ACCOUNTING PRINCIPLES AND STANDARDS HANDBOOK

# CHAPTER 6. INTERNAL CONTROLS

# Section 1.0 General

This chapter describes the internal controls designed to protect
resources against waste, loss, and misuse while ensuring that timely,
reliable data are obtained, maintained, and fairly disclosed. Internal
controls are safeguards built into a process or work flow to provide
reasonable assurance to management that the system is working as
intended and that resources are used in the most effective and efficient
manner possible.

What constitutes an effective control system may vary with
circumstances. Senior bureau management officials are responsible for
adequate management controls in their bureaus. They should establish an
environment that creates the appropriate control awareness, attitude,
and discipline. Each management control system should be designed to fit
the organization and its operating philosophy, focus on areas of
inherent risk, and achieve a thoughtful balance between control costs
and benefits. Management control systems should provide reasonable, but
not absolute, assurance that the objectives of the system will be
accomplished. This concept recognizes that the cost of management
controls should not exceed the benefits to be derived from them, i.e.,
that the marginal costs of the planned controls do not exceed the
marginal benefits to be derived.

# Section 2.0 Authority

In addition to this chapter, the following laws, regulations, and
guidelines are relevant to the bureau's system of internal control:

> a\. [Federal Managers' Financial Integrity
> Act](http://www.whitehouse.gov/omb/financial/fmfia1982.html)
> (P.L.97-255), (31 U.S.C. Secs. 1105, 1106, 1108, 1113, 3512);
>
> b\. [Government Performance and Results Act of
> 1993](http://govinfo.library.unt.edu/npr/library/misc/s20.html) (P.L.
> 103-62), (5 U.S.C. Sec. 306), (31 U.S.C. Secs. 1115-1119), (39 U.S.C.
> Secs. 2801-2805);
>
> c\. [GAO Standards for Internal Control in the Federal
> Government;](http://www.gao.gov/special.pubs/ai2131.pdf)
>
> d\. [Office of Management and Budget (OMB) Circular A-123,
> \"Management Accountability and
> Control;\"](http://www.whitehouse.gov/omb/circulars/index.html) and
>
> e\. [Department Administrative Order (DAO) 216-15, \"Internal
> Management
> Control.\"](http://204.193.232.34/cgi-bin/doit.cgi?205:112:b8aaf989f8d2b3faa25bc06d588259602f2848051e697bb18a84f603496ae8a1)

# Section 3.0 Responsibility

Bureau finance officers and program financial system managers are
responsible for ensuring that adequate internal controls are established
and maintained in all activities under their control. Accounting systems
include all systems and subsystems that process and record transactions,
track and control assets and other resources, make disbursements,
receive payments, and/or produce financial reports.

Responsibility for preventing fraud and waste is not solely confined to
financial or internal audit personnel. Each manager and supervisor,
whether they are in accounting, administration, program, or budget, is
responsible for management controls. A sound management control process
is a dynamic, cost-saving management tool. Management control programs
must anticipate and prevent (as well as detect and correct) errors,
irregularities, and mismanagement.

The Accounting and Auditing Act of 1950 (P.L. 97-258, as amended by 32
U.S.C. Sec. 3512) requires the head of each agency to establish and
maintain adequate systems of internal control. The Federal Managers
Financial Integrity Act (FMFIA) of 1982 amended the former Act to
require ongoing evaluations and reports on the adequacy of the systems
of internal control of each executive agency. At the bureau level, the
management controls should provide reasonable assurance that:

> a\. Obligations and costs are in compliance with applicable laws;
>
> b\. Funds, property, and other assets are safeguarded against waste,
> loss, unauthorized use, or misappropriation;
>
> c\. Revenues and expenditures applicable to agency operations are
> properly recorded and accounted for to permit the preparation of
> accounts and reliable financial and statistical reports, and to
> maintain accountability over the assets; and
>
> d\. Programs are efficiently and effectively carried out in accordance
> with law and management policy.

[OMB Circular
A-123](http://www.whitehouse.gov/omb/circulars/index.html), as revised
in December 2004, defines management\'s responsibility for internal
control in Federal agencies. The circular emphasizes the need for
agencies to integrate and coordinate internal control assessments with
other internal control-related activities. Annually, management must
provide assurances on internal control in its Performance and
Accountability Report, including a separate assurance on internal
control over financial reporting, along with a report on identified
material weaknesses and corrective actions.

# Section 4.0 Oversight

The FMFIA requires each Department or agency head to provide reasonable
assurance on the adequacy of the organization's system of management
controls in an annual FMFIA report to the President and the Congress. To
comply with this requirement, each agency should conduct continuous
evaluations of its management control systems and such evaluations will
form the basis of the annual report. OMB Circular A-123 states that the
head of each agency is responsible for designing, installing,
evaluating, improving, and reporting on the agency's management control
systems. The agency head is specifically required to:

> a\. Designate a senior official who will be responsible for
> coordinating the overall agency wide efforts of evaluating, improving,
> and reporting on management control systems.
>
> b\. Issue management control directives to establish specific
> responsibilities for seeing that agency management control systems are
> developed, maintained, evaluated, improved, and reported.
>
> c\. Provide for coordination among principal participants, i.e., the
> designated management control official, heads of organization units
> including the Inspector General, and program and technical staff.
>
> d\. Assign responsibility for management control to appropriate levels
> of management in each agency component.
>
> e\. Perform (at least once every five (5) years or as program changes
> require) risk assessments providing a preliminary review of the
> susceptibility of a program or function to waste, loss, unauthorized
> use, or misappropriation of all agency components and assessable
> units.
>
> f\. Provide for detailed examination of the system of internal
> controls to determine whether adequate control measures exist and are
> implemented to prevent or detect the occurrence of potential risks in
> a cost effective manner.
>
> g\. Identify areas which have high inherent potential for waste, loss,
> abuse, unauthorized use, or misappropriation due to the nature of the
> activity itself, and give priority to designing and implementing
> timely corrective action for material weaknesses identified within
> those areas.
>
> h\. Establish a formal follow-up system to record and track the
> implementation of corrective actions associated with the resolution of
> material deficiencies.

The Inspector General (or the senior audit official if there is no
Inspector General) should provide technical assistance in the agency
effort to evaluate and improve internal controls. The Inspector General
is also responsible for the review of management control systems as part
of its normal audit process.

The Government Accountability Office (GAO) also audits the agencies'
efforts to comply with the FMFIA. OMB reviews the annual FMFIA reports
of agencies and meets with appropriate agency personnel to ensure
compliance with FMFIA and OMB Circulars A-123 and A-127. OMB works
particularly close with those agencies reporting high risk areas.

Within the Department, the Director of Management and Organization is
responsible for internal controls, audit follow-up, and liaison
activities pursuant to DOO 20-7. The Director for Financial Management
(Deputy CFO) is responsible for financial internal controls pursuant to
DOO 20-27, as amended.

# Section 5.0 General Standards

The following standards, as prescribed by GAO's Standards for Internal
Control in the Federal Government, represent the minimum level of
quality acceptance for internal control and provide the basis against
which Departmental internal control is to be evaluated:

> .01 [Control Environment]{.underline}
>
> Management and employees should establish and maintain an environment
> throughout the department that sets a positive and supportive attitude
> toward internal control and conscientious management.
>
> The following are key factors affecting the control environment:

1.  Integrity and ethical values maintained and demonstrated by
    management and staff;

2.  Management's commitment to competence;

3.  Management's philosophy and operating style;

4.  Agency's organizational structure;

5.  Delegation of authority and responsibility throughout the
    organization;

6.  Human capital policies and practices;

7.  External relationship, i.e., with Congress and central oversight
    agencies such as OMB, Treasury, etc.; and

> 8\. Internal senior management councils and the Office of the
> Inspector General.
>
> .02 [Risk Assessment]{.underline}
>
> Internal control should provide for an assessment of the risks the
> agency faces from external and internal sources. Risk assessment can
> be accomplished through the following:
>
> a\. Establishment of clear, consistent agency objectives;
>
> b\. Identification and analysis of risks associated with achieving
> such agency objectives; and
>
> c\. Formation of a basis for determining how risks should be managed.
>
> .03 [Control Activities]{.underline}
>
> Internal control activities help ensure that management's directives
> are carried out. The control activities should be effective and
> efficient in accomplishing the agency's control objectives. Control
> activities include policies, procedures, techniques, and mechanisms
> put in place to ensure adherence to requirements established by these
> management directives.
>
> Internal control activities also include special control activities
> for information systems. They apply to all information systems
> including mainframe, minicomputer, network, and end-user environments;
> and the processing of transactions within the application software.
>
> .04 [Information and Communications]{.underline}
>
> Information should be recorded and communicated to management and
> others within the entity who need it, and in a form and within a time
> frame that enables them to carry out their internal control and other
> responsibilities.
>
> Information pertinent to external as well as internal events must be
> relevant, reliable, and timely. Information must be communicated
> effectively with data flowing down, across and up the organization.
> Management should ensure that means of communication are adequate.
>
> .05 [Monitoring]{.underline}
>
> Internal control monitoring should assess the quality of performance
> over time and ensure that the findings of audits and other reviews are
> promptly resolved. Monitoring should be performed continually and be
> ingrained in the agency operations.
>
> Monitoring includes regular management and supervisory activities,
> comparisons, reconciliations, and other actions people take in
> performing their duties. It can take the form of self-assessment. It
> should include policies and procedures to ensure that audit findings
> are resolved in a timely manner and proper actions are taken to
> correct deficiencies, produce improvements, or demonstrate audit
> findings and recommendations do not warrant management actions.

# Section 6.0 Accounting Control Activities

The following accounting control activities are prescribed for bureau
accounting systems, subsidiary accounting systems, and program financial
systems:

> .01 [Documentation]{.underline}
>
> a\. All transactions, processing procedures, and systems of
> administrative controls, and other internal controls (e.g.,
> objectives, techniques) are to be fully documented so that a clear
> audit trail is established.
>
> b\. Controls should be established to assure that financial
> transaction documents are received and processed in a timely manner.
> Documents should be properly classified and filed for reference, and
> retained in accordance with records management standards (see Chapter
> 15, Records Management, of this Handbook).
>
> c\. Internal control requirements should be included in directives,
> policies, manuals, plans, flowcharts, and desk procedures.
>
> .02 [Recording Transactions and Events]{.underline}
>
> a\. Transactions and other significant events are to be promptly and
> accurately recorded and classified.
>
> b\. An approved system of general ledger and subsidiary accounts shall
> be maintained for assets, liabilities, net position, revenues,
> expenses, budgetary accounts, and memorandum accounts.
>
> .03 [Execution of Transactions and Events]{.underline}
>
> a\. Transactions and other significant events are to be authorized and
> executed only by persons acting within the scope of their authority.
>
> b\. Authorization should be clearly communicated to managers and
> employees and should include the specific terms under which the
> authority exists.

c\. There should be a systematic, ongoing administrative review of
disbursement transactions to ensure proper certification of vouchers and
disbursement of Government funds.

> d\. Statistical sampling may be employed in the administrative review
> process.
>
> .04 [Reconciliation of Accounts]{.underline}
>
> a\. Proper reconciliation of accounts shall consist of identification
> of differences between general ledger balances, subsidiary ledgers,
> and the detail. The reconciliation must include the timely processing
> (preferably in the following month) of the identified items
> constituting the difference between controlling accounts and the
> detail. Accounting records must be promptly brought into agreement
> with the results of audits or physical inventories when they are
> taken. Differences should be investigated to determine the causes.
> Procedures need to be implemented to prevent recurrence and, if
> applicable, to effect recoveries.
>
> b\. General ledger accounts must be reconciled to subsidiary ledgers
> and source documents as frequently as possible, but no less frequently
> than prescribed by the following schedule of reconciliations:
>
> [General Ledger Account]{.underline} [Frequency]{.underline}
>
> Fund Balance with Treasury Monthly
>
> Cash Monthly
>
> Imprest Funds Monthly
>
> Advances Monthly
>
> Loans Receivable Monthly
>
> Deposit Accounts Monthly
>
> Suspense Accounts Monthly
>
> Inventories Annually
>
> Fixed Assets Annually
>
> Other Assets Annually
>
> Undelivered Orders Monthly
>
> Accounts Payable Monthly
>
> Other Liabilities Annually
>
> The preparation of external financial statements or financial reports
> should be preceded by proper and completed reconciliations.
>
> c\. Formal schedules and work papers for such reconciliations shall be
> of sufficient detail to ensure the accuracy of financial statements
> and reports. The working papers and records on which such
> verifications are based shall be retained within the bureau in a form
> that will facilitate an audit.
>
> d\. The reconciliation of general ledger accounts with subsidiary and
> support records helps to substantiate and maintain the accuracy of
> account postings and balances. Different tools may be used to
> accomplish a meaningful reconciliation based on the finance officer's
> professional judgment and knowledge of the systems and controls
> involved. Whenever possible, computer-assisted procedures should be
> employed. All reconciliation procedures should be fully documented and
> explained.
>
> e\. Due professional care should be taken to ensure that the samples
> drawn are reliable. If random sampling is used, a conclusion may be
> projected on the entire population. If random sampling is not used, a
> conclusion can only be reached on the sample selected - no valid
> conclusion can be reached about the entire population. For example,
> drawing a sample of every tenth transaction is not a random sample;
> such a sample will only tell you with 100 percent certainty what your
> performance or results were on every tenth transaction. Samples taken
> must also be based on an adequate sample size to reach a 95 percent
> confidence level.
>
> .05 [Separation of Duties]{.underline}
>
> Key duties and responsibilities in authorizing, processing, recording,
> and reviewing transactions, as well as the receipt, use, and
> disposition of resources, shall be separated among individuals. To
> reduce situations where errors or irregularities can go undetected, no
> one individual should control all phases of an activity or
> transaction.
>
> .06 [Supervision]{.underline}
>
> Adequate and continuous supervision is to be provided to ensure that
> internal control objectives are achieved. Supervisors should control
> employee's activities to optimize productivity and to achieve internal
> control objectives.
>
> .07 [Access to and Accountability for Resources]{.underline}
>
> a\. Access to resources and records is to be limited to authorized
> individuals. Accountability for the custody and use of resources is to
> be assigned and maintained.
>
> b\. Periodic comparison (at least annually) shall be made by taking a
> physical count of resources and comparing the result with the amounts
> recorded in the official records to determine whether the two agree.

.08 [Litigation, Claims and Assessments]{.underline}

> Management of the Federal reporting entity is responsible for adopting
> internal control policies and procedures to identify, evaluate and
> account for litigation, claims and assessments as a basis for the
> preparation of financial statements in accordance with the
> requirements of the Chief Financial Officers Act of 1990 and the
> Government Management Reform Act of 1994. These include litigation,
> claims and assessments handled by legal counsel outside of the Federal
> reporting entity's legal department.

# Section 7.0 Audit Control Activities

> a\. Evaluate findings and recommendations reported by auditors and
> other reviewers promptly.
>
> b\. Determine proper actions and time-frames in response to
> audit/review findings and recommendations.
>
> c\. Complete all actions that correct or otherwise resolve the matters
> brought to management's attention within the established time frame.

# Section 8.0 Budget Control Activities

Operating budgets on a cost basis shall be made a part of the system of
accounting and internal control. Reports to responsible officials, at
least monthly, should be provided in sufficient detail to facilitate the
following:

> a\. Control of resources for the purposes intended;
>
> b\. Comparison of actual performance to planned or budgeted
> performance and analysis of variances; and
>
> c\. Evaluation of personnel and organizational performances.

# Section 9.0 Information Systems Control Activities

These activities include the following:

> a\. General control over data center operations; system acquisitions
> and maintenance; access security and application system development;
> and maintenance.
>
> b\. Application control designed to help ensure completeness,
> accuracy, authorization, and validity of all transactions during
> application processing.

Details on this subject matter are provided by GAO in the [*Federal
Information System Control Audit
Manual*](http://www.gao.gov/special.pubs/ai12.19.6.pdf).

# Section 10.0 Review Control Activities

Internal controls associated with accounting functions will be subject
to rigorous, systematic reviews and self-assessments in accordance with
guidelines provided under [DAO
216-15](http://204.193.232.34/cgi-bin/doit.cgi?205:112:b8aaf989f8d2b3faa25bc06d588259602f2848051e697bb18a84f603496ae8a1),
"Internal Management Control Systems, and in accordance with OMB
[Circular A-123](http://www.whitehouse.gov/omb/circulars/index.html).

A-123, as revised in December 2004, defines management\'s responsibility
for internal control in Federal agencies. A re-examination of the
existing internal control requirements for Federal agencies was
initiated in light of the new internal control requirements for
publicly-traded companies contained in the Sarbanes-Oxley Act of 2002.
Circular A-123 and the statute it implements, the Federal Managers'
Financial Integrity Act of 1982, are at the center of the existing
Federal requirements to improve internal control. The revised circular
reflects policy recommendations developed by a joint committee of
representatives from the Chief Financial Officer Council (CFOC) and the
President's Council on Integrity and Efficiency (PCIE). The policy
changes in this circular are intended to strengthen the requirements for
conducting management's assessment of internal control over financial
reporting. The circular also emphasizes the need for agencies to
integrate and coordinate internal control assessments with other
internal control-related activities. The revised Circular provides
updated internal control standards and new specific requirements for
conducting management's assessment of the effectiveness of internal
control over financial reporting (Appendix A). This Circular emphasizes
the need for integrated and coordinated internal control assessments
that synchronize all internal control-related activities. Annually,
management must provide assurances on internal control in its
Performance and Accountability Report, including a separate assurance on
internal control over financial reporting, along with a report on
identified material weaknesses and corrective actions. This Circular
does not require a separate audit opinion on internal control over
financial reporting. Agencies may at their discretion elect to receive
an audit opinion on internal control over financial reporting.

Section 11.0 Management's Responsibility for Internal Control

The following parts of this section were excerpted [from OMB Circular
A-123 (revised December 21,
2004](http://www.whitehouse.gov/omb/circulars/index.html)):

Internal control, in the broadest sense, includes the plan of
organization, methods and procedures adopted by management to meet its
goals. Internal control includes processes for planning, organizing,
directing, controlling, and reporting on agency operations.

The three objectives of internal control are:

-   Effectiveness and efficiency of operations,

-   Reliability of financial reporting, and

-   Compliance with applicable laws and regulations.

The safeguarding of assets is a subset of all of these objectives.
Internal control should be designed to provide reasonable assurance
regarding prevention of or prompt detection of unauthorized acquisition,
use or disposition of assets.

Management is responsible for developing and maintaining internal
control activities that comply with the following standards to meet the
above objectives:

-   Control Environment,

-   Risk Assessment,

-   Control Activities,

-   Information and Communications, and

-   Monitoring

**A. Control Environment**

The control environment is the organizational structure and culture
created by management and employees to sustain organizational support
for effective internal control. When designing, evaluating or modifying
the organizational structure, management must clearly demonstrate its
commitment to competence in the workplace. Within the organizational
structure, management must clearly: define areas of authority and
responsibility; appropriately delegate the authority and responsibility
throughout the agency; establish a suitable hierarchy for reporting;
support appropriate human capital policies for hiring, training,
evaluating, counseling, advancing, compensating and disciplining
personnel; and uphold the need for personnel to possess and maintain the
proper knowledge and skills to perform their assigned duties as well as
understand the importance of maintaining effective internal control
within the organization.

The organizational culture is also crucial within this standard. The
culture should be defined by management's leadership in setting values
of integrity and ethical behavior but is also affected by the
relationship between the organization and central oversight agencies and
Congress. Management's philosophy and operational style will set the
tone within the organization. Management's commitment to establishing
and maintaining effective internal control should cascade down and
permeate the organization's control environment which will aid in the
successful implementation of internal control systems.

**B. Risk Assessment**

Management should identify internal and external risks that may prevent
the organization from meeting its objectives. When identifying risks,
management should take into account relevant interactions within the
organization as well as with outside organizations. Management should
also consider previous findings; e.g., auditor identified, internal
management reviews, or noncompliance with laws and regulations when
identifying risks. Identified risks should then be analyzed for their
potential effect or impact on the agency.

**C. Control Activities**

Control activities include policies, procedures and mechanisms in place
to help ensure that agency objectives are met. Several examples include:
proper segregation of duties (separate personnel with authority to
authorize a transaction, process the transaction, and review the
transaction); physical controls over assets (limited access to
inventories or equipment); proper authorization; and appropriate
documentation and access to that documentation.

Internal control also needs to be in place over information systems --
general and application control. General control applies to all
information systems such as the mainframe, network and end-user
environments, and includes agency-wide security program planning,
management, control over data center operations, system software
acquisition and maintenance. Application control should be designed to
ensure that transactions are properly authorized and processed
accurately and that the data is valid and complete. Controls should be
established at an application's interfaces to verify inputs and outputs,
such as edit checks. General and application control over information
systems are interrelated, both are needed to ensure complete and
accurate information processing. Due to the rapid changes in information
technology, controls must also adjust to remain effective.

**D. Information and Communications**

Information should be communicated to relevant personnel at all levels
within an organization. The information should be relevant, reliable,
and timely. It is also crucial that an agency communicate with outside
organizations as well, whether providing information or receiving it.
Examples include: receiving updated guidance from central oversight
agencies; management communicating requirements to the operational
staff; operational staff communicating with the information systems
staff to modify application software to extract data requested in the
guidance.

# Section 12.0 Conclusiveness of Chapter

While this chapter includes all internal control standards prescribed by
GAO, it is not to be considered a conclusive statement of internal
controls. It is imperative to utilize the underlying authoritative laws
and guidance documents from GAO, OMB, the Department of Commerce, etc.
to ensure compliance with the extensive internal control guidelines.
Other chapters of this Handbook describe additional internal controls
relating to those subject areas.