OMB Circular A-123, Management’s Responsibility OMB Circular A-123, Management’s Responsibility for Internal Controlfor Internal Control

and Internal Control Review Processes for and Internal Control Review Processes for Acquisition and Financial AssistanceAcquisition and Financial Assistance

Kate B. Oliver and Patricia E. CorriganKate B. Oliver and Patricia E. CorriganDOI Office of Acquisition and Property DOI Office of Acquisition and Property

ManagementManagementU.S. Department of the Interior Business U.S. Department of the Interior Business

ConferenceConferenceHunt Valley, MarylandHunt Valley, Maryland

May 24, 2006May 24, 2006

OMB Circular A-123, Management’s OMB Circular A-123, Management’s Responsibility for Internal ControlResponsibility for Internal Control

• Revision Issued:Revision Issued: December 2004 December 2004• Effective:Effective: Beginning in Fiscal Year 2006 Beginning in Fiscal Year 2006• Purpose:Purpose: Provides guidance to Federal managers on Provides guidance to Federal managers on

improving the accountability and effectiveness of Federal improving the accountability and effectiveness of Federal programs and operations by:programs and operations by:

- establishing,- establishing,

- assessing,- assessing,

- correcting, and- correcting, and

- reporting- reporting

on internal control.on internal control.• Authority:Authority: Includes Includes but is not limitedbut is not limited to Federal to Federal

Managers’ Financial Integrity Act of 1982 as codified in 31 Managers’ Financial Integrity Act of 1982 as codified in 31 U.S.C. 3512 U.S.C. 3512

Internal Controls DefinedInternal Controls Defined

• Internal controls are the organization, policies, procedures, actions, Internal controls are the organization, policies, procedures, actions, and activities that management implements to ensure that goals and and activities that management implements to ensure that goals and objectives are met. objectives are met.

• Effective internal control Effective internal control provides provides assuranceassurance that significant that significant weaknessesweaknesses in the design or operation of internal control, that could in the design or operation of internal control, that could adversely affect the agency’s ability to meet its objectives, would beadversely affect the agency’s ability to meet its objectives, would be prevented prevented oror detected detected in a timely manner.in a timely manner.

• Internal control should be an integral part of the Internal control should be an integral part of the entire cycleentire cycle of of planning, budgeting, management, accounting, and auditing. It planning, budgeting, management, accounting, and auditing. It should support the effectiveness and the integrity of should support the effectiveness and the integrity of every stepevery step of the of the process and provide process and provide continual continual feedback to management. feedback to management.

• Internal control – organization, policies, and procedures – are Internal control – organization, policies, and procedures – are toolstools to to help managers achieve results and safeguard the integrity of their help managers achieve results and safeguard the integrity of their programs programs and and it applies to program, operational, and administrative it applies to program, operational, and administrative areas not just accounting and financial management.areas not just accounting and financial management.

Internal Control ObjectivesInternal Control Objectives

• Internal control is an Internal control is an integral component of integral component of an an organization’sorganization’s management management that provides that provides reasonable assurancereasonable assurance that the following that the following objectives objectives are being are being achieved:achieved:

- - Effectiveness and efficiency of program activities Effectiveness and efficiency of program activities and operationsand operations

- Reliable, complete, and timely data are maintained- Reliable, complete, and timely data are maintained

- Compliance with applicable laws and regulations- Compliance with applicable laws and regulations

- Programs and resources are protected from waste, - Programs and resources are protected from waste, fraud, and fraud, and

mismanagementmismanagement

RISKRISK

• Internal control guarantees neither the success of agency Internal control guarantees neither the success of agency programs, nor the absence of waste, fraud, and programs, nor the absence of waste, fraud, and mismanagement, mismanagement, BUTBUT is a means of is a means of managingmanaging the the riskrisk associated with Federal programs and operations.associated with Federal programs and operations.

• Managers should define the control environment (e.g., Managers should define the control environment (e.g., programs, operations, reporting) and perform risk assessments programs, operations, reporting) and perform risk assessments to identify the most significant areas within that environment to identify the most significant areas within that environment in which to place or enhance internal control.in which to place or enhance internal control.

• The risk assessment is a critical step in the process to The risk assessment is a critical step in the process to determine the extent of controls.determine the extent of controls.

• Once significant areas have been identified, control activities Once significant areas have been identified, control activities should be implemented.should be implemented.

• Continuous monitoring and testing should help identify poorly Continuous monitoring and testing should help identify poorly designed or ineffective controls and should be reported.designed or ineffective controls and should be reported.

• Management is then responsible for redesigning or improving Management is then responsible for redesigning or improving upon those controls.upon those controls.

Who is Responsible for Internal Control in Who is Responsible for Internal Control in Federal Agencies?Federal Agencies?

• ManagementManagement has a fundamental responsibility to develop has a fundamental responsibility to develop and maintain effective internal control. The proper and maintain effective internal control. The proper stewardship of Federal resources is an essential stewardship of Federal resources is an essential responsibility of agency managers and staff.responsibility of agency managers and staff.

• Federal employeesFederal employees must ensure that Federal programs must ensure that Federal programs operate and Federal resources are used efficiently and operate and Federal resources are used efficiently and effectively to achieve desired objectives.effectively to achieve desired objectives.

• ProgramsPrograms must operate and resources must be used must operate and resources must be used consistent with agency missions, in compliance with laws consistent with agency missions, in compliance with laws and regulations, and with minimal potential for waste, and regulations, and with minimal potential for waste, fraud, and mismanagement.fraud, and mismanagement.

Actions Required by ManagementActions Required by Management

Agencies and individual Federal managers Agencies and individual Federal managers mustmust take systematic and proactive measures to:take systematic and proactive measures to:

• Develop and implement appropriate, cost-effective internal Develop and implement appropriate, cost-effective internal control for results-oriented management;control for results-oriented management;

• Assess the adequacy of internal control in Federal Assess the adequacy of internal control in Federal programs and operations;programs and operations;

• Identify needed improvements;Identify needed improvements;• Take corresponding corrective action; andTake corresponding corrective action; and• Report annually on internal control through management Report annually on internal control through management

assurance statements.assurance statements.

QUIZQUIZ• Internal control only applies to accounting and financial management. Internal control only applies to accounting and financial management.

(True/False)(True/False)

• Internal control is basically a post-award “inspection”-type process. Internal control is basically a post-award “inspection”-type process. (True/False)(True/False)

• Internal control guarantees the success of agency programs and the Internal control guarantees the success of agency programs and the absence of waste, fraud, and mismanagement. (True/False)absence of waste, fraud, and mismanagement. (True/False)

• OMB Circular A-123 (Revised) states that only Federal managers are OMB Circular A-123 (Revised) states that only Federal managers are responsible for ensuring that Federal programs operate and Federal responsible for ensuring that Federal programs operate and Federal resources are used efficiently and effectively to achieve desired objectives. resources are used efficiently and effectively to achieve desired objectives. (True/False)(True/False)

• Internal control is a means of identifying and managing risk associated Internal control is a means of identifying and managing risk associated with Federal programs and operations. (True/False)with Federal programs and operations. (True/False)

• Internal controls are the organization, policies, procedures, actions, and Internal controls are the organization, policies, procedures, actions, and activities that management implements to ensure that goals and objectives activities that management implements to ensure that goals and objectives are met. (True/False)are met. (True/False)

• Federal managers must report annually on internal control through Federal managers must report annually on internal control through management assurance statements. (True/False)management assurance statements. (True/False)

Internal Control Standards Internal Control Standards – Two Approaches– Two Approaches

OLD CIRCULAR A-123OLD CIRCULAR A-123• General Control StandardsGeneral Control Standards• Compliance with Laws and Compliance with Laws and

RegulationsRegulations• Reasonable Assurance and Reasonable Assurance and

SafeguardsSafeguards• Integrity, Competence, and Integrity, Competence, and

AttitudeAttitude• Specific StandardsSpecific Standards• Delegation of Authority and Delegation of Authority and

OrganizationOrganization• Separation of Duties and Separation of Duties and

SupervisionSupervision• Access to and Accountability for Access to and Accountability for

ResourcesResources• Recording and DocumentationRecording and Documentation• Resolution of Audit Findings and Resolution of Audit Findings and

Other DeficienciesOther Deficiencies

CIRCULAR A-123 (Revised)CIRCULAR A-123 (Revised)

Emphasizes management’s Emphasizes management’s responsibility for developing responsibility for developing and maintaining internal and maintaining internal control activities that comply control activities that comply with standards related to:with standards related to:

• Control EnvironmentControl Environment• Risk AssessmentRisk Assessment• Control ActivitiesControl Activities• Information and Information and

CommunicationsCommunications• MonitoringMonitoring

Control EnvironmentControl Environment

Emphasizes importance of establishing organizational Emphasizes importance of establishing organizational structure and culture by management and employees to structure and culture by management and employees to sustain support for effective internal control. This sustain support for effective internal control. This includes:includes:

• Well defined areas of authority and responsibility;Well defined areas of authority and responsibility;• Appropriate delegation of authority and responsibility throughout the Appropriate delegation of authority and responsibility throughout the

agency;agency;• Establishment of a suitable hierarchy for reporting;Establishment of a suitable hierarchy for reporting;• Supporting appropriate human capital policies for hiring, training, Supporting appropriate human capital policies for hiring, training,

evaluating, counseling, advancing, compensating and disciplining evaluating, counseling, advancing, compensating and disciplining personnel; andpersonnel; and

• Upholding the need for personnel to possess and maintain the proper Upholding the need for personnel to possess and maintain the proper knowledge and skills to perform their assigned duties as well as knowledge and skills to perform their assigned duties as well as understand the importance of maintaining effective internal control understand the importance of maintaining effective internal control within the organization.within the organization.

Control Environment (Continued)Control Environment (Continued)

• The organizational culture is also crucial within The organizational culture is also crucial within the control environment standard. The culture the control environment standard. The culture should be defined by management’s leadership in should be defined by management’s leadership in setting values of integrity and ethical behavior.setting values of integrity and ethical behavior.

• Management’s philosophy and operational style Management’s philosophy and operational style will set the tone within the organization.will set the tone within the organization.

• Management’s commitment to establishing and Management’s commitment to establishing and maintaining effective internal control should maintaining effective internal control should cascade down and permeate the organization’s cascade down and permeate the organization’s control environment which will aid in the control environment which will aid in the successful implementation of internal control successful implementation of internal control systems.systems.

Risk AssessmentRisk Assessment

• Management should identify internal and external Management should identify internal and external risks that may prevent the organization from risks that may prevent the organization from meeting its objectives.meeting its objectives.

• When identifying risks, management should take When identifying risks, management should take into account relevant interactions within the into account relevant interactions within the organization as well as with outside organizations.organization as well as with outside organizations.

• Management should also consider previous Management should also consider previous findings, e.g., auditor identified, internal findings, e.g., auditor identified, internal management reviews, or non-compliance with laws management reviews, or non-compliance with laws and regulations when identifying risks. and regulations when identifying risks.

• Identified risks should then be analyzed for their Identified risks should then be analyzed for their potential effect or impact on the agency.potential effect or impact on the agency.

Control ActivitiesControl Activities

Control activities include policies, procedures and Control activities include policies, procedures and mechanisms in place to address or mitigate risk mechanisms in place to address or mitigate risk and help ensure internal control objectives are and help ensure internal control objectives are met. Examples include:met. Examples include:

• Proper segregation of duties and supervision;Proper segregation of duties and supervision;• Access to and accountability for resources, e.g., Access to and accountability for resources, e.g.,

physical control over assets;physical control over assets;• Appropriate recording and documentation and access Appropriate recording and documentation and access

to that documentation; andto that documentation; and• General and application controls over information General and application controls over information

systemssystems

Information and CommunicationsInformation and Communications

• Information should be communicated to all Information should be communicated to all relevant personnel at all levels within an relevant personnel at all levels within an organization. organization.

• Information should be relevant, reliable, and Information should be relevant, reliable, and timely.timely.

• It is also crucial that an agency communicate It is also crucial that an agency communicate with outside organizations as well, whether with outside organizations as well, whether providing information or receiving it.providing information or receiving it.

• Examples include:Examples include:– Receiving updated guidance from central oversight offices;Receiving updated guidance from central oversight offices;– Management communicating requirements to the operational staff;Management communicating requirements to the operational staff;– Operational staff communicating with the information systems Operational staff communicating with the information systems

staff to modify application software to extract data requested in staff to modify application software to extract data requested in the guidance.the guidance.

Monitoring IMonitoring I

• Monitoring the effectiveness of internal control Monitoring the effectiveness of internal control should occur in the normal course of business.should occur in the normal course of business.

• In addition, periodic reviews, reconciliations or In addition, periodic reviews, reconciliations or comparisons of data should be included as part of the comparisons of data should be included as part of the regular assigned duties of personnel.regular assigned duties of personnel.

• Periodic assessments should be integrated as part of Periodic assessments should be integrated as part of management’s continuous monitoring of internal management’s continuous monitoring of internal control, which should be control, which should be ingrained ingrained in the agency’s in the agency’s operations.operations.

• NEWS FLASH: NEWS FLASH: If an effective continuous monitoring If an effective continuous monitoring program is in place, it can level the resources needed program is in place, it can level the resources needed to maintain effective internal controls throughout the to maintain effective internal controls throughout the year.year.

Monitoring IIMonitoring II

• Deficiencies found in internal control should be reported Deficiencies found in internal control should be reported to the appropriate personnel and management to the appropriate personnel and management responsible for that area.responsible for that area.

Please note, you Please note, you cannotcannot prepare an annual internal control prepare an annual internal control assurance statement for your function if:assurance statement for your function if:

• Deficiencies identified, whether through internal review Deficiencies identified, whether through internal review or by an external audit, are not evaluated and corrected.or by an external audit, are not evaluated and corrected.

• A systematic process is not in place for addressing A systematic process is not in place for addressing deficiencies.deficiencies.

The Old A-123 Standards are Still in the Revised A-123 but The Old A-123 Standards are Still in the Revised A-123 but Instead of Standing Alone as in the Old Process, the Instead of Standing Alone as in the Old Process, the

Standards are Now Grouped and Assessments Can be Made Standards are Now Grouped and Assessments Can be Made Through a More Comprehensive Framework That Better Through a More Comprehensive Framework That Better

Identifies the Sources of Systemic and Compliance Identifies the Sources of Systemic and Compliance WeaknessesWeaknesses

Control EnvironmentRisk Assessment

Control ActivitiesInformation and Communications

Monitoring

Defects/Weaknesses

Potential Causes Effect

GAO Framework for Assessing the Acquisition GAO Framework for Assessing the Acquisition Function at Federal AgenciesFunction at Federal Agencies

• Issued September 2005Issued September 2005• Developed to assess the strengths and Developed to assess the strengths and

weaknesses of agencies’ acquisition functions.weaknesses of agencies’ acquisition functions.• Framework comprises four interrelated Framework comprises four interrelated

cornerstones that promote an efficient, effective, cornerstones that promote an efficient, effective, and accountable acquisition function:and accountable acquisition function:

- Organizational Alignment and Leadership- Organizational Alignment and Leadership

- Policies and Processes- Policies and Processes

- Human Capital- Human Capital

- Knowledge and Information Management- Knowledge and Information Management

Organizational Alignment and LeadershipOrganizational Alignment and Leadership

• Appropriate placement of the acquisition function in the agency, Appropriate placement of the acquisition function in the agency, with stakeholders having clearly defined roles and responsibilities.with stakeholders having clearly defined roles and responsibilities.

• While there is no single, optimal way to organize an agency’s While there is no single, optimal way to organize an agency’s acquisition function, each agency must assess whether the current acquisition function, each agency must assess whether the current placement of its acquisition function is meeting organizational placement of its acquisition function is meeting organizational needs and that any associated risk is identified and mitigated.needs and that any associated risk is identified and mitigated.

• Committed leadership enables officials to make strategic decisions Committed leadership enables officials to make strategic decisions that achieve agency-wide acquisitions more effectively and that achieve agency-wide acquisitions more effectively and efficiently.efficiently.

• Critical success factors to be evaluated/assessed in this area Critical success factors to be evaluated/assessed in this area include:include:

- Assuring appropriate placement of the acquisition function- Assuring appropriate placement of the acquisition function- Organizing the acquisition function to operate strategically- Organizing the acquisition function to operate strategically- Clearly defining and integrating roles and responsibilities- Clearly defining and integrating roles and responsibilities- Clear, strong, and ethical executive leadership- Clear, strong, and ethical executive leadership

- Effective communications and continuous improvement- Effective communications and continuous improvement

Policies and ProcessesPolicies and Processes

• Implementing strategic decisions to achieve desired agency-wide Implementing strategic decisions to achieve desired agency-wide outcomes requires clear and transparent policies and processes that outcomes requires clear and transparent policies and processes that are implemented consistently.are implemented consistently.

• Policies: establish expectations about management of a functionPolicies: establish expectations about management of a function• Processes: means by which management functions will be Processes: means by which management functions will be

performed and implemented in support of agency missions.performed and implemented in support of agency missions.• Effective policies and processes govern the planning, award, Effective policies and processes govern the planning, award,

administration, and oversight of acquisition efforts, with a focus on administration, and oversight of acquisition efforts, with a focus on assuring that these efforts achieve intended results.assuring that these efforts achieve intended results.

• Critical success factors to be evaluated/assessed in this area Critical success factors to be evaluated/assessed in this area include:include:- - Partnering with internal organizationsPartnering with internal organizations- Assessing internal requirements and the impact of external events- Assessing internal requirements and the impact of external events- Managing and engaging suppliers- Managing and engaging suppliers- Monitoring and providing oversight to achieve desired outcomes- Monitoring and providing oversight to achieve desired outcomes- Enabling financial accountability- Enabling financial accountability- Using sound Capital Investment strategies- Using sound Capital Investment strategies

Human CapitalHuman Capital

• Successfully acquiring goods and services and executing and Successfully acquiring goods and services and executing and monitoring contracts to help the agency meet its missions monitoring contracts to help the agency meet its missions requires valuing and investing in the acquisition workforce.requires valuing and investing in the acquisition workforce.

• Agencies must think strategically about attracting, developing, Agencies must think strategically about attracting, developing, and retaining talent, and creating a results-oriented culture and retaining talent, and creating a results-oriented culture within the acquisition workforce.within the acquisition workforce.

• Critical success factors to be evaluated/assessed in this area Critical success factors to be evaluated/assessed in this area include:include:- Commitment to human capital management- Commitment to human capital management

- Integration and alignment - Integration and alignment

- Data-driven human capital decisions- Data-driven human capital decisions

- Targeted investments in people- Targeted investments in people

- Human capital approaches tailored to meet organizational needs- Human capital approaches tailored to meet organizational needs

- Empowerment and inclusiveness- Empowerment and inclusiveness

- Unit and individual performance linked to organizational goals- Unit and individual performance linked to organizational goals

Knowledge and Information ManagementKnowledge and Information Management

• Effective knowledge and information management provides Effective knowledge and information management provides credible, reliable, and timely data to make acquisition decisions.credible, reliable, and timely data to make acquisition decisions.

• Each stakeholder in the acquisition process-program and Each stakeholder in the acquisition process-program and acquisition personnel who decide which goods and services to acquisition personnel who decide which goods and services to buy; project managers who receive goods and services from buy; project managers who receive goods and services from contractors; contract administrators who oversee compliance contractors; contract administrators who oversee compliance with the contracts; finance which pays for the goods and with the contracts; finance which pays for the goods and services; policy and management-need meaningful data to services; policy and management-need meaningful data to perform their respective roles and responsibilities.perform their respective roles and responsibilities.

• Critical success factors to be evaluated/assessed in this area Critical success factors to be evaluated/assessed in this area include:include:- tracking acquisition data- tracking acquisition data

- tracking financial data into meaningful formats- tracking financial data into meaningful formats

- analyzing goods and services spending- analyzing goods and services spending

- safeguarding the integrity of operations and data stewardship- safeguarding the integrity of operations and data stewardship

The GAO Framework is Built on a Foundation of Strong The GAO Framework is Built on a Foundation of Strong Internal Control Which Serves as the First Line of Defense in Internal Control Which Serves as the First Line of Defense in Safeguarding Assets and Preventing and Detecting Errors and Safeguarding Assets and Preventing and Detecting Errors and

WeaknessesWeaknesses

Defects/Weaknesses

Potential Causes

Organizational Alignment

And Leadership

Policies andProcesses (includes

Monitoring Processes)

Human CapitalKnowledge and

Information Management

EEffect

DOI OIG Framework to Promote DOI OIG Framework to Promote Accountability in Interior’s Grants Accountability in Interior’s Grants

ManagementManagement

• Issued: Fall 2005Issued: Fall 2005• Identified internal controls necessary to effectively manage Identified internal controls necessary to effectively manage

grants and create a culture of accountability and grants and create a culture of accountability and stewardship:stewardship:

- Produce Reliable Data- Produce Reliable Data

- Solicit Competition- Solicit Competition

- Monitor Grants Effectively- Monitor Grants Effectively

- Write Effective Grant Agreements- Write Effective Grant Agreements

- Provide Adequate Training- Provide Adequate Training

- Streamline Policies and Procedures- Streamline Policies and Procedures

- Establish Measurable Goals (performance metrics)- Establish Measurable Goals (performance metrics)

Each One of the Controls Identified in the OIG Each One of the Controls Identified in the OIG Framework Fits Into at Least One of the Four Major Framework Fits Into at Least One of the Four Major

Standard Categories Identified Below Standard Categories Identified Below

Defects/Weaknesses, e.g. Lack of

Accountability and

Transparency

Potential Causes Effect

OrganizationalAlignment and

Leadership

Human Capital

Policies andProcesses (Includes

Monitoring Processes)

Knowledge andInformation Management

Assessing Internal ControlAssessing Internal Control

• In conducting your reviews of internal control in the acquisition In conducting your reviews of internal control in the acquisition and financial assistance functions, use the standards in the GAO and financial assistance functions, use the standards in the GAO and OIG frameworks as the “lens” or the evaluation factors with and OIG frameworks as the “lens” or the evaluation factors with which to assess the functions, identify areas of risk and which to assess the functions, identify areas of risk and weakness, and develop and implement corrective action plans.weakness, and develop and implement corrective action plans.

• Additional sources of information in preparing for and conducting Additional sources of information in preparing for and conducting reviews include:reviews include:– Knowledge gained from the daily operation of programs and systemsKnowledge gained from the daily operation of programs and systems– OIG and GAO reports, including audits, inspections, reviews, investigationsOIG and GAO reports, including audits, inspections, reviews, investigations– Management reviews conducted (i) expressly for the purpose of assessing Management reviews conducted (i) expressly for the purpose of assessing

internal control, or (ii) for other internal control, or (ii) for other purposes with an assessment of internal purposes with an assessment of internal control as a by-product of the reviewcontrol as a by-product of the review

– Program evaluations, past reviews, corrective action plansProgram evaluations, past reviews, corrective action plans– Annual performance plans and reports pursuant to GPRAAnnual performance plans and reports pursuant to GPRA– Single Audit reports (for financial assistance)Single Audit reports (for financial assistance)– The agency’s Performance and Accountability ReportThe agency’s Performance and Accountability Report– Agency Budget and Strategic PlanAgency Budget and Strategic Plan– Performance plansPerformance plans

Assessing Internal ControlAssessing Internal Control

• Identify deficiencies from reviews and other sources of information described Identify deficiencies from reviews and other sources of information described above.above.

• Report deficiencies in accordance with annual guidelines, e.g., PFM’s Report deficiencies in accordance with annual guidelines, e.g., PFM’s Guidelines for FY 2006 Internal Control and Audit Follow-up Programs, as Guidelines for FY 2006 Internal Control and Audit Follow-up Programs, as supplemented by PAM’s FY 2006 Internal Control/Departmental Functional supplemented by PAM’s FY 2006 Internal Control/Departmental Functional Review Guidance for Acquisition, Financial Assistance, and Property Review Guidance for Acquisition, Financial Assistance, and Property Management.Management.

• A control deficiency or combination of control deficiencies that in A control deficiency or combination of control deficiencies that in management’s judgment represents significant deficiencies in the design or management’s judgment represents significant deficiencies in the design or operation of internal control that could adversely affect the function’s ability to operation of internal control that could adversely affect the function’s ability to meet its internal control objectives is a meet its internal control objectives is a reportable condition reportable condition (to be tracked (to be tracked and monitored within the bureau).and monitored within the bureau).

• A reportable condition that the agency head determines to be significant A reportable condition that the agency head determines to be significant enough to be reported outside the agency shall be considered a enough to be reported outside the agency shall be considered a material material weaknessweakness..

• Managers and staff are encouraged to identify control deficiencies, as this Managers and staff are encouraged to identify control deficiencies, as this reflects positively on the bureau’s commitment to recognizing and addressing reflects positively on the bureau’s commitment to recognizing and addressing management problems. Failing to report a known reportable condition reflects management problems. Failing to report a known reportable condition reflects adversely on the bureau and continues to place its operations at risk..adversely on the bureau and continues to place its operations at risk..

Assessing Internal ControlAssessing Internal Control

• In preparing their reports and assurance statements, bureaus In preparing their reports and assurance statements, bureaus must carefully compare and review the results of all the reviews must carefully compare and review the results of all the reviews conducted during the reporting cycle and consider whether conducted during the reporting cycle and consider whether systemic weaknesses exist that adversely affect internal control systemic weaknesses exist that adversely affect internal control across organizational or program lines. They must then develop across organizational or program lines. They must then develop a plan of action for addressing these types of weaknesses in a plan of action for addressing these types of weaknesses in addition to the individual corrective action plans resulting from addition to the individual corrective action plans resulting from each review.each review.

Correcting Internal Control DeficienciesCorrecting Internal Control Deficiencies

• Corrective actions plans must be developed to correct Corrective actions plans must be developed to correct deficiencies identified in reviews.deficiencies identified in reviews.

• Managers are responsible for taking timely and effective action to Managers are responsible for taking timely and effective action to implement corrective actions.implement corrective actions.

• Progress must be tracked at the appropriate level to ensure Progress must be tracked at the appropriate level to ensure timely and effective results.timely and effective results.

• Completion of material weakness corrective action plans must be Completion of material weakness corrective action plans must be reviewed and validated by the DOI Office of Financial reviewed and validated by the DOI Office of Financial Management and/or OIG staff. Therefore, bureaus/offices are Management and/or OIG staff. Therefore, bureaus/offices are expected to maintain appropriate supporting documentation expected to maintain appropriate supporting documentation regarding corrective action plan implementation in order to regarding corrective action plan implementation in order to support closure.support closure.

Reporting on Internal ControlReporting on Internal Control

• DOI has established an integrated organizational structure to DOI has established an integrated organizational structure to implement its internal control program. This structure uses the implement its internal control program. This structure uses the building block principle: It starts with the individual program building block principle: It starts with the individual program manager and ascends to the Bureau and Office Director, to the manager and ascends to the Bureau and Office Director, to the program assistant secretary, and ultimately to the Secretary.program assistant secretary, and ultimately to the Secretary.

• Bureaus and offices should ensure that subordinate managers Bureaus and offices should ensure that subordinate managers provide assurance statements to support the Bureau or Office provide assurance statements to support the Bureau or Office Director’s assurance to the program assistant secretary.Director’s assurance to the program assistant secretary.

• As indicated in the 2006 Internal Control/Departmental Functional As indicated in the 2006 Internal Control/Departmental Functional Review Guidance for Acquisition, Financial Assistance, and Review Guidance for Acquisition, Financial Assistance, and Property Management, Bureau and office acquisition managers Property Management, Bureau and office acquisition managers must coordinate issuance of their annual internal control must coordinate issuance of their annual internal control assessment report with their respective Bureau Management assessment report with their respective Bureau Management Control Coordinator and ensure that their reports are signed by the Control Coordinator and ensure that their reports are signed by the Assistant Director – Administration, or bureau equivalent, prior to Assistant Director – Administration, or bureau equivalent, prior to submission to the Office of Acquisition and Property Management. submission to the Office of Acquisition and Property Management.

Reporting on Internal ControlReporting on Internal Control

• Bureau internal control assessment reports for both acquisition Bureau internal control assessment reports for both acquisition and financial assistance must include the following:and financial assistance must include the following:

– findings of management reviews performed and corrective findings of management reviews performed and corrective action plans implemented (including timeframes for complete action plans implemented (including timeframes for complete implementation of corrective actions);implementation of corrective actions);

– summary findings of applicable OIG, GAO, and third party summary findings of applicable OIG, GAO, and third party Notices of Finding and Recommendations, and corrective plans Notices of Finding and Recommendations, and corrective plans implemented (including timeframes for complete implemented (including timeframes for complete implementation of corrective actions);implementation of corrective actions);

– bureau-wide targets review and supplementary reports; andbureau-wide targets review and supplementary reports; and– an assurance statement regarding the adequacy of bureau-wide an assurance statement regarding the adequacy of bureau-wide

internal controls, i.e., assurance that processes are in place for internal controls, i.e., assurance that processes are in place for the bureaus to: (1) prevent or promptly detect unauthorized the bureaus to: (1) prevent or promptly detect unauthorized acquisition, use, or disposition of assets; and (2) implement and acquisition, use, or disposition of assets; and (2) implement and monitor corrective actions for identified compliance or systemic monitor corrective actions for identified compliance or systemic weaknesses in order to bring identified weaknesses in bureau weaknesses in order to bring identified weaknesses in bureau acquisition and financial assistance processes/procedures into acquisition and financial assistance processes/procedures into compliance with applicable laws, regulations, and policy.compliance with applicable laws, regulations, and policy.

Assurance StatementsAssurance Statements

• Bureaus/offices have two assurance statement requirements Bureaus/offices have two assurance statement requirements during FY 2006:during FY 2006:

1.1. Assurance statement on the effectiveness of internal controls Assurance statement on the effectiveness of internal controls over financial reporting as of 06/30/2006 due to the Assistant over financial reporting as of 06/30/2006 due to the Assistant Secretary – Policy, Management and Budget (AS/PMB) and the Secretary – Policy, Management and Budget (AS/PMB) and the Office of Financial Management by July 31, 2006; andOffice of Financial Management by July 31, 2006; and

2.2. FY 2006 Final Assurance Statement covering all programs and FY 2006 Final Assurance Statement covering all programs and operations is due to the AS/PMB and Office of Financial operations is due to the AS/PMB and Office of Financial Management on or before September 15, 2006.Management on or before September 15, 2006.

• The assurance statements that you prepare for acquisition, The assurance statements that you prepare for acquisition, financial assistance, and property management must be included financial assistance, and property management must be included in your bureau’s/office’s Final Assurance Statement covering all in your bureau’s/office’s Final Assurance Statement covering all programs and operations, i.e., Assurance Statement #2.programs and operations, i.e., Assurance Statement #2.

Assurance QUIZ – Double Assurance QUIZ – Double JeopardyJeopardy

Management is required to: Management is required to:

a.a. Provide Provide absoluteabsolute assurance of internal control assurance of internal controlOROR

b. Provide b. Provide reasonablereasonable assurance of internal control assurance of internal control

ANSWER: b - Provide ANSWER: b - Provide reasonablereasonable assurance of assurance of internal controlinternal control.

Reasonable assurance that internal control processes Reasonable assurance that internal control processes are in place for the bureaus to: (1) prevent or promptly are in place for the bureaus to: (1) prevent or promptly detect unauthorized acquisition, use, or disposition of detect unauthorized acquisition, use, or disposition of assets; and (2) implement and monitor corrective assets; and (2) implement and monitor corrective actions for identified compliance or systemic actions for identified compliance or systemic weaknesses in order to bring identified weaknesses in weaknesses in order to bring identified weaknesses in bureau acquisition and financial assistance bureau acquisition and financial assistance processes/procedures into compliance with applicable processes/procedures into compliance with applicable laws, regulations, and policy.laws, regulations, and policy.

RESOURCESRESOURCES• DOI Office of Acquisition and Property Management Website:DOI Office of Acquisition and Property Management Website:

http://www.doi.gov/pamhttp://www.doi.gov/pam (GAO Framework can be accessed (GAO Framework can be accessed under “Acquisition”)under “Acquisition”)

• DOI Office of Financial Management Website: DOI Office of Financial Management Website: http://www.doi.gov/pfmhttp://www.doi.gov/pfm

• DOI Office of Inspector General Website: DOI Office of Inspector General Website: http://www.oig.doi.govhttp://www.oig.doi.gov

• Office of Management and Budget Website: Office of Management and Budget Website: http://www..whitehouse.gov/ombhttp://www..whitehouse.gov/omb

• Government Accountability Office Website: Government Accountability Office Website: http://www.gao.govhttp://www.gao.gov