during the next annual cycle, even if it is less than three years from the last IP risk assessment. Examples of events that may trigger an off-cycle risk assessment include but are not limited to, national disasters, national emergencies, or a change to program structure that increases payment integrity risk. ”
