Mr. Chair, there were two types of risk assessments done: one was for recipients and one was for projects. We found that the agency not only did the recipient risk assessment in terms of whether it was a high, medium, or low risk, but also did an analysis that justified the reason for the categorization. Alternatively, on the other side with the project risk assessments, although we found that they also designated each project as a high, medium, or low, there was not the analysis to back that up.
On December 4th, 2014. See this statement in context.