![](media/image1.wmf){width="2.4993055555555554in"
height="0.9368055555555556in"}

**State Assessment of Internal Controls**

**Final Report**

*Prepared for:*

Administration for Children and Families

Child Care Bureau

1250 Maryland Ave. SW, 8th Floor

Washington, DC 20024

Attn: Moniquin Huggins, Task Order Officer

Wenda Singer, Improper Payments Team Leader

*Prepared by:*

Walter R. McDonald & Associates, Inc.

12300 Twinbrook Parkway, Suite 310

Rockville, MD 20852

Under Contract Number 233--02--0093

Task Order Number 8

May 2007

**TABLE OF CONTENTS**

**EXECUTIVE SUMMARY [1](#__RefHeading___Toc166558820)**

A. Background [1](#__RefHeading___Toc166558821)

B. Objectives for Developing a Process to Examine State Internal
Controls [2](#__RefHeading___Toc166558822)

C. Potential Uses of the Self-Assessment
[2](#__RefHeading___Toc166558823)

D. Conceptual Design of the Instrument [3](#__RefHeading___Toc166558824)

E. Instrument Development [3](#__RefHeading___Toc166558825)

F. Initial Pilot State: Kansas [4](#__RefHeading___Toc166558826)

G. Training of Federal Staff in ACF Regional Offices
[5](#__RefHeading___Toc166558827)

H. Conclusions [5](#__RefHeading___Toc166558828)

I. Estimated Costs [6](#__RefHeading___Toc166558829)

J. Revisions to the Instrument [6](#__RefHeading___Toc166558830)

K. Recommendations [7](#__RefHeading___Toc166558831)

L. Recommended Steps for Successful Implementation
[7](#__RefHeading___Toc166558832)

I. INTRODUCTION [10](#__RefHeading___Toc166558833)

A. Background [10](#__RefHeading___Toc166558834)

B. Objectives for Developing a Process to Examine State Internal
Controls [11](#__RefHeading___Toc166558835)

II\. POTENTIAL USES BY STATE AND FEDERAL STAFF
[12](#__RefHeading___Toc166558836)

A. Benefits of the Instrument [12](#__RefHeading___Toc166558837)

III\. METHoDOLOGY [14](#__RefHeading___Toc166558839)

A. Project Team [14](#__RefHeading___Toc166558840)

B. Conceptual Design [14](#__RefHeading___Toc166558841)

C. Instrument Development [16](#__RefHeading___Toc166558842)

D. Initial Pilot State: Kansas [17](#__RefHeading___Toc166558843)

IV\. RESULTS OF ADDITIONAL PILOT STATES
[21](#__RefHeading___Toc166558845)

A. Arkansas [21](#__RefHeading___Toc166558846)

B. Illinois [22](#__RefHeading___Toc166558847)

C. Kentucky [22](#__RefHeading___Toc166558848)

D. Maine [23](#__RefHeading___Toc166558849)

E. Montana [24](#__RefHeading___Toc166558850)

F. Nevada [25](#__RefHeading___Toc166558851)

G. Puerto Rico [26](#__RefHeading___Toc166558852)

H. Washington [27](#__RefHeading___Toc166558853)

I. Conclusions [28](#__RefHeading___Toc166558854)

V. ESTIMATED COSTS [30](#__RefHeading___Toc166558855)

A. Objectives of the Cost Analysis [30](#__RefHeading___Toc166558856)

B. Measuring the Costs to Conduct the State Internal Control Assessment
Pilot [30](#__RefHeading___Toc166558857)

VI\. CONCLUSIONS AND RECOMMENDATIONS [32](#__RefHeading___Toc166558859)

A. Conclusions [32](#__RefHeading___Toc166558860)

B. Estimated Costs [33](#__RefHeading___Toc166558861)

C. Revisions to the Instrument [33](#__RefHeading___Toc166558862)

D. Recommendations [33](#__RefHeading___Toc166558863)

E. Recommended Steps for Successful Implementation
[34](#__RefHeading___Toc166558864)

**Exhibits**

Exhibit 1. Use of Hyperlinks & Follow-Up As Documentation
[13](#__RefHeading___Toc163986120)

Exhibit 2. State, Commonwealth, and Regional Participation
[19](#__RefHeading___Toc163986126)

Exhibit 3. Estimated Costs of Conducting a State Internal
Self-Assessment [30](#__RefHeading___Toc163986139)

**APPENDICIES**

Appendix A. Site Visit Agenda [36](#__RefHeading___Toc165450415)

Appendix B. Potential Team Members and Functions
[37](#__RefHeading___Toc165450416)

Appendix C. Suggested Assignments for Completing the Assessment
Instrument [38](#__RefHeading___Toc165450417)

Appendix D. Arkansas Assessment Team Members
[42](#__RefHeading___Toc165450418)

Appendix E. Illinois Assessment Team Members
[44](#__RefHeading___Toc165450419)

Appendix F. Kansas Assessment Team Members
[45](#__RefHeading___Toc165450420)

Appendix G. Kentucky Assessment Team Members
[46](#__RefHeading___Toc165450421)

Appendix H. Maine Assessment Team Members
[47](#__RefHeading___Toc165450422)

Appendix I. Montana Assessment Team Members
[48](#__RefHeading___Toc165450424)

Appendix J. Nevada Assessment Team Members
[50](#__RefHeading___Toc165450425)

Appendix K. Puerto Rico Assessment Team Members
[51](#__RefHeading___Toc165450426)

Appendix L. Washington Assessment Team Members
[52](#__RefHeading___Toc165450427)

Appendix M. State Internal Control Self-Assessment Instrument (Modified)
[54](#__RefHeading___Toc165450428)

Appendix N. State Internal Control Self-Assessment Instrument (Original)
[86](#__RefHeading___Toc165450429)

[]{#__RefHeading___Toc166558820 .anchor}**EXECUTIVE SUMMARY**

This report describes the development and pilot of the State Internal
Control Self-Assessment Instrument (Instrument). This report highlights
the background and objectives, the potential benefits to States and
Federal Staff, and the methodology used to develop and implement the
pilot in Kansas, the initial pilot State. The major part of this report
focuses on nine additional pilot States and includes lessons learned and
associated costs from implementing the Instrument.

A.  []{#__RefHeading___Toc166558821 .anchor}**Background**

In response to the Improper Payment Information Act of 2002, the U.S.
Department of Health and Human Services (HHS), Office of the Inspector
General, Administration for Children and Families (ACF), as well as the
Office of Management and Budget (OMB) developed an Erroneous Payment
Assessment Plan. The plan identified the Child Care Program as being at
high risk of errors that could result in improper payments caused by
mistakes, inadequate controls, fraud, waste, or abuse.

Since 2003, the Child Care Bureau (CCB) has taken a systematic approach
to addressing the issue of improper payments in the Child Care
Development Fund (CCDF). The CCB has examined the policies and practices
in 11 partner States, conducted an error rate pilot in nine pilot
States, and analyzed associated costs. The current pilot examines the
feasibility of implementing a State Internal Control Self-Assessment
Instrument (Instrument) to assist States in identifying potential gaps
and problems within the Child Care Program.

In 2004, the Government Accountability Office (GAO) issued a report
describing the strategies implemented by 16 States to address improper
payments in the CCDF and Temporary Assistance for Needy Families (TANF)
block grant programs. The GAO studied what States were doing to manage
improper payments and how the U.S. Department of Health and Human
Services (HHS), which oversees the TANF and CCDF programs, helps States
identify and address improper payments in these programs. The GAO
concluded, "HHS lacks adequate information to assess risk and assist
States in managing improper payments."[^1]

The GAO report, The Improper Payments Information Act of 2002, the
President's Management Agenda goal of "Improved Financial Performance,"
related OMB guidance and recommendations from the President's Council on
Integrity and Efficiency[^2] all stress that Federal and State agencies
should prioritize the creation of an effective control environment
within their programs using resources and incentives to support this
effort. According to GAO, HHS needs mechanisms to gather information on
State internal control activities, including steps that States take to
minimize or eliminate risks, in order to detect and minimize errors that
could result in improper payments.

B.  []{#__RefHeading___Toc166558822 .anchor}**Objectives for Developing
    a Process to Examine State Internal Controls**

The Government Accountability Office (GAO) identifies assessing internal
controls as an important strategy to assist States in efforts to
minimize erroneous payments. Assessment of risk through an internal
control self-assessment process is an activity that entails a
comprehensive review and analysis of program operations to determine
where risks exist, identify those risks, and then measure the potential
or actual impact of those risks on program operations. The information
gathered from this assessment can determine the nature and type of
corrective actions needed, and provides baseline information for
measuring progress in reducing errors that could result in improper
payments.

In response to the GAO directive, the CCB organized a Federal Project
Team that included staff from Regional offices, the State of Kansas, the
CCB central office and Walter R. McDonald & Associates, Inc. (WRMA) to
draft an approach to address internal controls, using GAO's *Internal
Control Management and Evaluation Tool* as a model.[^3]

C.  []{#__RefHeading___Toc166558823 .anchor}**Potential Uses of the
    Self-Assessment**

The CCB views the State Internal Control Self-Assessment Instrument as a
promising tool for both State and Federal managers. The Instrument can
provide the CCB, Regional Offices, and States with a systematic method
for reviewing and documenting the adequacy of a State's internal control
system, identifying internal control weaknesses, and providing
documentation of findings and possible corrective actions.

ACF Regional Office program specialists and grants officers along with
representatives from nine States/Territories and WRMA were an integral
part of the development and piloting of the Instrument. The State and
Federal Project Teams who participated in the pilot identified the
following benefits of the Instrument implementation process:

1.  **Benefits to States**

-   Enables the States to evaluate their internal controls against GAO
    standards;

-   Can be adapted for use in other program areas;

-   Combines into a single document a wide variety of information that
    can be used to monitor internal controls and prevent errors;

-   Documents areas needing ongoing monitoring or other corrective
    action activities;

-   Can become a "virtual document" that continually updates through
    hyperlinks to the State's Internet or Intranet site each time the
    State changes a supporting materials;

-   Addresses the core processes affecting the child care program, when
    used in conjunction with the State Plan;

-   Documents when necessary internal controls exist and function
    adequately to minimize the risk of errors that could result in
    improper payments; and

-   Can be adapted to meet the unique requirements of a particular State
    and adapted to other State programs.

    2.  **Benefits to ACF Staff in Regional Offices**

```{=html}
<!-- -->
```
-   Assists States in performing oversight and supporting the CCDF
    program;

-   Identifies areas for technical assistance with States, individually
    or in regional meetings;

-   Highlights areas that States identify as weaknesses, which when
    combined with the State Plans, audits and other reports, can develop
    and support corrective actions; and

-   Provides a vehicle for sharing of best practices both within and
    across Regions.

D.  []{#__RefHeading___Toc166558824 .anchor}**Conceptual Design of the
    Instrument**

The purpose of the Instrument is to provide a supplemental guide for
States to assess the adequacy of internal controls and to identify
issues that may contribute to errors in the administration of the Child
Care and Development Fund (CCDF). This Instrument provides a starting
point for States to modify to fit the circumstances, conditions, and
risks relevant to each agency. States can review their internal controls
and procedures using the relevant factors and elements in the Instrument
and document responses as appropriate to their particular agency
circumstances.

Using the GAO tool as the base, the State Internal Control
Self-Assessment Instrument has five sections corresponding to the five
standards for internal controls:

-   Control environment

-   Risk assessment

-   Control activities

    -   Common categories of control activities

    -   Control activities specific to information systems general

    -   Control activities specific to information systems application
        control

-   Information and communications

-   Monitoring

Each section of the Instrument contains a list of major elements or
criteria for States to consider when reviewing internal controls as they
relate to each particular standard. By reviewing each element, States
can first determine the applicability of the item to local
circumstances. If applicable, the Instrument provides standards against
which States can assess performance, identify any resultant gaps or
weaknesses, and determine the extent to which the element influences the
agency's ability to achieve its mission and goals. The results of this
assessment can guide States in developing processes, procedures, or
other measures to improve internal controls in order to meet the intent
of the IPIA and ACF\'s need to document improvements. State assessment
results can help provide a framework for ongoing technical assistance,
when shared with ACF staff in Regional Offices.

E.  []{#__RefHeading___Toc166558825 .anchor}**Instrument Development**

The Federal Project Team, consisting of Federal CCB staff from Central
Office, Region VII and WRMA, worked with Kansas as a partner State in
the review, modification, and initial pilot test of the Instrument.
Alice Womack, State Child Care Administrator, agreed to lead the State
Self Assessment of Internal Controls Project Team, which included staff
representing Program, Fiscal, Policy, Human Resources, Information
Technology, and Auditing Divisions, at both the central office and field
office levels.

Federal Project Team members visited Kansas in November 2005 and
conducted a two-day working session to orient the Kansas Project Team to
the project and work together to tailor the Instrument for use in
reviewing the child care program. The Kansas and Federal Project Teams
reviewed every section, element, and criterion in the initial draft
Instrument and, through consensus, modified and tailored the Instrument.
The Project Teams deleted several of the elements and their associated
criteria from the original document. The Project Teams came to consensus
on all modifications to the Instrument before making any changes. The
Project Team members chose to delay further refinement and modification
of the Instrument until after State pilot implementation.

F.  []{#__RefHeading___Toc166558826 .anchor}**Initial Pilot State:
    Kansas**

Kansas participated in the development of the Instrument and agreed to
be the first State to pilot the Instrument from November 21, 2005 to
January 13, 2006. Following completion, the Federal Project Team
conducted a debriefing call to discuss the Kansas experience. After
considerable discussion, the Kansas Project Team made several
recommendations for successful implementation of the Instrument,
including:

1.  **Composition and Responsibilities of the State Project Team**

-   Select one overall project coordinator.

-   Have a high-level management staff member recruit team members and
    act as organizational sponsor.

-   Form a broad-based team. See Appendix B for a listing of potential
    team member's functional assignments.

-   Designate adequate support/clerical staff to be involved from the
    beginning of the project, especially for tracking and compiling data
    and information

-   See "Suggested Section Assignments," Appendix C for more guidance on
    forming the State Project Team.

2.  **Orientation Meetings and Ongoing Communication**

-   Hold an initial team meeting to explain the purpose, process, and
    benefits of participation and uses for future work within the
    agency.

-   Hold additional orientation meetings, if staff members who will
    complete sections of the Instrument are not at the orientation
    meeting.

3.  **Gathering and Recording Information**

-   Discuss the procedures for gathering documentation, including: the
    use of hyperlinks to both the State Internet and Intranet Web sites;
    and how hard copy attachment options are to be coordinated with all
    team members.

-   Provide all team members with an electronic version of the document
    to use to enter all information and send to the coordinator who can
    then assign support staff to compile into one document. More than
    one team member may complete some sections, which will require
    integration by the coordinator.

4.  **Finalizing and Submitting the Completed Assessment**

-   Have support staff edit the completed Instrument for errors,
    grammar, and writing style consistency.

-   When completed, hold a wrap-up meeting with all team members to
    share completed documents and receive comments and feedback; make
    changes to document as agreed upon in discussion.

-   Have high-level management staff/team review the completed
    Instrument to ensure that it is consistent with agency mission and
    can be integrated with agency strategic or business plan.

G.  []{#__RefHeading___Toc166558827 .anchor}**Training of Federal Staff
    in ACF Regional Offices**

Upon completion of the Kansas pilot, the CCB convened a one-and-a-half
day training session in Kansas City, MO for Regional grants officers and
program specialists from CCB Central Office and all ten ACF Regional
Offices. Members of the Kansas Project Team also attended the training.

The purpose of the training was to involve the ACF Regional Offices in
provision of technical assistance to the States during the Instrument
pilot and to demonstrate how they could use the results for monitoring
purposes. At the conclusion of the session, the CCB invited an
additional nine Regions and States or Commonwealths to participate in
the pilot, including Maine (Region I), Puerto Rico (Region II), Kentucky
(Region IV), Illinois (Region V), Arkansas (Region VI), Kansas (Region
VII), Montana (Region VIII), Nevada (Region IX), and Washington (Region
X).

The Federal Project Team conducted site visits in eight of the nine
jurisdictions; Maine chose not to have a site visit due to timing
issues. Instead, the Federal Project Team conducted a conference call
with the Maine Project Team to answer questions and prepare team members
for completing the Instrument.

H.  []{#__RefHeading___Toc166558828 .anchor}**Conclusions**

Based on the self-assessment process, the nine pilot States offered the
following conclusions for future pilots:

*A successful Instrument implementation process needs involvement across
program areas***.** States realized that the scope of the
self-assessment process was broad, requiring the involvement of common
supporting areas that cross walk several different programs, such as
Human Resources and Information Technology. As a result, the commitment
of all parts of the organization is critical to the success of the
self-assessment process.

*High-level management support is important for optimal implementation*.
For those States without the necessary organizational support, the
self-assessment process was a greater challenge. The States that found
the self-assessment process most rewarding were those States that had a
high level of commitment from the top State organizational level.

*Redundancies in the Instrument did not serve a useful purpose***.** All
nine pilot States expressed a need to streamline the Instrument and
eliminate the redundancies. States also requested creating a section
specific to the child care program. WRMA revised the Instrument as
explained in the section below.

*States need to allow adequate time to complete the self-assessment
process*. States recommended establishing an agreed upon timeframe to
ensure timely and thoughtful completion of the Instrument. Most States
indicated that a 90-day timeframe for Instrument completion was
adequate. Several States recommended scheduling the self-assessment
process to occur within a timeframe that does not conflict with other
major agency activities. Most States recommended updating the Instrument
every two years.

*States may use hyperlinks to refer to documents on the State's Internet
and/or Intranet Web site to ensure that the Instrument stays current by
linking dynamically to continuously updated documentation*. Most States
indicated that combining all of the documentation in a single document
was helpful. Using the hyperlink rather than printing the complete set
of documentation was beneficial because the link will route to the most
current version of a document. This is important as many policy
documents are on a regular schedule for updates. The Illinois Project
Team recommended establishing an area on the CCB Web site for States to
provide links for sharing internal control documentation, which is not
available on either the Internet or the State agency Intranet.

*Agency allocation of an overall project coordinator is critical to the
self-assessment process.* The project coordinator needs to have top-down
management support, sufficient authority to set deadlines, availability
during the entire process to provide clear instructions, answer
questions, consult with team members and coordinate with top agency
leadership.

I.  []{#__RefHeading___Toc166558829 .anchor}**Estimated Costs**

Despite the scope and complexity of the Instrument, the costs of
conducting a State Internal Control Self-Assessment are relatively
modest. Kentucky and Maine estimated costs of approximately \$3,000,
while Montana and Washington estimated between \$8,000 and \$9,500. The
range for all States was \$3,032 through \$9,445. The costs for the
Commonwealth of Puerto Rico were significantly higher, due to several
factors. Puerto Rico involved the greatest number of personnel in the
site visit and in the Instrument implementation process. Puerto Rico
also expanded the scope of the self-assessment process to examine areas
needing attention as identified in a prior audit.

J.  []{#__RefHeading___Toc166558830 .anchor}**Revisions to the
    Instrument**

The nine pilot States recommended elimination of the redundancies and
the tailoring of certain elements to the child care program. Based on
the advice of the participating States and ACF staff in Regional
Offices, WRMA modified the Instrument. The objective of the
modifications was to reduce the redundancy, clarify the instructions,
and tailor Section III to include elements specific to the child care
program. In order to involve all pilot States in the process of
Instrument modification, WRMA shared the revised Instrument with the
States and the ACF staff in the Regional Office who drafted the initial
Instrument. Following receipt of all of the comments, WRMA made further
revisions to the Instrument. Appendix M contains the revised Instrument.

The modifications to the Instrument included:

-   Eliminating or combining 23 elements in Section I and II (Control
    Environment and Risk Assessment) for a reduction of 23%;

-   Reviewing and clarifying all instructions for each section of the
    Instrument;

-   Revising Section III: Common categories of control activities to
    specifically focus on the child care program; and

-   Making minor changes to Sections IV and V.

The modifications did not affect the integrity of the Instrument.

K.  []{#__RefHeading___Toc166558831 .anchor}**Recommendations**

The Instrument can provide the CCB staff in the Central and in Regional
Offices and States with a systematic method for reviewing and
documenting the adequacy of a State's internal control system,
identifying internal control weaknesses, and providing documentation of
findings and possible corrective actions. Recommendations include:

-   *Obtain the commitment of all parts of the organization prior to
    initiation of the process.* A successful Instrument implementation
    process needs involvement across program areas**.** States realized
    that the scope of the self-assessment process was broad, requiring
    the involvement of common supporting areas that cross walk several
    different programs.

-   *Market the Instrument to programs in addition to the child care
    program*. Some States adapted the Instrument to meet other needs
    beyond the child care program. Puerto Rico used the self-assessment
    process to re-examine fiscal areas highlighted in a previous audit,
    and included an action plan with the Self-Assessment findings. Maine
    intends to strengthen its Performance Evaluation System (PER) by
    including a section focusing on ethics and personal integrity.

-   *Consider involving an external entity to review the accuracy and
    validity of State responses*. Arkansas recommended enlisting an
    external entity to validate the self-assessment responses from the
    agency. Puerto Rico and Maine also recommended developing a
    verification or validation process to ensure that responses were
    accurate and appropriate. Several States recommended the involvement
    of the Regional Offices to assist with the validation process.

-   *Consider integrating the self-assessment process with the agency's
    strategic or business plans.* High-level management support is
    important for broader implementation of the self-assessment process.
    States may choose to involve senior management staff initially to
    determine the applicability of the self-assessment process with the
    broader agency mission or strategic planning process. Within the
    child care program the Instrument can be combined with the CCDF
    State Plan to serve as a biannual update of State efforts towards
    the prevention of errors that could result in improper payments.
    Senior management staff can review responses to ensure consistency
    with agency mission and strategic and business plans.

L.  []{#__RefHeading___Toc166558832 .anchor}**Recommended Steps for
    Successful Implementation**

Based on the first pilot State experience, Kansas offered several
logistical steps that can maximize the effectiveness of the methodology
process. The following steps provided useful guidance for the nine pilot
States' implementation experience and support the above recommendations.
The steps include:

1.  Select one overall project coordinator. It is critical that the
    project coordinator is available during the entire process to answer
    questions, consult with team members and coordinate with the CCB or
    WRMA.

2.  Select a full range of State Project Team members. The following
    list includes potential County and Contractor staff for States where
    that may be appropriate. Appendix B provides a table listing
    potential team members and their functions. Potential team members
    may include:

    a.  High and Middle Level Management;

    b.  Audits;

    c.  Human Resources;

    d.  Information Technology;

    e.  Program Staff including those working on systems for programs if
        different than IT staff;

    f.  Quality Assurance;

    g.  Eligibility staff (State, County or contractors);

    h.  Licensing Staff;

    i.  Finance/Accounting;

    j.  Operations;

    k.  Public Information Officer;

    l.  Legislative Liaison; and

    m.  County management staff if County Administered.

3.  Hold an initial team meeting to explain purpose, process and sell
    the project. If possible, have a senior level management staff
    person kick-off the project at this meeting. Go over each section of
    the document and make specific assignments to the team members for
    each section of the document. States that performed this step
    reported that it was very important to successful completion of the
    document.

4.  Hold additional follow-up meetings to ensure that all participants
    tasked with completing sections of the assessment understand the
    purpose and process.

5.  Make sure the identified coordinator is available during the entire
    process to answer questions, hold conference calls, consult with
    team members and coordinate with the CCB or WRMA.

6.  Designate and involve support staff at the beginning for tracking
    and compiling data and information, editing for errors, checking
    grammar, and providing writing style consistency.

7.  Provide all team members with an electronic version of the document
    to use in completing their assigned sections. Have all information
    entered on the electronic document and sent to coordinator who can
    then assign support staff to integrate it into one document. If more
    than one team member completes a section, integration with oversight
    from coordinator may be necessary.

8.  Establish an agreed upon type style and font size so that responses
    can be inserted into the master document easily.

9.  Discuss documentation: Web sites (hyperlink to both Internet and
    Intranet) and hard copy attachment options with all team members.

10. Hold additional meetings with all team members or sub-groups to
    share the completed document, receive comments and feedback, and
    make changes to document as needed.

11. Have senior management staff review responses to ensure consistency
    with agency's mission and strategic or business plans.

    I.  []{#__RefHeading___Toc166558833 .anchor}**INTRODUCTION**

In response to the Improper Payments Information Act (IPIA) of 2002 and
guidance from the Office of Management and Budget (OMB), the Child Care
Bureau (CCB) launched the project: Measuring Improper Payments in the
Child Care Program. The purpose of this project is to identify and
describe methods that could help States identify, measure, and minimize
errors in the administration of the Child Care and Development Fund
(CCDF).

This report describes the development and pilot of the State Internal
Control Self-Assessment Instrument (Instrument). This report highlights
the background and objectives, the potential benefits to States and
Federal Staff, and the methodology used to develop and implement the
pilot in Kansas, the initial pilot State. The major part of this report
focuses on nine additional pilot States and includes lessons learned and
associated costs from implementing the Instrument.

A.  []{#__RefHeading___Toc166558834 .anchor}**Background**

Since 2003, the Child Care Bureau (CCB) has taken a systematic approach
to addressing the issue of improper payments in the Child Care
Development Fund (CCDF). The CCB has examined the policies and practices
in 11 partner States, conducted an error rate pilot in nine States, and
analyzed associated pilot costs. The current pilot examines the
feasibility of implementing an Instrument to assist States in
identifying potential gaps and problems within their State Child Care
Programs.

In 2004, the Government Accountability Office (GAO) issued a report
describing the strategies implemented by 16 States to address improper
payments in the CCDF and Temporary Assistance for Needy Families (TANF)
block grant programs. The GAO studied what States were doing to manage
improper payments and how the U.S. Department of Health and Human
Services (HHS), which oversees the TANF and CCDF programs, helps States
identify and address improper payments in these programs. The GAO
concluded that "HHS lacks adequate information to assess risk and assist
States in managing improper payments."[^4]

The GAO report, The Improper Payments Information Act of 2002, the
President's Management Agenda goal of "Improved Financial Performance,"
related OMB guidance, and recommendations from the President's Council
on Integrity and Efficiency[^5] all stress that Federal and State
agencies should prioritize the creation of an effective control
environment within their programs using resources and incentives to
support this effort. According to GAO, HHS needs mechanisms to gather
information on State internal control activities, including steps that
States take to minimize or eliminate risks, in order to detect and
prevent errors that could result in improper payments.

B.  []{#__RefHeading___Toc166558835 .anchor}**Objectives for Developing
    a Process to Examine State Internal Controls**

GAO identifies assessing internal controls as an important strategy to
assist States in efforts to prevent errors that could result in improper
payments. Assessment of risk through an internal control self-assessment
process is an activity that entails a comprehensive review and analysis
of program operations to determine where risks exist, identify those
risks, and then measure the potential or actual impact of those risks on
program operations. The information gathered from this assessment can be
used to determine the nature and type of corrective actions needed, and
provides baseline information for measuring progress in reducing errors
that could result in improper payments.

In response to the GAO directive, the CCB organized a Federal/State team
that included CCB staff from central and regional offices, the State of
Kansas, and Walter R. McDonald & Associates, Inc. (WRMA) to draft an
approach to address internal controls, using GAO's *Internal Control
Management and Evaluation Tool* as a model.[^6]

The CCB views the Instrument as a promising tool for both State and
Federal managers. The Instrument can provide the CCB and States with a
systematic method for reviewing and documenting the adequacy of a
State's internal control system, identifying internal control
weaknesses, and providing documentation of findings and possible
corrective actions.

This report describes the development of an Instrument to assess the
adequacy of internal controls and to identify issues that may contribute
to errors in the administration of the Child Care and Development Fund
(CCDF). The following chapter describes the benefits of using the
Instrument for staff in States and ACF Regional Offices.

II. []{#__RefHeading___Toc166558836 .anchor}**POTENTIAL USES BY STATE
    AND FEDERAL STAFF**

States can view completed internal control Instruments as living
documents, making revisions as circumstances, conditions, and risks
change. The CCB views the State Internal Control Self-Assessment
Instrument as a promising tool for both State and Federal managers. The
Instrument provides the CCB and States with a systematic method for
reviewing and documenting the adequacy of a State's internal control
system, by identifying internal control weaknesses, and providing
documentation of findings, and possible corrective actions. The CCB
believes this Instrument can complement other Federal activities aimed
at helping States become more vigilant and prevention-oriented in an
overall effort to reduce errors that could result in improper payments.

A.  []{#__RefHeading___Toc166558837 .anchor}**Benefits of the
    Instrument**

ACF Regional Office program specialists and grants officers, along with
representative from nine States/Territories and WRMA, were an integral
part of the development and piloting of the Instrument. The State and
Federal Project Teams who participated in the pilot identified the
following benefits of the Instrument implementation process:

1.  **Benefits to States**

-   Enables the States to evaluate their internal controls against GAO
    standards;

-   Can be adapted for use in other program areas;

-   Combines into a single document a wide variety of information that
    can be used to monitor internal controls and prevent errors that
    could result in improper payments;

-   Documents areas needing ongoing monitoring or other corrective
    action activities;

-   Can become a "virtual document" that continually updates through
    hyperlinks to the State's Internet or Intranet site each time the
    State changes supporting material;

-   Addresses the core processes affecting the child care program, when
    used in conjunction with the State Plan;

-   Documents when necessary internal controls exist and function
    adequately to minimize the risk of errors that could result in
    improper payments; and

-   Can be adapted to meet the unique requirements of a particular State
    and adapted to other State programs.

    2.  **Benefits to ACF Staff in Regional Offices**

```{=html}
<!-- -->
```
-   Assists States in performing oversight and supporting the CCDF
    program;

-   Identifies areas for technical assistance with States, individually
    or in regional meetings;

-   Highlights areas that States identify as weaknesses, which when
    combined with the State Plans, audits and other reports, can develop
    and support corrective actions; and

-   Provides a vehicle for sharing of best practices both within and
    across Regions.

This Instrument can be a major source document for multiple parts of the
organization and benefit a broad range of program areas. Exhibit 1
provides an example of how Kentucky used hyperlinks for documentation
sources in Column 3 so that when a part of the organization updates its
documents, it can simultaneously update the Instrument. Kentucky also
used Column 4 from the Instrument to explain how the State will address
an area or take a corrective action if needed.

[]{#__RefHeading___Toc163986120 .anchor}**Exhibit 1. Use of Hyperlinks &
Follow-up as Documentation**

+---------------+-----------------+------------------+-----------------+
| Elements      | Criteria        | Documentation    | F               |
|               |                 |                  | indings/Results |
|               |                 | (Provide all     | & Suggested     |
|               |                 | applicable       | Follow-up if    |
|               |                 | documentation)   | Necessary       |
+===============+=================+==================+=================+
| 11\.          | Management      | Operational      | Continue to     |
| Management    | maintains       | manuals and hard | respond to      |
| ensures all   | written         | copies of        | findings (if    |
| transactions  | documentation   | documentation    | applicable)     |
| and other     | that is readily | are maintained   | from results of |
| significant   | available,      | according to     | Single audit as |
| events are    | complete,       | Cabinet          | required by     |
| clearly       | useful,         | guidelines.      | contract        |
| documented    | properly        |                  |                 |
| with respect  | managed,        |                  |                 |
| to each of    | maintained, and |                  |                 |
| the agency's  | periodically    | Contract         |                 |
| overall       | updated.        | oversight        |                 |
| activities    |                 | branch:          |                 |
| and those     |                 |                  |                 |
| activities    |                 | [http://eprocure |                 |
| related to    |                 | ment.ky.gov/serv |                 |
| the Child     |                 | let/KYECServlet? |                 |
| Care Program. |                 | object=ECOMMERCE |                 |
|               |                 | &action=showMain |                 |
|               |                 | P                |                 |
|               |                 | age]{.underline} |                 |
+---------------+-----------------+------------------+-----------------+

The following chapter describes in more detail the methodology used to
develop the initial draft Instrument.

III. []{#__RefHeading___Toc166558839 .anchor}**METHODOLOGY**

This chapter describes the various components of the pilot methodology
and the process that the Federal Project Team used to develop and pilot
test the State Internal Control Self-Assessment Instrument. The chapter
describes the make-up of the Federal Project Team, examines the
conceptual design and Instrument development process, and explains the
initial pilot in Kansas and the training for ACF staff in Regional
Offices.

A.  []{#__RefHeading___Toc166558840 .anchor}**Project Team**

Because of the intended use of the State Internal Control
Self-Assessment Instrument for both States and ACF staff in Regional
Offices, it was important to involve both State and ACF Regional staff
in the development and pilot process. The Federal Project Team consisted
of Region VII financial/grants management and program staff, CCB policy
and program staff, and WRMA staff. Kansas agreed to participate in the
design as well as conduct a pilot of the Instrument. After the project
team finalized the Instrument, Kansas staff proceeded to select State
team members.

B.  []{#__RefHeading___Toc166558841 .anchor}**Conceptual Design**

The Federal Project Team conducted an extensive review and analysis of
existing applicable documentation as the first step in developing a
baseline tool.[^7]^,^[^8]^,^ [^9] The Government Accountability Office
(GAO) Internal Control Management and Evaluation Tool provided the
conceptual model used to design the State Internal Control-Assessment
Instrument.[^10] In addition, the Project Team reviewed several other
risk assessment Instruments, including tools used by Virginia, Illinois,
and Federal agencies such as the Department of Transportation. Elements
from these tools were included in the draft Instrument.

The purpose of the Instrument is to provide a supplemental guide for
States to assess the adequacy of internal controls and to identify
issues that may contribute to errors in the administration of the Child
Care and Development Fund (CCDF). States can modify this tool to fit the
circumstances, conditions, and risks relevant to each agency. States can
review their internal controls and procedures, using the relevant
factors and elements in the Instrument, and document responses as
appropriate to their particular agency circumstances.

The Instrument has five sections corresponding to the five standards for
internal control outlined by the GAO. [^11] The following section
provides a brief description of each of the five standards. The third
standard, Control Activities, is further broken down into three
additional sections: one dealing with Common Activities and two dealing
with Information Systems.

-   *Control environment:* This standard addresses how the State
    establishes and maintains an environment throughout the organization
    that sets a positive and supportive attitude towards internal
    control and conscientious management. Major factors affecting the
    control environment include:

    -   Integrity and Ethical Values;

    -   Commitment to Competence;

    -   Management Philosophy and Operating Style;

    -   Organizational Structure;

    -   Assignment of Authority and Responsibility;

    -   Human Resource Policies and Practices; and

    -   Oversight Groups.

-   *Risk assessment:* This standard addresses the importance of
    establishing clear and consistent goals and objectives at both the
    organizational and program level. When an agency has established,
    well-articulated objectives, it can then assess any risks that could
    impede the efficient and effective achievement of those goals and
    objectives. Once the agency identifies and analyzes the potential
    risks, it can develop a plan to minimize, eliminate, or mitigate
    those risks. The design of this section or standard assists States
    in this effort.

-   *Control activities[:]{.underline}* This standard applies to the
    policies, procedures, techniques, and mechanisms used by States to
    mitigate the risks identified during the risk assessment process.
    Effective control activities are integral to an agency's planning,
    implementation, and review processes. In addition, internal control
    activities are essential in achieving accountability, and efficient
    program results.

    -   *Common categories of control activities***:** Control
        activities include a wide range of diverse activities, such as
        approvals, authorizations, verifications, reconciliations,
        performance reviews, security activities, and the production of
        records and documentation. The agency can determine whether the
        proper control activities have been established, whether they
        are in sufficient number, and the degree to which those controls
        are operating effectively.

    -   *Control activities specific to information systems general:*
        Some internal control activities apply specifically to
        information systems, including the structure, policies, and
        procedures that apply to the agency's overall computer
        operations. These activities apply to all aspects of the
        information systems operations, including mainframe, network,
        Internet, and end-user environments. General control governs the
        environment in which the agency's application systems operate.
        The six major factors or categories of information systems
        control activities within general information systems controls
        are: agency wide security management, access control,
        application software development and change, system software
        control, segregation of duties, and service continuity.

    -   *Control activities specific to information systems application
        control**:*** Application control involves the structure,
        policies, and procedures designed or adopted by the agency to
        ensure completeness, accuracy, authorization, and validity of
        all transactions during application processing. Controls include
        both the routines contained within the computer programming
        code, as well as the policies and procedures associated with
        end-user activities. The four major categories of control
        activities are authorization control, completeness control,
        accuracy control, and control over integrity of processing and
        data files.

-   *Information and communications:* The fourth standard assesses the
    degree to which the State has relevant and reliable information,
    both financial and non-financial, relating to external and internal
    events. Information and communication must be broad based,
    accountable, reliable, continuous, appropriate, and secure, whether
    manual or automated.

-   *Monitoring:* The final standard allows the State to examine and
    evaluate the performance of contract and non-contract providers
    administering child care and other related services. This standard
    provides elements to gauge the effectiveness of the program, audits,
    and other monitoring activities.

Each section of the Instrument contains a list of major elements or
criteria for States to consider when reviewing internal controls as they
relate to each particular standard. By reviewing each element, States
can first determine the applicability of the item to local
circumstances. If applicable, the Instrument provides standards against
which States can assess performance, identify any resultant gaps or
weaknesses, and determine the extent to which the element influences the
agency's ability to achieve its mission and goals. The results of this
assessment can guide States in developing processes, procedures, or
other measures to improve internal controls in order to meet the intent
of the IPIA and ACF\'s need to document improvements. State assessment
results can help provide a framework for ongoing technical assistance,
when shared with ACF staff in Regional Offices.

A.  []{#__RefHeading___Toc166558842 .anchor}**Instrument Development**

The Federal Project Team, consisting of Federal CCB staff from Central
Office and Region VII and WRMA, used an interactive approach to develop
the Instrument. Beginning with the basic Internal Control Management and
Evaluation Tool (GAO--01--1008G), the Project Team reviewed other
assessment tools, including those developed by Illinois and Virginia,
and verified that relevant information contained in those Instruments
were also contained in the draft Instrument. This process took place
over several weeks through conference calls and e-mails to produce and
refine the initial draft Instrument.

Kansas participated as a partner State in the review, modification, and
initial pilot test of the Instrument. Alice Womack, State Child Care
Administrator, agreed to lead the State Self Assessment of Internal
Controls Project Team, which included staff representing Program,
Fiscal, Policy, Human Resources, Information Technology, and Auditing
Divisions, at both the central office and field office levels.

Federal Project Team members consisting of Federal staff from Central
Office, Region VII, and WRMA visited Kansas in November 2005. The
Federal Project Team conducted a two-day working session to orient the
Kansas Project Team to the project and work together to tailor the
Instrument for use in reviewing the child care program. The Kansas and
Federal Project Teams reviewed every section, element, and criterion in
the initial draft Instrument and, through consensus, modified and
tailored the Instrument. The Project Teams deleted several of the
elements and their associated criteria from the original document. The
Project Teams came to consensus on all modifications to the Instrument
before making any changes. In all cases, the deletion of elements
occurred because the team members considered the element redundant and
so it did not add value to the Instrument.

Several elements had no associated criteria. The Project Teams reviewed
each of these and only added criteria when the teams determined that the
element needed clarification. The Instrument repeats some elements
across issues and several sections have the same criteria, but used in a
different context. The Project Team members chose to delay further
refinement and modification of the Instrument until after State pilot
implementation.

B.  []{#__RefHeading___Toc166558843 .anchor}**Initial Pilot State:
    Kansas**

Kansas piloted the Instrument from November 21, 2005 to January 13,
2006. Following completion, the Federal Project Team conducted a
debriefing call to discuss the Kansas experience. After considerable
discussion, the Kansas Project Team made several recommendations for the
future pilot States.

1.  **Initial Pilot Observations**

> The Kansas Project Team expressed that the pilot was "rewarding" and
> required only a nominal investment of State staff time and resources.
> Kansas recruited team members from a broad range of program areas to
> participate on the Kansas Project Team. The Kansas Project Team
> recognized that the Instrument had relevance across program offices
> and some of the team members indicated that they planned to share this
> information more widely in their respective divisions to make process
> improvements. Kansas anticipates that these improvements will occur as
> the other program areas absorb the ramifications of the Instrument.
>
> Kansas offered the following recommendations for future pilots:

a.  **Composition and Responsibilities of the State Project Team**

-   Select one overall project coordinator. Make sure the coordinator is
    available during the entire process to answer internal questions,
    arrange conference calls with the team, consult with team members,
    and coordinate status and technical assistance call with the
    contractor when necessary.

-   Have a high-level management staff member recruit team members and
    act as organizational sponsor.

-   Form a broad-based team. Include members from: High and Middle Level
    Management, Audits, Personnel/Human Resources, Information
    Technology, Program Staff (including those working on the systems
    for programs if different than IT staff), Quality Assurance or
    Quality Control, Staff who do Eligibility Determination (workers
    and/or contractors), Licensing Staff, Finance/Accounting,
    Operations, Public Information Officer, Legislative Liaison, and
    County Management/Staff (if county administered). See Appendix B for
    a listing of potential team member's functional assignments.

-   Designate adequate support/clerical staff to be involved from the
    beginning of the project, especially for tracking and compiling data
    and information.

-   See "Suggested Section Assignments," Appendix C for more guidance on
    forming the State Project Team.

    a.  **Orientation Meetings and Ongoing Communication**

```{=html}
<!-- -->
```
-   When forming the State Project Team, hold an initial team meeting to
    explain the purpose, process, and sell the project (explain benefits
    of participation and uses for future work within the agency).
    Include the organizational sponsor to kick-off the meeting.

-   Hold additional orientation meetings, if necessary, to ensure that
    all persons involved in completing sections of the assessment
    understand the purpose and process. This is particularly important
    if staff members who will complete sections of the Instrument are
    not at the site visit meeting.

    a.  **Gathering and Recording Information**

-   Discuss the procedures for gathering documentation, including: the
    use of hyperlinks to both the State Internet and Intranet Web sites;
    and how hard copy attachment options are to be coordinated with all
    team members.

-   Provide all team members with an electronic version of the document
    to use in completing their assigned sections. Have them enter all
    information onto the electronic document and send to the coordinator
    who can then assign support staff to compile into one document. More
    than one team member may complete some sections, which will require
    integration by the coordinator.

-   When recording supporting documentation, use hyperlinks to the
    State's Internet or Intranet sites (URL's) to reduce the amount of
    hard copy attachments and to facilitate future updates.

    a.  **Finalizing and Submitting the Completed Assessment**

-   Have support staff edit the completed Instrument for errors,
    grammar, and writing style consistency.

-   When completed, hold a wrap-up meeting with all team members to
    share completed documents and receive comments and feedback; make
    changes to document as agreed upon in discussion.

-   Have high-level management staff/team review the completed
    Instrument to ensure that it is consistent with agency mission and
    can be integrated with agency strategic or business plan. Kansas had
    high-level support for this project and shared all findings with top
    management.

    2.  **Training for Federal Staff in ACF Regional Offices**

> Upon completion of the Kansas pilot, the CCB convened a one-and-a-half
> day training session in Kansas City, MO for Regional grants officers
> and program specialists from CCB Central Office and all ten ACF
> Regional Offices. Members of the Kansas Project Team also attended the
> training.
>
> The session covered the background and genesis of the Instrument
> followed by an explanation of the initial pilot experience by members
> of the Kansas Project Team. Participants reviewed and discussed each
> element of the Instrument. The session concluded with a discussion of
> how the staff in the ACF Regional Offices would provide technical
> assistance to States during the Instrument pilot and how they could
> use the results for monitoring purposes. At the conclusion of the
> session, the CCB selected an additional nine States to invite to
> participate in the pilot.

[]{#__RefHeading___Toc163986126 .anchor}**Exhibit 2. State,
Commonwealth, and Regional Participation**

  --------------------------------- -------------------------------------
  **REGION**                        **STATE**

  I                                 Maine

  II                                Puerto Rico

  III                               None[^12]

  IV                                Kentucky

  V                                 Illinois

  VI                                Arkansas

  VII                               Kansas\*

  VIII                              Montana

  IX                                Nevada

  X                                 Washington
  --------------------------------- -------------------------------------

\* Kansas was the original pilot State

3.  **Site Visit Protocols**

> To plan the site visit, WRMA convened a planning conference call with
> each pilot State and corresponding ACF staff in the Regional Office.
> Prior to the call, WRMA shared with each pilot State an overview of
> pilot process and a copy of the Instrument completed by Kansas. These
> documents provided concrete examples of potential State responses and
> suggested the level and types of staff who needed to attend the
> initial technical assistance and training site visit. This information
> also provided useful "lessons learned" from the Kansas experience
> regarding team composition and the need for top-level administrative
> support to assure pilot success. Each State then identified and
> selected team members and scheduled a site visit.
>
> The Federal Project Team conducted site visits in eight of the nine
> jurisdictions; Maine chose not to have a site visit due to timing
> issues. Instead, the Federal Project Team conducted a conference call
> with the Maine Project Team to answer questions and prepare team
> members for completing the Instrument.
>
> While the Federal Project Team originally planned a one-and-a-half day
> site visit, it became apparent that one day was sufficient and
> remaining site visits were adjusted accordingly. This minimized the
> disruption to the State. The Federal Project Team consisted of
> representation from Central and ACF Regional Offices and staff from
> WRMA.
>
> During the site visit, Federal staff and WRMA provided an item-by-item
> review of the Instrument. The members from the State Project Team
> identified as most knowledgeable in a given area volunteered to
> respond to each section of the Instrument. Team members also addressed
> the logistics and timeframes for Instrument completion. States also
> identified who would provide administrative assistance to consolidate
> the document.

IV. []{#__RefHeading___Toc166558845 .anchor}**RESULTS OF ADDITIONAL
    PILOT STATES**

    A.  []{#__RefHeading___Toc166558846 .anchor}**Arkansas**

        1.  **Review Team Process**

> After reviewing the Kansas recommendations for team composition, the
> Arkansas Project Team convened a large group of key managers from all
> parts of the agency, to obtain buy-in during the initial site visit.
> Convening key managers from each division of the agency for the
> initial site visit provided participants with the necessary background
> for each element, making it easier for the Arkansas project
> coordinator to make the appropriate contact during completion of the
> Instrument.
>
> The Arkansas Project Team took a different approach to completing the
> Instrument compared to other States. The Arkansas project coordinator
> went through each section of the Instrument and answered all of the
> questions possible. The Arkansas project coordinator then contacted
> the critical staff in each of the other areas whenever there were
> questions or a need for additional clarification.

2.  **Benefits of the Instrument**

> One of the highlighted strengths of the Instrument was the inclusion
> of sections of internal controls relating to computer security. A
> previous audit of the agency had identified several issues with
> computer security. The Instrument addressed areas of concern
> identified in the previous audit and assisted them in preparing their
> responses for their next security audit. Team members also indicated
> that the Instrument helped identify additional weaknesses, such as the
> inadvertent release of confidential information through e-mail.
>
> The information technology section provided a useful framework for a
> State engaged in a system development effort, for developing system
> requirements, and for ensuring compliance after a system is completed.
> Arkansas suggested that the Instrument could be a companion tool for
> strategic planning.

3.  **Changes to the Instrument**

> The Arkansas Project Team proposed the following changes to the
> Instrument:

-   Revising the Instrument to reduce or eliminate redundancy;

-   Adding a section specific to child care; and

-   Streamlining criteria to include more checklists.

    1.  **Recommendations**

> The Arkansas Project Team recommendations included:

-   Allowing 90 days to complete the instrument;

```{=html}
<!-- -->
```
-   Enlisting an external entity to validate the self-assessment
    responses from the agency;

-   Using this Instrument with other agency planning tools;

-   Working with the ACF staff in the Regional Office to validate the
    self-assessment process; and

-   Including a discussion about the strengths and weakness, as well as
    lessons learned from using the Instrument, as part of the annual
    State Administrator's Meetings.

B.  []{#__RefHeading___Toc166558847 .anchor}**Illinois**

    1.  **Review Team Process**

> The Illinois Project Team struggled with the Instrument. Although
> representatives from multiple parts of the Department of Human
> Services (DHS) attended the site visit, the Illinois Project Team had
> difficulty making assignments because so many of the elements within
> the Instrument dealt with areas outside of child care. The Illinois
> Project Team attributed their difficulty with assignments to not
> having buy-in from a high enough administrative level, which prevented
> implementation of the Instrument in other areas of the agency.

2.  **Benefits of the Instrument**

> Illinois paid particular attention to its relationship with
> contractors in completing the Instrument. Illinois relies heavily on
> contractors in administration of child care services and this
> Instrument helped the agency identify the importance of monitoring the
> internal controls of its contractors. Both the Illinois Project Team
> and the ACF staff in Region V indicated that all of the providers
> under contract with DHS must go through a single agency audit, which
> addresses many of the same internal controls. The Illinois Project
> Team indicated that they would make a streamlined Instrument available
> to contractors to document internal controls.

3.  **Changes to the Instrument**

> The Illinois Project Team proposed the following changes to the
> Instrument:

-   Revising the Instrument to reduce or eliminate redundancy;

-   Streamlining criteria to include more checklists;

-   Including a section specific to child care; and

-   Involving States that participated in the pilot in reviewing and
    modifying the Instrument.

    1.  **Recommendations**

> Illinois Project Team recommendations included:

-   Establishing an area on the CCB Web site for States to provide links
    for sharing internal control documentation, not available either on
    the Internet or the State agency Intranet;

-   Tailoring the Instrument to focus on the child care program;

-   Eliminating redundancies across sections;

-   Allowing 90 days to complete the instrument; and

-   Reviewing and updating the Instrument every two years.

C.  []{#__RefHeading___Toc166558848 .anchor}**Kentucky**

    1.  **Review Team Process**

> In order to obtain initial buy-in from all levels of the organization,
> The Kentucky Project Team used the completed Kansas Instrument as a
> guide to determine who to include in the initial site visit kick-off
> meeting. By involving upper- and mid-level management in the site
> visit, Kentucky derived a strong commitment, buy-in, and coordination,
> which they determined is critical to the success of the process.

2.  **Benefits of the Instrument**

> Kentucky determined that auditing staff participation was critical to
> the success of its self-assessment process. The external auditors were
> initially reluctant to participate, but as they went through the
> self-assessment process, they realized that their participation would
> not adversely affect their working relationship with the agency.
>
> Use of the Instrument in Kentucky helped verify that many practices
> and procedures were already in place; however, most needed better
> documentation. In some cases, particularly in the fiscal area, the
> Kentucky Project Team determined that the process currently in place,
> worked without written documentation. By identifying and reviewing the
> practices and procedures through use of the Instrument, the team
> verified that processes existed and that the agency was using them
> appropriately.

3.  **Changes to the Instrument**

> The Kentucky Project Team proposed the following changes to the
> Instrument:

-   Revising the Instrument to reduce or eliminate redundancy; and

-   Including a section specific to child care.

    1.  **Recommendations**

> The Kentucky Project Team recommendations included:

-   Choosing the timeframe within the fiscal year to minimize major
    conflicts;

-   Ensuring sufficient time and staff support to complete the process;

-   Allowing 90 days to complete the Instrument;

-   Reviewing and updating the Instrument every 3 to 5 years;

```{=html}
<!-- -->
```
-   Including a section specific to child care;

-   Having top management review the final Instrument;

-   Using the column "Findings/Results & Suggested Follow-up if
    Necessary" for documenting activities and areas where the State
    needed to do additional work; and

-   Providing the following supports to States:

```{=html}
<!-- -->
```
-   Kansas suggestions for team selection and completing the Instrument;

-   A site visit;

-   Technical assistance; and

-   Ongoing follow-up.

D.  []{#__RefHeading___Toc166558849 .anchor}**Maine**

    1.  **Review Team Process**

> Due to scheduling problems, Maine did not have a site visit. Training
> took place through a conference call. The Maine Project Team stated
> that it would have been helpful to have assistance at the beginning of
> the process to answer any questions face-to-face, but did not feel
> that the lack of a site visit, in general, was a hindrance to
> successfully completing the Instrument. Maine did stress the
> importance of reviewing the Instrument completely so that
> participating State staff understand all of the areas to be considered
> when completing the Instrument and who would be responsible.
>
> The Maine Project Team read the information provided by Kansas and
> reviewed the Kansas Instrument prior to organizing its team and
> completing the Instrument. Once the core participants of the Maine
> Project Team identified all of the program areas, the project
> coordinator went to the Directors of all of the identified areas (HR,
> IT, etc.) requesting that they assign the appropriate staff. Maine did
> not have problems securing the staff resources needed to conduct this
> review.

2.  **Benefits of the Instrument**

> The Maine team considered the completeness of the Instrument to be a
> great strength. The Maine team thought that the Instrument was very
> helpful in identifying and addressing potential issues. Maine pointed
> out that the State Child Welfare program is now using the Instrument
> as part of an accreditation effort. The Human Relations (HR)
> representative stated that Maine is very proud of its Performance
> Evaluation System (PER) and he was therefore surprised to realize that
> the Maine PER did not contain integrity and ethical value components
> identified in the Instrument. He stated that the HR program would
> consider adding integrity and ethical value information during
> consideration for revisions during the next review cycle.

3.  **Changes to the Instrument**

> The Maine Project Team proposed the following changes to the
> Instrument:

-   Revising the Instrument to reduce or eliminate redundancy; and

-   Developing a verification or validation process to ensure that
    answers were accurate and appropriate.

    1.  **Recommendations**

> Maine Project Team recommendations included:

-   Allowing 90 days to complete the Instrument;

-   Reviewing and updating the Instrument every year; and

-   Applying the Instrument in other areas of the agency, such as child
    welfare.

E.  []{#__RefHeading___Toc166558850 .anchor}**Montana**

    1.  **Review Team Process**

> Prior to the site visit, Montana reviewed the Instrument and all
> associated criteria. Because of the review, Montana realized that the
> Instrument was broader in scope than anticipated. The Montana Project
> Team identified the staff member from each area most appropriate to
> complete the Instrument. In the few instances where they did not
> identify the appropriate staff resources, the team approached the
> Director of that agency for the needed support. Montana had no
> difficulty obtaining the necessary cooperation with the other
> participating agencies. The Montana team stressed that, to save time,
> a core group should first review the Instrument before engaging the
> larger group.

1.  **Benefits of the Instrument**

> Montana was optimistic that the Instrument would inform the work of
> the child care program and assist in identifying policies, practices,
> and procedures to prevent errors that could result in improper
> payments. The Montana Project Team stated that the Instrument was
> useful and that the information reinforced information identified in
> other process work in the State. Several areas highlighted weaknesses
> that the agency needs to address, such as succession planning for
> staffing, the sharing of IT planning documents, developing future
> strategies, writing desk manuals to reduce confusion during periods of
> staff turnover, and disaster planning with agencies contracted with to
> administer portions of the child care program.

2.  **Changes to the Instrument**

> The Montana Project Team proposed the following changes to the
> Instrument:

-   Revising the Instrument to reduce or eliminate redundancy;

-   Including a section specific to the child care program;

```{=html}
<!-- -->
```
-   Stressing that States must have an upfront understanding of the
    internal controls in other areas of the organization and how those
    controls influence the child care program; and

-   Requesting guidance from Federal staff in the Central and ACF
    Regional Offices on how to use the results.

    1.  **Recommendations**

> Montana Project Team recommendations included:

-   Assigning an administrative assistant to the project to coordinate
    the process to free up the administrator's time;

-   Allowing adequate time to complete the process;

-   Establishing an agreed upon timeframe to ensure a timely and
    thoughtful completion of the Instrument;

-   Allowing 90 days to complete the Instrument;

-   Scheduling to minimize the conflict of other major activities
    occurring at the same time as the self-assessment process; and

-   Reviewing and updating the Instrument every five years, except in
    the areas such as the IT plan and the HR manual, which may require
    more frequent changes.

F.  []{#__RefHeading___Toc166558851 .anchor}**Nevada**

    1.  **Review Team Process**

> The Nevada Welfare Division has an Administrator, three Deputy
> Administrators, and a number of Chiefs. The Child Care Director first
> looked at all of the tasks and then approached the Deputy
> Administrators and Chiefs of the various areas he felt should be
> involved. In some cases, the Chief participated directly, while in
> other areas the Chief delegated responsibility to others. Having all
> of the participants together at the site visit to decide who was most
> appropriate to answer a particular section was extremely valuable.

1.  **Benefits of the Instrument**

> The Nevada Project Team indicated that combining all of the
> documentation in a single document was helpful. Using the hyperlink
> rather than printing the complete set of documentation was beneficial
> because the link will route to the most current version of a document,
> as many policy documents are on a regular schedule for updates. The
> Nevada Project Team indicated that the Instrument could support many
> other activities within the entire organization.

2.  **Changes to the Instrument**

> The Nevada Project Team proposed the following changes to the
> Instrument:

-   Revising the Instrument to reduce or eliminate redundancy; and

-   Including a section specific to the child care program.

    1.  **Recommendations**

> Nevada Project Team recommendations included:

-   Planning a suitable timeframe for Instrument completion to avoid
    conflicts with other major initiatives;

-   Ensuring top-down support. Engaged and supportive top management is
    critical for success in this project;

-   Allowing 90 days to complete the Instrument;

-   Allowing sufficient time to complete the process;

-   Providing clear instructions;

-   Having someone with sufficient authority to be in charge to e-mail
    and follow up when sections were due; and

-   Reviewing and updating the Instrument every two years.

G.  []{#__RefHeading___Toc166558852 .anchor}**Puerto Rico**

    1.  **Review Team Process**

> The Commonwealth of Puerto Rico participated in the project based on
> the strong encouragement of the ACF staff in the Region II Office, who
> thought that including a site where Spanish is vital to its operations
> would also enrich the project. First, Puerto Rico examined the
> Instrument in depth, organized its Project Team, and then prepared and
> scheduled the orientation/site visit. Puerto Rico translated the
> Instrument into Spanish for ease of use by its staff.
>
> In preparation for the review, the Puerto Rico Project Team analyzed
> its Child Care State Plan, its Annual Plan, program components, and
> other appropriate plans to have a clear overview of the program scope,
> goals, and objectives. This was done to determine how well the
> internal controls of the agency are established and functioning and to
> assess and recommend what, where, and how the Administration needed to
> improve. The participants felt that the process allowed them the
> opportunity for self-evaluation and identification of strengths and
> needs of the Child Care Program. Consequently, action plans to deal
> with identified needs will be developed following on-going meetings
> throughout the next year.
>
> During the process of administering the Instrument, the Puerto Rico
> Project Team included personnel from its Regions and direct service
> providers. Puerto Rico organized the direct service providers into
> clusters or teams to respond to the Instrument. The clusters
> frequently responded that the Instrument did not apply to their
> day-to-day operations of direct service to families and their
> children.
>
> The Central Office manages most of the internal control processes that
> affect the Regions. Therefore, the Regions only responded to elements
> over which they had a level of control.
>
> As part of its initial planning, the Puerto Rico Project Team
> established deadlines to collect the needed information and complete
> the Instrument. The team assigned a central person to collect,
> compile, review, and summarize all of the responses. The Puerto Rico
> Project Team then analyzed the collected data, reviewed the findings,
> and developed a list of strengths, weaknesses, and recommendations for
> improvement. For the additional fiscal findings, the team compiled an
> action plan with appropriate deadlines and identified responsible
> parties.

2.  **Benefits of the Instrument**

> The Puerto Rico Project Team indicated that the process allowed them
> the opportunity for self-evaluation to identify the strengths and
> needs of the Child Care Program. The Puerto Rico Project Team will
> develop action plans to address identified needs during the next year.

3.  **Changes to the Instrument**

> The Puerto Rico Project Team proposed the following changes to the
> Instrument:

-   Incorporating an external validation process; and

-   Including a section specific to the child care program.

    1.  **Recommendations**

> Puerto Rico Project Team recommendations included:

-   Using it as a tool to re-examining issues raised in previous fiscal
    audits;

-   Using it to compliment other agency monitoring activities;

-   Including additional fiscal audit findings, as a follow-up to
    previous audits;

-   Including a list of strengths, weaknesses, and recommendations for
    improvement in the child care area; and

-   Developing a corrective action plan for areas needing improvement
    with appropriate deadlines and identified responsible parties.

H.  []{#__RefHeading___Toc166558853 .anchor}**Washington**

    1.  **Review Team Process**

> The Washington State Child Care Program reorganized into a new State
> agency, splitting off from the Children's Bureau. Lacking new
> leadership and high-level administrative support, the Washington
> project coordinator reviewed the Kansas documentation and recruited
> other State program areas identified as potentially appropriate to
> participate in the self assessment process. However, since a member of
> the Children's Bureau could not be present at the site visit, it
> created some initial problems in completing the Instrument.
>
> Due to the organization, the project coordinator stressed the need for
> the team members to have an institutional history. While there may be
> detailed policies in place, it is important to have an external check
> to assess the adequacy of State adherence to the policies.

2.  **Benefits of the Instrument**

> Staff from the Washington State Children's Bureau indicated that the
> process was very helpful as an internal assessment and highlighted the
> need to update or condense policies.
>
> The Instrument highlighted several areas that the State needed to or
> is in the process of addressing. Within Human Resources, staff members
> are updating policies dealing with employee development and training,
> employee discipline, and other policies. Because of changes in the
> organization and the development of a new computer system within the
> Children's Bureau, the Operations manual and Practice Models need
> updating. The team also stated that roles and responsibilities are
> constantly changing but the documentation of those changes often does
> not occur.

3.  **Changes to the Instrument**

> The Washington Project Team proposed the following changes to the
> Instrument:

-   Making revisions to the Instrument to reduce or eliminate
    redundancy; and

-   Including a section specific to the child care program.

    1.  **Recommendations**

> Washington Project Team recommendations included:

-   Gaining support and cooperation from other critical entities in the
    organization;

-   Reviewing and updating the Instrument every two years; and

-   Allowing 90 days to complete the Instrument.

I.  []{#__RefHeading___Toc166558854 .anchor}**Conclusions**

Each of the pilot States indicated several benefits resulting from the
self-assessment process, including planned actions to improve internal
controls in an effort reduce errors that can lead to improper payments.
Examples of State benefits included:

-   For Arkansas, because a previous agency audit identified several
    issues with computer security, the Instrument assisted in preparing
    responses for the next security audit. Arkansas also indicated that
    the Instrument helped identify additional weaknesses, such as the
    inadvertent release of confidential information through e-mail.

```{=html}
<!-- -->
```
-   Illinois relies heavily on contractors in administration of child
    care services and this Instrument helped the agency identify the
    importance of monitoring the internal controls of its contractors.
    Illinois indicated that they would make a streamlined Instrument
    available to contractors to document internal controls.

```{=html}
<!-- -->
```
-   Use of the Instrument in Kentucky helped verify that many practices
    and procedures were already in place; however, most needed better
    documentation. By identifying and reviewing the practices and
    procedures through use of the Instrument, Kentucky verified that
    processes existed and that the agency was using them appropriately.

```{=html}
<!-- -->
```
-   In Maine, the State Child Welfare program is now using the
    Instrument as part of an accreditation effort and the Human
    Relations is considering adding integrity and ethical value
    information to its Performance Evaluation System (PER).

```{=html}
<!-- -->
```
-   Montana indicated that the Instrument highlighted several areas of
    weaknesses that the agency needs to address, such as succession
    planning for staffing, the sharing of IT planning documents,
    developing future strategies, writing desk manuals to reduce
    confusion during periods of staff turnover, and disaster planning
    with agencies contracted with to administer portions of the child
    care program.

-   Nevada indicated that while it was challenging to conduct the
    Instrument during change to a new automated system, the
    self-assessment process provided checks of all necessary internal
    controls as part of the implementation process.

```{=html}
<!-- -->
```
-   Puerto Rico used the Instrument as a tool to re-examine issues
    raised in previous fiscal audits.

-   In Washington, Human Resources staff members are updating policies
    dealing with employee development and training, employee discipline,
    and other policies. Because of changes in the organization and the
    development of a new computer system within the Children's Bureau,
    the Operations manual and Practice Models need updating.

In summary, the pilot States achieved several benefits from the
Instrument. The next chapter provides an estimate of the costs incurred
by the States to implement the self-assessment process.

V.  []{#__RefHeading___Toc166558855 .anchor}**ESTIMATED COSTS**

    A.  []{#__RefHeading___Toc166558856 .anchor}**Objectives of the Cost
        Analysis**

This chapter reports on costs of the pilot implementation of the State
Internal Control Self-Assessment Instrument in nine States. The pilot
State cost estimates provide useful data instructive for States and
Federal Regional staff regarding the feasibility of future
implementations of the Instrument.

B.  []{#__RefHeading___Toc166558857 .anchor}**Measuring the Costs to
    Conduct the State Internal Control Assessment Pilot**

The Federal Project Team requested that States track the hours spent
preparing for and implementing the Instrument, including the time spent
on the site visit and any necessary follow-up activities. States
submitted hours contributed by each participating staff person, with an
estimate of the hourly rate of staff salary and benefits costs. The
Federal Project Team then multiplied the number of hours by the salary
and benefits of the participating staff, factoring in any additional
costs, such as travel or copying.

The following table highlights the estimated costs incurred by States
while conducting the State Internal Control Self-Assessment project.
Illinois was unable to provide cost data; therefore, there is no
estimate for Illinois.

[]{#__RefHeading___Toc163986139 .anchor}**Exhibit 3.** Estimated costs
of conducting a State Internal Self-Assessment

+--------------+---------------------------+---------------------------+
| **Region**   | **State**                 | **Cost Est.**             |
+--------------+---------------------------+---------------------------+
| I            | Maine                     | \$3,032                   |
+--------------+---------------------------+---------------------------+
| II           | Puerto Rico               | \$53,128                  |
+--------------+---------------------------+---------------------------+
| IV           | Kentucky                  | \$2,859                   |
+--------------+---------------------------+---------------------------+
| V            | Illinois                  | N/A                       |
+--------------+---------------------------+---------------------------+
| VI           | Arkansas                  | > \$4,242                 |
+--------------+---------------------------+---------------------------+
| VII          | Kansas                    | \$4,846                   |
+--------------+---------------------------+---------------------------+
| VIII         | Montana                   | \$9,445                   |
+--------------+---------------------------+---------------------------+
| IX           | Nevada                    | \$3,443                   |
+--------------+---------------------------+---------------------------+
| X            | Washington                | \$8,227                   |
+--------------+---------------------------+---------------------------+
|              | **Total Cost Est.**       | **\$66,297**              |
+--------------+---------------------------+---------------------------+

The costliest variable for States was the number of participating staff.
Some States included more staff in the site visit than did other States.
For example, Montana had 25 participants at the site visit; Puerto Rico
included 27 people at a two-day site visit, while the majority of States
had between nine and twelve participants. Other variables that
potentially could affect costs were travel, copying, or teleconferencing
costs. Although cost data were not reported by variable, the costs of
these other variables is assumed to be minimal, based on anecdotal
information.

Given the scope and complexity of the Instrument, the costs are
relatively modest. Kentucky and Maine estimated costs of approximately
\$3,000, while Montana and Washington estimated between \$8,000 and
\$9,500. The costs were higher for the Commonwealth of Puerto Rico for
several reasons. Puerto Rico had higher preparation costs due to
translating the Instrument to Spanish and involving a larger number of
the staff in the two-day training site visit, which involved
simultaneous translation services. Puerto Rico enlarged the scope of its
self-assessment process to include issues raised in an earlier fiscal
audit. Puerto Rico also included the largest number of persons (47) in
the process to complete the Instrument. The large number of participants
and the expansion of the scope of the project resulted in costs that
were substantially higher than any other State.

The average cost to States, excluding the atypical amount for Puerto
Rico, was \$5,156.

VI. []{#__RefHeading___Toc166558859 .anchor}**CONCLUSIONS AND
    RECOMMENDATIONS**

This pilot examined the implementation of the State Internal Control
Self-Assessment Instrument as a method for reviewing and documenting the
adequacy of a State's internal control system, identifying internal
control weaknesses, and providing documentation of findings and possible
corrective actions. This chapter presents the conclusions and
implications derived from the nine pilot States\' experiences. The
chapter concludes with recommendations for future pilots.

A.  []{#__RefHeading___Toc166558860 .anchor}**Conclusions**

Based on the self-assessment process, the nine pilot States offered the
following conclusions for future pilots:

*A successful Instrument implementation process needs involvement across
program areas***.** States realized that the scope of the
self-assessment process was broad, requiring the involvement of common
supporting areas that cross walk several different programs, such as
Human Resources and Information Technology. As a result, the commitment
of all parts of the organization is critical to the success of the
self-assessment process.

*High-level management support is important for optimal implementation*.
For those States without the necessary organizational support, the
self-assessment process was a greater challenge. The States that found
the self-assessment process most rewarding were those States that had a
high level of commitment from the top State organizational level.

*Redundancies in the Instrument did not serve a useful purpose***.** All
nine pilot States expressed a need to streamline the Instrument and
eliminate the redundancies. States also requested creating a section
specific to the child care program. WRMA revised the Instrument as
explained in the section below.

*States need to allow adequate time to complete the self-assessment
process*. States recommended establishing an agreed upon timeframe to
ensure timely and thoughtful completion of the Instrument. Most States
indicated that a 90-day timeframe for Instrument completion was
adequate. Several States recommended scheduling the self-assessment
process to occur within a timeframe that does not conflict with other
major agency activities. Most States recommended updating the Instrument
every two years.

*States may use hyperlinks to refer to documents on the State's Internet
and/or Intranet Web site to ensure that the Instrument stays current by
linking dynamically to continuously updated documentation*. Most States
indicated that combining all of the documentation in a single document
was helpful. Using the hyperlink rather than printing the complete set
of documentation was beneficial because the link will route to the most
current version of a document. This is important as many policy
documents are on a regular schedule for updates. The Illinois Project
Team recommended establishing an area on the CCB Web site for States to
provide links for sharing internal control documentation, which is not
available on either the Internet or the State agency Intranet.

*Agency allocation of an overall project coordinator is critical to the
self-assessment process.* The project coordinator needs to have top-down
management support, sufficient authority to set deadlines, availability
during the entire process to provide clear instructions, answer
questions, consult with team members and coordinate with top agency
leadership.

B.  []{#__RefHeading___Toc166558861 .anchor}**Estimated Costs**

Despite the scope and complexity of the Instrument, the costs of
conducting a State Internal Control Self-Assessment are relatively
modest. Kentucky and Maine estimated costs of approximately \$3,000,
while Montana and Washington estimated between \$8,000 and \$9,500. The
range for all States was \$3,032 through \$9,445. The costs for the
Commonwealth of Puerto Rico were significantly higher, due to several
factors. Puerto Rico involved the greatest number of personnel in the
site visit and in the Instrument implementation process. Puerto Rico
also expanded the scope of the self-assessment process to examine areas
needing attention as identified in a prior audit.

C.  []{#__RefHeading___Toc166558862 .anchor}**Revisions to the
    Instrument**

The nine pilot States recommended elimination of the redundancies and
the tailoring of certain elements to the child care program. Based on
the advice of the participating States and ACF staff in Regional Offices
requested that WRMA modify the Instrument. The objective of the
modifications was to reduce the redundancy, clarify the instructions,
and tailor Section III to include elements specific to the child care
program. In order to involve all pilot States in the process of
Instrument modification, WRMA shared the revised Instrument with the
States and the ACF staff in the Regional Office who drafted the initial
Instrument. Following receipt of all of the comments, WRMA made further
revisions to the Instrument. Appendix M contains the revised Instrument.

The modifications to the Instrument included:

-   Eliminating or combining 23 elements in Section I and II (Control
    Environment and Risk Assessment) for a reduction of 23%;

-   Reviewing and clarifying all instructions for each section of the
    Instrument;

-   Revising Section III: Common categories of control activities to
    specifically focus on the child care program; and

-   Making minor changes to Sections IV and V.

The modifications did not affect the integrity of the Instrument.

D.  []{#__RefHeading___Toc166558863 .anchor}**Recommendations**

The Instrument can provide the CCB staff in the Central and Regional
Offices and States with a systematic method for reviewing and
documenting the adequacy of a State's internal control system,
identifying internal control weaknesses, and providing documentation of
findings and possible corrective actions. Recommendations include:

-   *Obtain the commitment of all parts of the organization prior to
    initiation of the process.* A successful Instrument implementation
    process needs involvement across program areas**.** States realized
    that the scope of the self-assessment process was broad, requiring
    the involvement of common supporting areas that cross walk several
    different programs.

-   *Market the Instrument to programs in addition to the child care
    program*. Some States adapted the Instrument to meet other needs
    beyond the child care program. Puerto Rico used the self-assessment
    process to re-examine fiscal areas highlighted in a previous audit,
    and included an action plan with the self-assessment findings. Maine
    intends to strengthen its Performance Evaluation System (PER) by
    including a section focusing on ethics and personal integrity.

-   *Consider involving an external entity to review the accuracy and
    validity of State responses*. Arkansas recommended enlisting an
    external entity to validate the self-assessment responses from the
    agency. Puerto Rico and Maine also recommended developing a
    verification or validation process to ensure that responses were
    accurate and appropriate. Several States recommended the involvement
    of the Regional Offices to assist with the validation process.

-   *Consider integrating the self-assessment process with the agency's
    strategic or business plans.* High-level management support is
    important for broader implementation of the self-assessment process.
    States may choose to involve senior management staff initially to
    determine the applicability of the self-assessment process with the
    broader agency mission or strategic planning process. Within the
    child care program the Instrument can be combined with the CCDF
    State Plan to serve as a biannual update of State efforts towards
    the prevention of errors that could result in improper payments.
    Senior management staff can review responses to ensure consistency
    with agency mission and strategic and business plans.

    D.  []{#__RefHeading___Toc166558864 .anchor}**Recommended Steps for
        Successful Implementation**

Based on the first pilot State experience, Kansas offered several
logistical steps that can maximize the effectiveness of the methodology
process. The following steps provided useful guidance for the nine pilot
States' implementation experience and support the above recommendations.
The steps include:

1.  Select one overall project coordinator. It is critical that the
    project coordinator is available during the entire process to answer
    questions, consult with team members and coordinate with the CCB or
    WRMA.

2.  Select a full range of State Project Team members. The following
    list includes potential County and Contractor staff for States where
    that may be appropriate. Appendix B provides a table listing
    potential team members and their functions. Potential team members
    may include:

    a.  High and Middle Level Management;

    b.  Audits;

    c.  Human Resources;

    d.  Information Technology;

    e.  Program Staff including those working on systems for programs if
        different than IT staff;

    f.  Quality Assurance;

    g.  Eligibility staff (State, County or contractors);

    h.  Licensing Staff;

    i.  Finance/Accounting;

    j.  Operations;

    k.  Public Information Officer;

    l.  Legislative Liaison; and

    m.  County management staff if County Administered.

3.  Hold an initial team meeting to explain purpose, process and sell
    the project. If possible, have a senior level management staff
    person kick-off the project at this meeting. Go over each section of
    the document and make specific assignments to the team members for
    each section of the document. States that performed this step
    reported that it was very important to successful completion of the
    document.

4.  Hold additional follow-up meetings to ensure that all participants
    tasked with completing sections of the assessment understand the
    purpose and process.

5.  Make sure the identified coordinator is available during the entire
    process to answer questions, hold conference calls, consult with
    team members and coordinate with the CCB or WRMA.

6.  Designate and involve support staff at the beginning for tracking
    and compiling data and information, editing for errors, checking
    grammar, and providing writing style consistency.

7.  Provide all team members with an electronic version of the document
    to use in completing their assigned sections. Have all information
    entered on the electronic document and sent to coordinator who can
    then assign support staff to integrate it into one document. If more
    than one team member completes a section, integration with oversight
    from coordinator may be necessary.

8.  Establish an agreed upon type style and font size so that responses
    can be inserted into the master document easily.

9.  Discuss documentation: Web sites (hyperlink to both Internet and
    Intranet) and hard copy attachment options with all team members.

10. Hold additional meetings with all team members or sub-groups to
    share the completed document, receive comments and feedback, and
    make changes to document as needed.

11. Have senior management staff review responses to ensure consistency
    with agency's mission and strategic or business plans.

    []{#__RefHeading___Toc165450415 .anchor}**Appendix A. Site Visit
    Agenda**

*State Name*

Site Visit Schedule

*Date*, 2006

**Site Visit Project Team**

> **Child Care Bureau:** *List all CCB participants*
>
> **Regional Staff:** *List all Regional Staff*
>
> **WRMA Project Team:** *List all WRMA Staff*
>
> **State Project Team:** *List State Project Team*

**Meet with State Error Rate Project Team**

**Introduction & Overview**

Introductions: CCB, State Review Team, Regional Staff, WRMA Team

> Overview of project goals and objectives (WRMA Study Team)

**Overview of State Control Self-Assessment Review Instrument**

Overview of the Instrument Development

-   Explanation of GAO 01-1008G.

-   Explanation of prior State experiences.

    -   Discussion of State Team make up

    -   Discussion of how Kansas documented the Instrument, including
        use of URL's for both Intranet and Internet.

```{=html}
<!-- -->
```
-   Discussion of follow-up status conference call and Technical
    Assistance.

**In-depth review of the Internal Control Self-Assessment Instrument**

A complete walkthrough of the Instrument

-   Examine each item for relevancy and consistent interpretation

-   Discuss which part of the team will answer each item. In many cases,
    more than one part of the organization will answer a given element.

-   Discuss how the State team will provide the supporting
    documentation. (hard copy, Intranet URL, Internet URL)

**Wrap Up**

> Meet with State Error Rate Project Team Leader share
> impressions/insights, allow for additional questions and answers, and
> arrange for any additional material that may be needed

**Next Steps**

> Additional Follow-up teleconferences (State/Fed team) as needed.
>
> Additional Follow-up teleconferences (All pilot State/Fed teams) as
> needed.

[]{#__RefHeading___Toc165450416 .anchor}**Appendix B. Potential Team
Members and Functions**

Each State must examine its organizational structure to determine how to
make assignments for completing the Instrument. For example, some States
are county administered, while others use contractors to administer some
or all child care services within the State. Some pilot States included
counties or contractors to participate on the State Project Team.

The following table lists how the pilot States assigned potential team
members to functional areas for completion of the Instrument.

+-----------------------+-----------------------+-----------------------+
| **Potential Team      |                       |                       |
| Members and           |                       |                       |
| Functions**           |                       |                       |
+-----------------------+-----------------------+-----------------------+
| **State**             | **County**            | **Contractor**        |
+-----------------------+-----------------------+-----------------------+
| High Level            | High Level            |                       |
| Management:           | Management:           |                       |
|                       |                       |                       |
| I, II, IV, V          | I, II, IV, V          |                       |
+-----------------------+-----------------------+-----------------------+
| Mid Level Management: | Mid Level Management: |                       |
|                       |                       |                       |
| I, II, IV, V          | I, II, IV, V          |                       |
+-----------------------+-----------------------+-----------------------+
| Audits: I, II, V      |                       |                       |
+-----------------------+-----------------------+-----------------------+
| Human Resources: I,   | Human Resources: I,   | Human Resources: I,   |
| II                    | II                    | II                    |
+-----------------------+-----------------------+-----------------------+
| Information           | Information           | Information           |
| Technology (IT): III  | Technology (IT): III  | Technology (IT): III  |
+-----------------------+-----------------------+-----------------------+
| Program Staff that    | Program Staff that    | Program Staff that    |
| also work with IT     | also work with IT     | also work with IT     |
| system: III           | system: III           | system: III           |
+-----------------------+-----------------------+-----------------------+
| Program Staff: III    |                       |                       |
+-----------------------+-----------------------+-----------------------+
| Eligibility Staff:    | Eligibility Staff:    | Eligibility Staff:    |
| III                   | III                   | III                   |
+-----------------------+-----------------------+-----------------------+
| Quality Assurance:    |                       |                       |
| III                   |                       |                       |
+-----------------------+-----------------------+-----------------------+
| Licensing: III        |                       |                       |
+-----------------------+-----------------------+-----------------------+
| Operations: III       |                       |                       |
+-----------------------+-----------------------+-----------------------+
| Finance/Accounting:   | Finance/Accounting:   | Finance/Accounting:   |
| I, II, V              | I, II, V              | I, II, V              |
+-----------------------+-----------------------+-----------------------+
| Public Information    |                       |                       |
| Officer: I, V         |                       |                       |
+-----------------------+-----------------------+-----------------------+
| Legislative Liaison:  |                       |                       |
| I, V                  |                       |                       |
+-----------------------+-----------------------+-----------------------+

[]{#__RefHeading___Toc165450417 .anchor}**Appendix C. Suggested
Assignments for Completing the Assessment Instrument**

Each State must examine its organizational structure to determine how to
make assignments for completing the Instrument. For example, some States
are county administered, while others use contractors to administer some
or all child care services within the State. Some pilot States included
counties or contractors to participate on the State Project Team.

The following outline provides suggested assignments for completion of
the Instrument based upon this pilot study. States need to include
high-level management staff initially to obtain necessary buy-in and
agency-wide administrative support. Each of the following assignments
directly corresponds to the sections and elements in the **Modified**
Self Internal Control Self-Assessment Instrument. States may choose to
assign multiple sections to some team members and two or more team
members may respond to different criteria within the same section.

**Section I - Control Environment**

> Integrity and Ethical Values
>
> 1 - High/Middle Level Management, Human Resources, Finance & Audits
>
> 2 - High/Middle Level Management, Human Resources, Finance & Audits
>
> Commitment to Competence
>
> 1 - Human Resources & Training (if separate) & Field/Contractor/County
> Management
>
> Management Philosophy and Operating Style
>
> 1 - High/Middle Management & Finance & Operations
>
> 2 - Human Resources
>
> 3 - High/Middle Management & Audits & Operations & Finance
>
> Organizational Structure
>
> 1 - High/Middle Management & Field/Contractor/County Management
>
> 2 - High/Middle Management & Field/Contractor/County Management
>
> 3 - High/Middle Management & Field/Contractor/County Management
>
> 4 - High/Middle Management & Field/Contractor/County Management &
> Human Resources
>
> Assignment of Authority and Responsibility
>
> 1 - High/Middle Management & Field/Contractor/County Management &
> Human Resources
>
> Human Resource Policies and Practices
>
> 1 - Human Resources
>
> Oversight Groups
>
> 1 - Audits
>
> 2 - High Management & Finance & Legislative Liaison
>
> **Section II - Risk Assessment**
>
> Establishment of Entity-Wide Objectives
>
> 1 - Finance & Operations & Programs
>
> 2 - High/Middle Management & Field/Contractor/County Management
>
> Establishment of Activity
>
> 1 - High/Middle Management & Finance & Field/Contractor/County
> Management
>
> 2 - High/Middle Management & Finance & Field/Contractor/County
> Management
>
> Risk Identification
>
> 1 - Audits & Operations & Human Resources & Finance
>
> 2 - Audits & Operations & Human Resources & Finance
>
> Risk Analysis
>
> 1 - Audits & Operations
>
> Managing Risk During Change
>
> 1 - Audits & Finance & Operations
>
> **Section III - Control Activities**
>
> General Application
>
> 1 - Programs
>
> 2 - Program & Quality Assurance & Field/Contractor/County Management
>
> Common Categories of Control Activities
>
> 1 - Programs & Finance & Field/Contractor/County Management
>
> 2 - Programs & Quality Control & Human Resources/Personnel &
> Field/Contractor/County Management
>
> 3 - Programs & Information Technology, Quality Assurance, &
> Field/Contractor/County Management
>
> 4 - Programs & Information Technology, Quality Assurance, &
> Field/Contractor/County Management
>
> 5 - Programs & Information Technology, Quality Assurance, &
> Field/Contractor/County Management
>
> 6 - Programs & Information Technology, Quality Assurance, &
> Field/Contractor/County Management
>
> 7 - Programs & Information Technology, Quality Assurance, Finance, &
> Field/Contractor/County Management
>
> 8- Programs & Information Technology, Quality Assurance, Finance, &
> Field/Contractor/County Management
>
> 9- Programs & Information Technology, Quality Assurance, Finance, &
> Field/Contractor/County Management
>
> Control Activities Specific for Information Systems - General Control
>
> Entity-wide Security Management Program
>
> 1 - Information Technology
>
> 2 - Information Technology
>
> 3 - Information Technology
>
> 4 - Information Technology & Human Resources
>
> 5 - Information Technology
>
> Access Control
>
> 1 - Information Technology
>
> 2 - Information Technology
>
> 3 - Information Technology
>
> Application Software Development and Change Control
>
> 1 - Information Technology
>
> 2 - Information Technology
>
> 3 - Information Technology
>
> System Software Control
>
> 1 - Information Technology
>
> 2 - Information Technology
>
> Segregation of Duties
>
> 1 - Information Technology
>
> 3 - Information Technology & Programs & Field/Contractor/County
> Management
>
> Service Continuity
>
> 1 - Information Technology
>
> 2 - Information Technology
>
> Control Activities Specific for Information Systems - Application
> Control
>
> Authorization Control
>
> 1 - Information Technology
>
> 2 - Information Technology
>
> 3 - Information Technology
>
> Completeness Control
>
> 1 - Field/Contractor/County Management
>
> 2 - Programs & Information Technology & Field/Contractor/County
> Management
>
> Accuracy Control
>
> 1 - Information Technology
>
> Control Over Integrity of Processing and Data Files
>
> 1 - Information Technology
>
> **Section IV - Information and Communication**
>
> Information
>
> 1 - Middle Management & Programs
>
> Communications
>
> 1 - High/Middle Management & Field/Contractor/County Management
>
> 2 - High/Middle Management & Field/Contractor/County Management
>
> Forms and Means of Communication
>
> 1 - High/Middle Management & Field/Contractor/County Management
>
> 2 - High/Middle Management & Field/Contractor/County Management
>
> **Section V - Monitoring**
>
> Ongoing Monitoring
>
> 1 - High/Middle Management & Field/Contractor/County Management &
> Programs & Quality Assurance
>
> 2 - Programs & Quality Assurance
>
> 3 - High/Middle Management & Field/Contractor/County Management
>
> 4 - High/Middle Management & Field/Contractor/County Management
>
> 5 - Audits
>
> 6 - High/Middle Management & Field/Contractor/County Management
>
> 7 - High/Middle Management & Field/Contractor/County Management &
> Programs & Audits
>
> 8 - High/Middle Management & Field/Contractor/County Management
>
> 9 - Audits
>
> 10 -High/Middle Management & Field/Contractor/County Management
>
> Audit Resolution
>
> 1 - High/Middle Management & Field/Contractor/County Management &
> Audits
>
> 2 - High/Middle Management & Field/Contractor/County Management

[]{#__RefHeading___Toc165450418 .anchor}**Appendix D. Arkansas
Assessment Team Members**

  ----------------------- --------------------- ------------------------------
  **STATE TEAM                                  
  (ARKANSAS)**                                  

  **(List all members of                        
  the State Team, their                         
  organization, title,                          
  Phone, Fax, and E-mail                        
  addresses)**                                  

  NAME: Tonya Russell     ORGANIZATION/TITLE:   
                          Director, AR DHHS     
                          Division of Child     
                          Care and Early        
                          Childhood Education   

  PHONE: 501-682-0494     FAX: 501-682-2317     E-MAIL:
                                                Tonya.Russell@arkansas.gov

  NAME: Tim Lampe         ORGANIZATION/TITLE:   
                          Assistant Director,   
                          AR DHHS Division of   
                          Child Care and Early  
                          Childhood Education   

  PHONE: 501-683-4286     FAX: 501-682-2317     E-MAIL: Tim.Lampe@arkansas.gov

  NAME: Sam Lamey         ORGANIZATION/TITLE:   
                          Chief Fiscal Officer, 
                          AR DHHS Division of   
                          Child Care and Early  
                          Childhood Education   

  PHONE: 501-683-0989     FAX: 501-682-2317     E-MAIL: Sam.Lampe@arkansas.gov

  NAME: Dave Griffin      ORGANIZATION/TITLE:   
                          Administrator,        
                          Licensing and         
                          Accreditation Unit,   
                          AR DHHS Division of   
                          Child Care and Early  
                          Childhood Education   

  PHONE: 501-682-8590     FAX: 501-682-2317     E-MAIL:
                                                David.Griffin@arkansas.gov

  NAME: Curtis Curry      ORGANIZATION/TITLE:   
                          Administrator,        
                          Special Nutrition     
                          Program Unit, AR DHHS 
                          Division of Child     
                          Care and Early        
                          Childhood Education   

  PHONE: 501-682-8869     FAX: 501-682-2334     E-MAIL:
                                                Curtis.Curry@arkansas.gov

  NAME: Mike Saxby        ORGANIZATION/TITLE:   
                          Administrator,        
                          Compliance Unit, AR   
                          DHHS Division of      
                          Child Care and Early  
                          Childhood Education   

  PHONE: 501-682-8584     FAX: 501-682-2317     E-MAIL: Mike
                                                Saxby@arkansas.gov

  NAME: Ivory Daniels     ORGANIZATION/TITLE:   
                          Administrator, Family 
                          Support Unit, AR DHHS 
                          Division of Child     
                          Care and Early        
                          Childhood Education   

  PHONE: 501-682-8947     FAX: 501-683-0034     E-MAIL: Ivory
                                                Daniels@arkansas.gov

  NAME: Paul Lazenby      ORGANIZATION/TITLE:   
                          Associate Director,   
                          Program Development   
                          and Public            
                          Pre-Kindergarten      
                          Unit, AR DHHS         
                          Division of Child     
                          Care and Early        
                          Childhood Education   

  PHONE: 501-682-9699     FAX: 501-682-4897     E-MAIL:
                                                Paul.Lazenby@arkansas.gov

  NAME: Dwain Griffin     ORGANIZATION/TITLE:   
                          Supervisor Central    
                          Office, Family        
                          Support Unit, AR DHHS 
                          Division of Child     
                          Care and Early        
                          Childhood Education   

  PHONE: 501-682-7909     FAX: 501-683-0034     E-MAIL:
                                                Dwain.Griffin@arkansas.gov

  NAME: Kathy MacKay      ORGANIZATION/TITLE:   
                          Program Coordinator,  
                          Licensing and         
                          Accreditation Unit,   
                          AR DHHS Division of   
                          Child Care and Early  
                          Childhood Education   

  PHONE: 501-268-8696     FAX: 501-268-4803     E-MAIL:
                                                Kathy.Mackay@arkansas.gov

  NAME: Jamie Morrison    ORGANIZATION/TITLE:   
                          Program               
                          Administrator, Public 
                          Pre-Kindergarten, AR  
                          DHHS Division of      
                          Child Care and Early  
                          Childhood Education   

  PHONE: 501-682-9699     FAX: 501-683-0971     E-MAIL:
                                                Jamie.Morrison@arkansas.gov

  NAME: Ray Jones         ORGANIZATION/TITLE:   
                          Program Coordinator,  
                          Compliance Unit, AR   
                          DHHS Division of      
                          Child Care and Early  
                          Childhood Education   

  PHONE: 501-682-2611     FAX: 501-682-2317     E-MAIL: Ray.Jones@arkansas.gov

  NAME: Pam Greer         ORGANIZATION/TITLE:   
                          Supervisor, Fraud     
                          Unit, AR DHHS Office  
                          of Chief Counsel      

  PHONE: 501-682-8628     FAX:                  E-MAIL: Pam.Greer@arkansas.gov

  NAME: Glenda Higgs      ORGANIZATION/TITLE:   
                          Supervisor, AR DHHS   
                          Office of Finance and 
                          Administration        
                          (Policy)              

  PHONE: 501-682-6476     FAX: 501-682-6477     E-MAIL: Glenda
                                                Higgs@arkansas.gov

  NAME: Karen Patton      ORGANIZATION/TITLE:   
                          AR DHHS Office of     
                          Finance and           
                          Administration        
                          (Accounts             
                          Receivables)          

  PHONE: 501-682-6521     FAX: 501-682-1855     E-MAIL: Karen
                                                Patton@arkansas.gov

  NAME: Virginia Miller   ORGANIZATION/TITLE:   
                          AR DHHS Office of     
                          Finance and           
                          Administration        
                          (Accounts             
                          Receivables)          

  PHONE: 501-682-6514     FAX: 501-682-1855     E-MAIL:
                                                Virginia.Miller@arkansas.gov

  NAME: Bill Hogue        ORGANIZATION/TITLE:   
                          Auditor, Audit Unit,  
                          AR DHHS Office of     
                          Chief Counsel         

  PHONE: 501-682-1679     FAX: 501-682-8905     E-MAIL: Bill.Hogue
  ----------------------- --------------------- ------------------------------

[]{#__RefHeading___Toc165450419 .anchor}**Appendix E. Illinois
Assessment Team Members**

  --------------------- ------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------
  **STATE TEAM                                                                                                            
  (ILLINOIS)**                                                                                                            

  NAME: Linda           ORGANIZATION/TITLE: Bureau of Child Care and Development, Bureau Chief                            
  Saterfield                                                                                                              

  PHONE: (217) 785-2559 FAX: 217-524-6030                                                                                 E-MAIL:
                                                                                                                          [[Linda.Saterfield@illinois.gov]{.underline}](mailto:Linda.Saterfield@illinois.gov)

  NAME: Richard Martin  ORGANIZATION/TITLE: Bureau of Child Care and Development, Supervisor                              

  PHONE: 312-793-3823   FAX: 312-793-4881                                                                                 E-MAIL:
                                                                                                                          [[Richard.M.Martin@illinois.gov]{.underline}](mailto:Richard.M.Martin@illinois.gov)

  NAME: Holly Knicker   ORGANIZATION/TITLE: Bureau of Child Care and Development                                          

  PHONE: (312) 793-3610 FAX:                                                                                              E-MAIL: [[HOLLY.KNICKER@illinois.gov]{.underline}](mailto:HOLLY.KNICKER@illinois.gov)

  NAME: Debbie Bretz    ORGANIZATION/TITLE: Child Care (Day Care)                                                         

  PHONE: (217) 524-6317 FAX:                                                                                              E-MAIL: [[Debbie.Bretz@illinois.gov]{.underline}](mailto:Debbie.Bretz@illinois.gov)

  NAME: Theresa Haley   ORGANIZATION/TITLE: Bureau of Training and Development, Asst.Bureau Chief                         

  PHONE: 217-558-2685   FAX:                                                                                              E-MAIL: [[Teresa.Haley@illinois.gov]{.underline}](mailto:Teresa.Haley@illinois.gov)

  NAME: Maria Ferraro   ORGANIZATION/TITLE: DHS Office of Legislation                                                     

  PHONE: (217) 557-1560 FAX:                                                                                              E-MAIL: [[MARIA.FERRARO@illinois.gov]{.underline}](mailto:MARIA.FERRARO@illinois.gov)

  NAME: Ray Davis       ORGANIZATION/TITLE: Bureau of Child Care and Development                                          

  PHONE: (217) 524-6028 FAX:                                                                                              E-MAIL: [[Ray.Davis@illinois.gov]{.underline}](mailto:Ray.Davis@illinois.gov)

  NAME: Marsha Brown    ORGANIZATION/TITLE: Bureau of Child Care and Development                                          

  PHONE: (217) 557-5993 FAX:                                                                                              E-MAIL: [[Marsha.Brown@illinois.gov]{.underline}](mailto:Marsha.Brown@illinois.gov)

  NAME: Patty           ORGANIZATION/TITLE: [Fiscal Planning & Capital                                                    
  Pace-Halpin           Develop](http://intranet.dhs/onenet/page.aspx?module=5&type=9&item=1&organizationalunitid=284).   
                        [Budget Contact for                                                                               
                        HCD](http://intranet.dhs/onenet/page.aspx?module=5&type=5&item=1&jobtitleid=13182)                

  PHONE: (217)-785-9703 FAX:                                                                                              E-MAIL:
                                                                                                                          [[Patti.Pace-Halpin@illinois.gov]{.underline}](mailto:Patti.Pace-Halpin@illinois.gov)

  NAME: Stacy Splain    ORGANIZATION/TITLE: Bureau of Child Care and Development, PSA                                     

  PHONE: (217) 557-1325 FAX:                                                                                              E-MAIL: [[Stacey.Splain@illinois.gov]{.underline}](mailto:Stacey.Splain@illinois.gov)

  NAME: Loretta Davis   ORGANIZATION/TITLE: Bureau of Child Care and Development, Manager                                 

  PHONE: 217-524-8867   FAX: 217-524-6029                                                                                 E-MAIL: [[Loretta.Davis@illinois.gov]{.underline}](mailto:Loretta.Davis@illinois.gov)

  NAME: Gary Anderson   ORGANIZATION/TITLE: Office of Fiscal Services                                                     

  PHONE: (217) 782-7554 FAX:                                                                                              E-MAIL: [[GARY.ANDERSON@illinois.gov]{.underline}](mailto:GARY.ANDERSON@illinois.gov)
  --------------------- ------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------

[]{#__RefHeading___Toc165450420 .anchor}**Appendix F. Kansas Assessment
Team Members**

  ------------------- --------------------- -------------------------------
  **STATE TEAM                              
  (KANSAS)**                                

  NAME: Alice Womack  ORGANIZATION/TITLE:   
                      SRS/Assistant         
                      Director of Capacity  
                      & Resource            
                      Development and State 
                      Child Care            
                      Administrator         

  PHONE: 785-291-3314 FAX: 785-296-0146     EMAIL: acw@srskansas.org

  NAME: Dennis Priest ORGANIZATION/TITLE:   
                      SRS/Assistant         
                      Director for Programs 

  PHONE: 785-296-4717 FAX: 785-296-0146     EMAIL: dzp@srskansas.org

  NAME: Bobbi Mariani ORGANIZATION/TITLE:   
                      SRS/Director,         
                      Economic and          
                      Employment Support    

  PHONE: 785-296-6750 FAX: 785-296-6960     EMAIL: bma@srskansas.org

  NAME: Kathy         ORGANIZATION/TITLE:   
  Valentine           SRS/Assistant         
                      Director for Support  

  PHONE: 785-296-4047 FAX: 785-296-6960     EMAIL: mkv@srskansas.org

  NAME: Rachel Katuin ORGANIZATION/TITLE:   
                      SRS/Team Lead for     
                      Capacity and Resource 
                      Development           

  PHONE: 785-368-8127 FAX: 785-296-0146     EMAIL: rak@srskansas.org

  NAME: Martee        ORGANIZATION/TITLE:   
  Thompson            SRS/Personnel         
                      Assistant             

  PHONE: 785-         FAX: 785-296-2173     EMAIL: mar@srskansas.org
  296-4055                                  

  NAME: Dennis Rogers ORGANIZATION/TITLE:   
                      SRS/Public Service    
                      Executive Personnel   

  PHONE: 785-291-3661 FAX: 785-296-2173     EMAIL: dxxr@srskansas.org

  NAME: Bob Lutz      ORGANIZATION/TITLE:   
                      SRS/State Auditor II  

  PHONE: 785-296-2040 FAX: 785-368-6498     EMAIL: brl@srskansas.org

  NAME: Chris Johnson ORGANIZATION/TITLE:   
                      SRS/State Auditor IV  

  PHONE: 785-368-6805 FAX: 785-368-6498     EMAIL: <csxj@srskansas.org>
  ------------------- --------------------- -------------------------------

[]{#__RefHeading___Toc165450421 .anchor}**Appendix G. Kentucky
Assessment Team Members**

  ---------------------- --------------------- --------------------------------
  **STATE TEAM                                 
  (KENTUCKY)**                                 

  NAME: Betsy Farley     ORGANIZATION/TITLE:   
  (retired)              DIVISION OF CHILD     
                         CARE/DIRECTOR         

  PHONE: 502-564-2524    FAX: 502-564-3464     E-MAIL: betsy.farley@ky.gov
  ext. 3204                                    

  NAME: Paula Woodworth  ORGANIZATION/TITLE:   
                         Division of Child     
                         Care/Assistant        
                         Director              

  PHONE: 502-564-2524    FAX: 502-564-3464     E-MAIL: paula.woodworth@ky.gov
  ext. 4377                                    

  NAME: Cordelia (Dee)   ORGANIZATION/TITLE:   
  Skolen                 Division of Child     
                         Care/Internal Policy  
                         Analyst               

  PHONE: 502-564-2524    FAX: 502-564-3464     E-MAIL: cordelia.skolen@ky.gov
  ext. 4368                                    

  NAME: Mark Fincel      ORGANIZATION/TITLE:   
                         Division of General   
                         Accounting            

  PHONE: 502-564-0298 X  FAX:                  E-MAIL: mark.fincel@ky.gov
  4341                                         

  NAME: Rachel Dockal    ORGANIZATION/TITLE:   
                         Division of           
                         Administration and    
                         Financial Mgmt,       
                         Internal Policy       
                         Analyst               

  PHONE: 502-564-7463    FAX: -                E-MAIL: rachel.dockal@ky.gov
  #4127                                        

  NAME: Jason Dunn       ORGANIZATION/TITLE:   
                         Division of Policy    
                         Development, Policy   
                         and Program Support   
                         Branch                

  PHONE: 502-564-7536    FAX:                  E-MAIL: jason.dunn@ky.gov
  Ext 4243                                     

  NAME: Dorcas Peach     ORGANIZATION/TITLE:   
                         Office of Human       
                         Resource Management,  
                         Personnel DCBS Branch 

  PHONE: 502-564-7770    FAX:                  E-MAIL: dorcas.peach@ky.gov
  x4144                                        

  NAME: Kathy Frye       ORGANIZATION/TITLE:   
                         Office Technology,    
                         Div of Systems        
                         Support               

  PHONE: 502-564-0105 x  FAX:                  E-MAIL: kathy.frye@ky.gov
  10362                                        

  NAME: Shari Gibson     ORGANIZATION/TITLE:   
                         Office of Information 
                         Technology, Cssmb     

  PHONE: 502-564-0105    FAX:                  E-MAIL: shari.gibson@ky.gov
  Ext. 10674                                   

  NAME: Lula Ray         ORGANIZATION/TITLE:   
                         Office of Information 
                         Technology, Fsadb-b   

  PHONE: 502-564-0105    FAX:                  E-MAIL: lula.ray@ky.gov
  Ext 10638                                    

  NAME: Donna Shouse     ORGANIZATION/TITLE:   
                         Office of Information 
                         Technology            

  PHONE: 502-564-0105    FAX:                  E-MAIL: donnac.shouse@ky.gov
  Ext 10650                                    

  NAME: Linda Sagraves   ORGANIZATION/TITLE:   
                         APA                   

  PHONE: 502-573-0050    FAX:                  E-MAIL:
                                               lLinda.sagraves@auditor.ky.gov
  ---------------------- --------------------- --------------------------------

[]{#__RefHeading___Toc165450422 .anchor}**Appendix H. Maine** Assessment
Team Members

  ----------------- ---------------------- ------------------------------
  **STATE TEAM                             
  (MAINE)**                                

  NAME: James       ORGANIZATION/TITLE:    
  Beougher                                 

  PHONE:            FAX: 207-287-5282      E-MAIL:
  207-287-5063                             james.beougher@maine.gov

  NAME: Carolyn     ORGANIZATION/TITLE:    
  Drugge            Director               

  PHONE:            FAX: 207-287-5031      E-MAIL:
  207-287-5014                             Carolyn.drugge@maine.gov

  NAME: Jenny       ORGANIZATION/TITLE:    
  Boyden            Director of Internal   
                    Audit                  

  PHONE:            FAX: 207-287-3005      E-MAIL: jenny.boyden@maine.gov
  207-287-4568                             

  NAME: Don         ORGANIZATION/TITLE:    
  Williams          Director of Human      
                    Resources              

  PHONE:            FAX: 207-287-4268      E-MAIL:
  207-287-4275                             Donald.f.williams@maine.gov

  NAME: Steve Smith ORGANIZATION/TITLE:    
                    Personnel Officer      

  PHONE:            FAX: 207-287-8299      E-MAIL:
  207-287-1877                             Stephen.smith@maine.gov

  NAME: Liz Hanley  ORGANIZATION/TITLE:    
                    Director of DHHS       
                    Service Center         

  PHONE:            FAX: 207-287-1862      E-MAIL:
  207-287-1861                             Elizabeth.hanley@maine.gov

  NAME: Chip        ORGANIZATION/TITLE:    
  Woodman           Deputy Director of     
                    DHHS Service Center    

  PHONE:            FAX: 207-287-1862      E-MAIL:
  207-287-2572                             charles.woodman@maine.gov

  NAME: Herb Downs  ORGANIZATION/TITLE:    
                    Director of Audit      

  PHONE:            FAX: 207-287-2601      E-MAIL: herb.f.downs@maine.gov
  207-287-2778                             

  NAME: Bob         ORGANIZATION/TITLE:    
  Blanchard         Program & Fiscal       
                    Coordinator            

  PHONE:            FAX: 207-287-5282      E-MAIL:
  207-287-5060                             Robert.blanchard@maine.gov

  NAME: Brian Snow  ORGANIZATION/TITLE:    
                    Group Manager          

  PHONE:            FAX: 207-287-1131      E-MAIL: brian.snow@maine.gov
  207-287-1747                             

  NAME: Ted Clark   ORGANIZATION/TITLE:    
                    Team Leader            

  PHONE:            FAX: 207-287-3665      E-MAIL: ted.l.clark@maine.gov
  207-287-2067                             
  ----------------- ---------------------- ------------------------------

**Appendix I.** []{#__RefHeading___Toc165450424 .anchor}**Montana
Assessment Team Members**

  ---------------------- --------------------- ------------------------------
  **STATE (MONTANA)**                          

  NAME: Allyson Eastman  ORGANIZATION/TITLE:   
                         Supervisor, District  
                         7 HRDC                

  PHONE: (406) 444-3657  FAX:                  E-MAIL: aeastman@hrdc7.org

  NAME: Anne Carpenter   ORGANIZATION/TITLE:   
                         Program Specialist    

  PHONE: (406) 444-3657  FAX:                  E-MAIL: Anncarpenter@mt.gov

  NAME: Annette          ORGANIZATION/TITLE:   
  McReynolds             CCUBS Project Lead,   
                         Northrop Grumman      

  PHONE: (406) 443-8600  FAX:                  E-MAIL:
                                               Annette.mcreynolds@ngc.com

  NAME: Becky            ORGANIZATION/TITLE:   
  Fleming-Siebenaler     Child Care Licensing  
                         Supervisor            

  PHONE: (406) 444-7770  FAX:                  E-MAIL: bfleming@mt.gov

  NAME: Carol Bondy      ORGANIZATION/TITLE:   
                         Chief, Audit Section  

  PHONE: (406) 444-5908  FAX:                  E-MAIL: cbondy@mt.gov

  NAME: Chris Hettinger  ORGANIZATION/TITLE:   
                         ECSB Fiscal Officer   

  PHONE: (406) 444-2803  FAX:                  E-MAIL: chettinger@mt.gov

  NAME: Dan Forbes       ORGANIZATION/TITLE:   
                         Chief, Information    
                         Systems Bureau        

  PHONE: (406) 444-1794  FAX:                  E-MAIL: dforbes@mt.gov

  NAME: DeeAnn Hartman   ORGANIZATION/TITLE:   
                         Director, District 7  
                         HRDC Child Care       
                         Resource and Referral 
                         Office                

  PHONE: (406) 247-4737  FAX:                  E-MAIL: dhartman@hrdc7.org

  NAME: Hank Hudson      ORGANIZATION/TITLE:   
                         Administrator, Human  
                         and Community         
                         Services Division     

  PHONE: (406) 444-5901  FAX:                  E-MAIL: hhudson@mt.gov

  NAME: Jamie Palagi     ORGANIZATION/TITLE:   
                         Chief, ECSB           

  PHONE: (406) 444-1828  FAX:                  E-MAIL: jpalagi@mt.gov

  NAME: Kelly Rosenleaf  ORGANIZATION/TITLE:   
                         Director, Child Care  
                         Resources             

  PHONE: (406) 728-6446  FAX:                  E-MAIL: Kelly@child
                                               careresources.org

  NAME: Marie Matthews   ORGANIZATION/TITLE:   
                         Fiscal Policy         
                         Advisor, Fiscal       
                         Services Division     

  PHONE: (406) 444-5369  FAX:                  E-MAIL: mmatthews@mt.gov

  NAME: Marilyn          ORGANIZATION/TITLE:   
  Daumiller              Fiscal Analyst,       
                         Legislative Fiscal    
                         Division              

  PHONE: (406) 444-5386  FAX:                  E-MAIL: mdaumiller@mt.gov

  NAME: Melody Olson     ORGANIZATION/TITLE:   
                         CCUBS Program         
                         Specialist -- ECSB    

  PHONE: (406) 444-1839  FAX:                  E-MAIL: molson@mt.gov

  NAME: Michelle Parks   ORGANIZATION/TITLE:   
                         Supervisor, Child     
                         Care Resources        

  PHONE: (406) 728-6446  FAX:                  E-MAIL: michelle@child
                                               careresources.org

  NAME: Patsy Mills      ORGANIZATION/TITLE:   
                         Chief, External       
                         Systems Bureau        

  PHONE: Retired         FAX:                  E-MAIL: pmills@mt.gov

  NAME: Patti Russ (no   ORGANIZATION/TITLE:   
  longer with the        Supervisor, ECSB      
  agency)                Child Care Unit       

  PHONE: (406) 444-0309  FAX:                  E-MAIL: pruss@mt.gov

  NAME: Randy Haight     ORGANIZATION/TITLE:   
                         CCUBS Program         
                         Specialist            

  PHONE: (406) 444-1268  FAX:                  E-MAIL: rhaight@mt.gov

  NAME: Robert Tallerico ORGANIZATION/TITLE:   
                         Chief, HCSD Fiscal    
                         Bureau                

  PHONE: (406) 444-4559  FAX:                  E-MAIL: rtallerico@mt.gov

  NAME: Ron Ostrander    ORGANIZATION/TITLE:   
                         Human Resources       
                         Manager, DPHHS        
                         Personnel and Human   
                         Resources             

  PHONE: (406) 444-5936  FAX:                  E-MAIL: rostrander@mt.gov

  NAME: Roy Kemp         ORGANIZATION/TITLE:   
                         Chief, Licensure      
                         Bureau                

  PHONE: (406) 444-2868  FAX:                  E-MAIL: Rkemp@mt.gov

  NAME: Sheilah Mevis    ORGANIZATION/TITLE:   
                         Director, Child Care  
                         Partnerships          

  PHONE: (406) 443-4608  FAX:                  E-MAIL: skmevis@child
                                               carepartnerships.org

  NAME: Steve Kranich    ORGANIZATION/TITLE:   
                         Section Supervisor,   
                         Program Integrity     
                         Section               

  PHONE: (406) 444-9356  FAX:                  E-MAIL: skranich@mt.gov

  NAME: Tess Keck        ORGANIZATION/TITLE:   
                         Supervisor, District  
                         7 HRDC                

  PHONE: No longer in    FAX:                  E-MAIL: tkeck@hrdc7.org
  the position                                 

  NAME: Tina Columbus    ORGANIZATION/TITLE:   
                         Program Specialist,   
                         ECSB                  

  PHONE: No longer with  FAX:                  E-MAIL: tcolumbus@mt.gov
  agency                                       
  ---------------------- --------------------- ------------------------------

[]{#__RefHeading___Toc165450425 .anchor}**Appendix J. Nevada Assessment
Team Members**

  ------------------ ------------------------ ----------------------------
  **STATE TEAM                                
  (NEVADA)**                                  

  NAME: Nancy Ford   ORGANIZATION/TITLE:      
                     DWSS, Administrator      

  PHONE:             FAX: 775-684-0614        E-MAIL: nkford@dwss.nv.gov
  775-684-0504                                

  NAME: Gary         ORGANIZATION/TITLE:      
  Stagliano          DWSS, Deputy             
                     Administrator            
                     Program/Field Operations 

  PHONE:             FAX: 775-684-0711        E-MAIL:
  775-684-0570                                gstagliano@dwss.nv.gov

  NAME: Vacant       ORGANIZATION/TITLE:      
                     DWSS, Deputy             
                     Administrator,           
                     Information Systems      

  PHONE:             FAX: 775-684-0712        E-MAIL:
  775-684-0530                                

  NAME: Roger        ORGANIZATION/TITLE:      
  Mowbray            DWSS, Deputy             
                     Administrator,           
                     Administrative Services  

  PHONE:             FAX: 775-684-0627        E-MAIL: rmowbray@dwss.nv.gov
  775-684-0657                                

  NAME: Gerald Allen ORGANIZATION/TITLE:      
                     DWSS, Child Care Program 
                     Chief                    

  PHONE:             FAX: 775-684-0711        E-MAIL: gallen@dwss.nv.gov
  775-684-0630                                

  NAME: Sue Smith    ORGANIZATION/TITLE:      
                     DWSS, Budget Chief       

  PHONE:             FAX: 775-684-0656        E-MAIL: ssmith@dwss.nv.gov
  775-684-0647                                

  NAME: Vacant       ORGANIZATION/TITLE:      
                     DWSS, Accounting Chief   

  PHONE:             FAX: 775-684-0627        E-MAIL:
  775-684-0660                                

  NAME: Kathi        ORGANIZATION/TITLE:      
  Sinclair           DWSS, Personnel Chief    

  PHONE:             FAX: 775-684-00646       E-MAIL:
  775-684-0641                                ksinclair@dwss.nv.gov

  NAME: Laura King   ORGANIZATION/TITLE:      
                     DWSS, PRE Chief          

  PHONE:             FAX: 775-684-0607        E-MAIL: lking@dwss.nv.gov
  775-684-0597                                

  NAME: Bart London  ORGANIZATION/TITLE:      
                     DWSS, Operation Center   
                     Manager                  

  PHONE:             FAX: 775-684-0712        E-MAIL: blondon@dwss.nv.gov
  775-684-0591                                

  NAME: Barb Darsow  ORGANIZATION/TITLE:      
                     DWSS, Child Care Program 
                     Specialist               

  PHONE:             FAX: 775-684-0711        E-MAIL: bdarsow@dwss.nv.gov
  775-684-0699                                

  NAME: Robin        ORGANIZATION/TITLE:      
  Ynacay-Nye         DWSS, Program/Field      
                     Operations Program       
                     Specialist               

  PHONE:             FAX: 775-684-0711        E-MAIL:
  775-684-0663                                rynacaynye@dwss.nv.gov
  ------------------ ------------------------ ----------------------------

[]{#__RefHeading___Toc165450426 .anchor}**Appendix K**. Puerto Rico
Assessment Team Members

  -------------------- --------------------- ------------------------------
  **STATE TEAM (PUERTO                       
  RICO)**                                    

  NAME: Yvette Del     ORGANIZATION/TITLE:   
  Valle Soto           Administrator         

  PHONE: 787 -         FAX: 787 -- 977- 7820 E-MAIL:
  721-1331                                   ydelvalle@acuden.gobiern.pr

  NAME: Maria Garriga  ORGANIZATION/TITLE:   
  Torres               Auxiliary             
                       Administrator of      
                       Programs              

  PHONE: 787 -- 721    FAX: 787 - 721-6399   E-MAIL:
  -1495                                      mgarriga@acuden.gobierno.pr

  NAME: Luis A. Ortiz  ORGANIZATION/TITLE:   
                       Auxiliary             
                       Administrator of      
                       Planning              

  PHONE: 787 -         FAX: 787 -- 977- 7820 E-MAIL:
  721-1331                                   lortiz@acuden.gobierno.pr

  NAME: Yolanda Muriel ORGANIZATION/TITLE:   
                       Auxiliary             
                       Administrator of      
                       Administration        

  PHONE: 787 -- 721    FAX: 787 -- 721-0188  E-MAIL:
  -8085                                      ymuriel@acuden.gobierno.pr

  NAME: Elisa Figueroa ORGANIZATION/TITLE:   

  PHONE: 787 721-1331  FAX: 787 -- 977- 7820 E-MAIL:
                                             efigueroa@acuden.gobierno.pr

  NAME: Hector Cruz    ORGANIZATION/TITLE:   
                       Executive Assistant   

  PHONE: 787 721 -1331 FAX: 787 -- 977- 7820 E-MAIL:
                                             hcruz@acuden.gobierno.pr

  NAME: Carmen Morales ORGANIZATION/TITLE:   
                       Consultant            

  PHONE: 787 721-1495  FAX: 787 721 -6366    E-MAIL:

  NAME: Sandra         ORGANIZATION/TITLE:   
  Velázquez            Director of Fiscal    
                       Monitoring Office     

  PHONE: 787 723 -5097 FAX: 787 -- 723 -     E-MAIL:
                       5098                  svelazquez@acuden.gobierno

  NAME: Julio González ORGANIZATION/TITLE:   
                       Director of Legal     
                       Office                

  PHONE: 787 721 --    FAX: 977 - 7820       E-MAIL: jgonzalez
  1331                                       \@acuden.gobierno.pr
  -------------------- --------------------- ------------------------------

[]{#__RefHeading___Toc165450427 .anchor}**Appendix L**. Washington
Assessment Team Members

  ---------------- --------------------- ---------------------------------
  **WASHINGTON                           
  STATE TEAM**                           

  NAME: Carla Gira ORGANIZATION/TITLE:   
                   Department of Early   
                   Learning / CC Subsidy 
                   Policy Administrator  

  PHONE:           FAX: 360-413-3482     E-MAIL: Carla.gira@del.wa.gov
  360-725-4682                           

  NAME: Nancy      ORGANIZATION/TITLE:   
  Vernon           Department of Early   
                   Learning / Program    
                   Initiatives Lead      

  PHONE:           FAX: 360-413-3482     E-MAIL: nancy.vernon@del.wa.gov
  360-725-4697                           

  NAME: Laurie     ORGANIZATION/TITLE:   
  Milligan         Department of Early   
                   Learning / Human      
                   Resources Manager     

  PHONE:           FAX: 360-413-3482     E-MAIL:
  360-725-4680                           laurie.milligan@del.wa.gov

  NAME: Renee Long ORGANIZATION/TITLE:   
                   Department of Social  
                   & Health Services /   
                   Economic Services     
                   Administration /      
                   Division of           
                   Management Resources  
                   & Services / Funding  
                   Policy Coordinator    

  PHONE:           FAX: 360-407-3998     E-MAIL: longrt@dshs.wa.gov
  360-725-4516                           

  NAME: Carolyn    ORGANIZATION/TITLE:   
  Horlor           Department of Social  
                   & Health Services /   
                   Economic Services     
                   Administration /      
                   Division of           
                   Management Resources  
                   & Services / Quality  
                   Assurance Projects    
                   Coordinator           

  PHONE:           FAX: 360-413-3493     E-MAIL: horlocb@dshs.wa.gov
  360-725-4537                           

  NAME: Paul Mena  ORGANIZATION/TITLE:   
                   Department of Social  
                   & Health Services /   
                   Administrative        
                   Services Division /   
                   Social Services       
                   Payment System,       
                   Program Manager       

  PHONE:           FAX: 360-664-6182     E-MAIL: menapc@dshs.wa.gov
  360-664-6014                           

  NAME: Tuan Tran  ORGANIZATION/TITLE:   
                   Department of Social  
                   & Health Services /   
                   Economic Services     
                   Administration /      
                   Information           
                   Technology Division / 
                   Information           
                   Technology Specialist 

  PHONE:           FAX: 360-407-0839     E-MAIL: tranta@dshs.wa.gov
  360-725-4563                           

  NAME: Luisa      ORGANIZATION/TITLE:   
  McEachern        Department of Social  
                   & Health Services /   
                   Economic Services     
                   Administration /      
                   Community Services    
                   Division / Special    
                   Projects Manager      

  PHONE:           FAX: 360-413-3491     E-MAIL: mceacml@dshs.wa.gov
  360-725-4891                           

  NAME: Carol      ORGANIZATION/TITLE:   
  Felton           Department of Social  
                   & Health Services /   
                   Children's            
                   Administration /      
                   Special Assistant     

  PHONE:           FAX: 360-902-7848     E-MAIL: FECA300@dshs.wa.gov
  360-902-7821                           

  NAME: Roger Long ORGANIZATION/TITLE:   
                   Department of Early   
                   Learning / Special    
                   Assistant for         
                   Provider Relations &  
                   Licensing Operations  

  PHONE:           FAX: 360-413-3482     E-MAIL:roger.long@del.wa.gov
  360-725-4900                           

  NAME: Joel       ORGANIZATION/TITLE:   
  Roalkvam         Department of Early   
                   Learning / CC         
                   Licensing             
                   Administrator         

  PHONE:           FAX: 360-413-3482     E-MAIL: joel.roalkvam@del.wa.gov
  360-725-4568                           

  NAME: Tammy Wood ORGANIZATION/TITLE:   
                   Department of Early   
                   Learning / Human      
                   Resources Specialist  

  PHONE:           FAX: 360-413-3482     E-MAIL: tammy.wood@del.wa.gov
  360-725-4650                           
  ---------------- --------------------- ---------------------------------

[]{#__RefHeading___Toc165450428 .anchor}**Appendix M. STATE INTERNAL
CONTROL SELF-ASSESSMENT INSTRUMENT**

**(Modified)**

**STATE INTERNAL CONTROL SELF-ASSESSMENT INSTRUMENT**

**STATE**

**DATE**

**STATE INTERNAL CONTROL SELF-ASSESSMENT INSTRUMENT**

  ------------------------ ---------------------- ------------------------
  **STATE TEAM (Insert                            
  State Name)**                                   

  (List all members of the                        
  State Team, their                               
  organization, title,                            
  Phone, Fax, and E-mail                          
  addresses)                                      

  NAME:                    ORGANIZATION/TITLE:    

  PHONE:                   FAX:                   E-MAIL:

  NAME:                    ORGANIZATION/TITLE:    

  PHONE:                   FAX:                   E-MAIL:

  NAME:                    ORGANIZATION/TITLE:    

  PHONE:                   FAX:                   E-MAIL:

  NAME:                    ORGANIZATION/TITLE:    

  PHONE:                   FAX:                   E-MAIL:

  NAME:                    ORGANIZATION/TITLE:    

  PHONE:                   FAX:                   E-MAIL:

  NAME:                    ORGANIZATION/TITLE:    

  PHONE:                   FAX:                   E-MAIL:

  NAME:                    ORGANIZATION/TITLE:    

  PHONE:                   FAX:                   E-MAIL:

  NAME:                    ORGANIZATION/TITLE:    

  PHONE:                   FAX:                   E-MAIL:

  NAME:                    ORGANIZATION/TITLE:    

  PHONE:                   FAX:                   E-MAIL:
  ------------------------ ---------------------- ------------------------

Add additional pages to capture all staff involved in the assessment
process.

+-----------------------------------------------------------------------+
| **STATE INTERNAL CONTROL SELF-ASSESSMENT INSTRUMENT**                 |
+-----------------------------------------------------------------------+
| **GENERAL INSTRUCTIONS**                                              |
+-----------------------------------------------------------------------+
| This tool is a State Internal Control Self-Assessment Instrument for  |
| use in a State's child care program. This tool can be used to help    |
| both State and Federal managers determine how well an agency's        |
| internal controls are designed and functioning and help them to       |
| determine what, where, and how improvements can be made. States can   |
| use this tool specifically for the child care program and contactors, |
| or they can administer it more broadly to address multiple program    |
| components.                                                           |
|                                                                       |
| The tool contains five sections corresponding to the five standards   |
| for internal control outlined by the General Accountability Office    |
| (GAO) in its document, GAO-01-1008G -- Internal Control Management    |
| and Evaluation Tool (8/01). The third standard, Control Activities,   |
| is further broken down into three additional sections, one dealing    |
| with Common Activities and two dealing with Information Systems. The  |
| standards are:                                                        |
|                                                                       |
| -   Control Environment;                                              |
|                                                                       |
| -   Risk Assessment;                                                  |
|                                                                       |
| -   Control Activities:                                               |
|                                                                       |
|     -   Common Categories of Control Activities;                      |
|                                                                       |
|     -   Control Activities Specific for Information Systems---General |
|         Control;                                                      |
|                                                                       |
|     -   Control Activities Specific for Information                   |
|         Systems---Application Control;                                |
|                                                                       |
| -   Information and Communications; and                               |
|                                                                       |
| -   Monitoring.                                                       |
|                                                                       |
| Each section contains a list of major elements and criteria for       |
| consideration when reviewing internal controls as they relate to      |
| particular standards. These elements represent some of the more       |
| important issues addressed by the standard. Included with each        |
| element are criteria for States to consider when addressing the       |
| elements. The criteria provided are examples and are not              |
| all-inclusive. States should use these criteria when considering the  |
| degree to which the internal controls are functioning.                |
|                                                                       |
| States need to evaluate how well the child care program meets each    |
| element and criterion and identify those areas where they may be      |
| deficient. The States should then take the opportunity to begin       |
| formulating a plan of action to address the identified deficiencies.  |
|                                                                       |
| States should consider using hyperlinks to the appropriate State's    |
| Internet or Intranet site for documentation. This Instrument can then |
| become a source document for internal controls for the child care     |
| Lead Agency. States should view this tool as a living document, a     |
| starting point that can fit the circumstances, conditions, and risks  |
| relevant to their agency. Not all of the elements or criteria will be |
| applicable for every agency. States should attempt to complete all of |
| the sections, but should feel free to note those areas that they do   |
| not consider relevant. States that choose to use the tool to assess   |
| the whole agency need to have staff of program areas that apply to    |
| the whole agency complete the pertinent sections to reflect the whole |
| agency. Child care program staff will complete the sections specific  |
| to child care. (These elements and criteria are in italics in the     |
| instrument.) Agency staff may then revise the child care specific     |
| sections to be relevant to other agency programs, such as Food Stamps |
| and Child Welfare, and then assign staff of those programs to respond |
| to the program specific elements. Even when the elements are specific |
| to the child care program, there may overall elements that also refer |
| to the agency as a whole. The overall agency elements should also be  |
| included during the review process.                                   |
|                                                                       |
| The goal is for this tool to be useful in assessing internal controls |
| as they relate to the achievement of the objectives of the agency,    |
| identifying areas of concern, and providing a documented way of       |
| addressing those concerns. Ultimately, this tool can help States      |
| become more effective and efficient in the development and use of     |
| their internal controls. This tool may also be useful in identifying  |
| issues with respect to safeguarding assets from improper payments     |
| caused by mistakes, inadequate controls, fraud, waste, or abuse.      |
+-----------------------------------------------------------------------+

+-----------------------------------------------------------------------+
| **STATE INTERNAL CONTROL SELF-ASSESSMENT INSTRUMENT**                 |
+-----------------------------------------------------------------------+
| **I. CONTROL ENVIRONMENT**                                            |
+-----------------------------------------------------------------------+
| The Control Environment is the first Internal Control Standard. This  |
| standard addresses how the States establish and maintains an          |
| environment throughout the organization that sets a positive and      |
| supportive attitude toward internal control and conscientious         |
| management. State's managers and evaluators will review and address   |
| each of the elements that affect the accomplishment of this goal to   |
| determine if there is a positive control environment.                 |
|                                                                       |
| The elements and criteria contained in this Instrument are a          |
| beginning point and not as an all-inclusive set of elements and       |
| criteria. Some of the elements and criteria are subjective in nature  |
| and require States to use judgment when assessing them. It is         |
| important to examine each of the elements and criteria, as each is    |
| important and can help in achieving control environment               |
| effectiveness. Many of the elements within this standard apply to not |
| only the child care program but to the agency as a whole. The         |
| appropriate documentation will often be global in nature.             |
+-----------------------------------------------------------------------+
| **Integrity and Ethical Values**                                      |
+-----------------------------------------------------------------------+

+----------+---+---------------------+-----------------+---+-----------------+
| **El     |   | **Criteria**        | **              |   | **F             |
| ements** |   |                     | Documentation** |   | indings/Results |
|          |   |                     |                 |   | & Suggested     |
|          |   |                     | **(Provide all  |   | Follow-up if    |
|          |   |                     | applicable      |   | Necessary**     |
|          |   |                     | d               |   |                 |
|          |   |                     | ocumentation)** |   |                 |
+==========+===+=====================+=================+===+=================+
| 1\. The  |   | Codes of conduct    |                 |   |                 |
| agency   |   | are comprehensive   |                 |   |                 |
| has a    |   | in nature and       |                 |   |                 |
| formal   |   | include such issues |                 |   |                 |
| code or  |   | as appropriate use  |                 |   |                 |
| codes of |   | of resources,       |                 |   |                 |
| conduct  |   | conflicts of        |                 |   |                 |
| in place |   | interest, political |                 |   |                 |
| that     |   | activities of       |                 |   |                 |
| est      |   | staff, acceptance   |                 |   |                 |
| ablishes |   | of gifts or         |                 |   |                 |
| an       |   | donations or        |                 |   |                 |
| ethical  |   | foreign             |                 |   |                 |
| culture  |   | decorations, and    |                 |   |                 |
| th       |   | use of due          |                 |   |                 |
| roughout |   | professional care.  |                 |   |                 |
| the      |   |                     |                 |   |                 |
| organ    |   | The agency          |                 |   |                 |
| ization. |   | periodically        |                 |   |                 |
| These    |   | reviews codes of    |                 |   |                 |
| policies |   | conduct, obtains    |                 |   |                 |
| e        |   | signatures from all |                 |   |                 |
| stablish |   | staff members, and  |                 |   |                 |
| the high |   | takes quick and     |                 |   |                 |
| ethical  |   | appropriate action  |                 |   |                 |
| s        |   | as soon as there    |                 |   |                 |
| tandards |   | are any signs that  |                 |   |                 |
| to which |   | a problem may       |                 |   |                 |
| all      |   | exist.              |                 |   |                 |
| e        |   |                     |                 |   |                 |
| mployees |   | Staff members       |                 |   |                 |
| must     |   | indicate that they  |                 |   |                 |
| adhere   |   | know what kind of   |                 |   |                 |
| and      |   | behavior is         |                 |   |                 |
| guide    |   | acceptable and      |                 |   |                 |
| the      |   | unacceptable, what  |                 |   |                 |
| actions  |   | penalties           |                 |   |                 |
| of staff |   | unacceptable        |                 |   |                 |
| as they  |   | behavior may bring, |                 |   |                 |
| interact |   | and what to do if   |                 |   |                 |
| within   |   | they become aware   |                 |   |                 |
| and      |   | of unacceptable     |                 |   |                 |
| outside  |   | behavior.           |                 |   |                 |
| the      |   |                     |                 |   |                 |
| agency.  |   | Management          |                 |   |                 |
|          |   | emphasizes the      |                 |   |                 |
|          |   | importance of       |                 |   |                 |
|          |   | integrity and       |                 |   |                 |
|          |   | ethical values      |                 |   |                 |
|          |   | through oral        |                 |   |                 |
|          |   | communications in   |                 |   |                 |
|          |   | meetings, via       |                 |   |                 |
|          |   | one-on-one          |                 |   |                 |
|          |   | discussions, and by |                 |   |                 |
|          |   | example in daily    |                 |   |                 |
|          |   | activities.         |                 |   |                 |
|          |   |                     |                 |   |                 |
|          |   | Management          |                 |   |                 |
|          |   | cooperates with     |                 |   |                 |
|          |   | auditors and other  |                 |   |                 |
|          |   | evaluators,         |                 |   |                 |
|          |   | discloses known     |                 |   |                 |
|          |   | problems to them,   |                 |   |                 |
|          |   | and values their    |                 |   |                 |
|          |   | comments and        |                 |   |                 |
|          |   | recommendations.    |                 |   |                 |
+----------+---+---------------------+-----------------+---+-----------------+
| 2\.      |   | Management takes    |                 |   |                 |
| Ma       |   | action when there   |                 |   |                 |
| nagement |   | are intentional     |                 |   |                 |
| est      |   | violations of       |                 |   |                 |
| ablishes |   | policies,           |                 |   |                 |
| internal |   | procedures, or the  |                 |   |                 |
| controls |   | code(s) of conduct. |                 |   |                 |
| and      |   |                     |                 |   |                 |
| interv   |   | Management          |                 |   |                 |
| entions, |   | communicates the    |                 |   |                 |
| and      |   | types of            |                 |   |                 |
| takes    |   | disciplinary        |                 |   |                 |
| app      |   | actions taken       |                 |   |                 |
| ropriate |   | throughout the      |                 |   |                 |
| disc     |   | agency and provides |                 |   |                 |
| iplinary |   | guidance for        |                 |   |                 |
| action   |   | intervene.          |                 |   |                 |
| in       |   |                     |                 |   |                 |
| response |   | Management fully    |                 |   |                 |
| to       |   | documents the       |                 |   |                 |
| vi       |   | reasons for any     |                 |   |                 |
| olations |   | intervention or     |                 |   |                 |
| of the   |   | overriding of       |                 |   |                 |
| code of  |   | internal control    |                 |   |                 |
| conduct. |   | and specific        |                 |   |                 |
|          |   | actions taken and   |                 |   |                 |
|          |   | prohibits           |                 |   |                 |
|          |   | overriding of       |                 |   |                 |
|          |   | internal control by |                 |   |                 |
|          |   | low-level           |                 |   |                 |
|          |   | management staff    |                 |   |                 |
|          |   | except in           |                 |   |                 |
|          |   | emergencies.        |                 |   |                 |
|          |   | Notification and    |                 |   |                 |
|          |   | documentation to    |                 |   |                 |
|          |   | upper-level         |                 |   |                 |
|          |   | management occurs   |                 |   |                 |
|          |   | immediately.        |                 |   |                 |
+----------+---+---------------------+-----------------+---+-----------------+
| **Co     |   |                     |                 |   |                 |
| mmitment |   |                     |                 |   |                 |
| to       |   |                     |                 |   |                 |
| Comp     |   |                     |                 |   |                 |
| etence** |   |                     |                 |   |                 |
+----------+---+---------------------+-----------------+---+-----------------+
| 1\.      |   | Management analyzes |                 |   |                 |
| Ma       |   | the tasks and       |                 |   |                 |
| nagement |   | competencies needed |                 |   |                 |
| has      |   | for particular      |                 |   |                 |
| id       |   | jobs; establishes   |                 |   |                 |
| entified |   | formal job          |                 |   |                 |
| and      |   | descriptions that   |                 |   |                 |
| defined  |   | identify the        |                 |   |                 |
| the      |   | necessary           |                 |   |                 |
| tasks    |   | knowledge, skills,  |                 |   |                 |
| required |   | and abilities       |                 |   |                 |
| to       |   | needed for various  |                 |   |                 |
| ac       |   | jobs; and makes     |                 |   |                 |
| complish |   | them known to       |                 |   |                 |
| pa       |   | staff.              |                 |   |                 |
| rticular |   |                     |                 |   |                 |
| jobs and |   | Evidence exists     |                 |   |                 |
| provides |   | that the agency     |                 |   |                 |
| training |   | makes every effort  |                 |   |                 |
| and      |   | to assure that      |                 |   |                 |
| co       |   | staff selected for  |                 |   |                 |
| unseling |   | various positions   |                 |   |                 |
| to help  |   | have the requisite  |                 |   |                 |
| staff    |   | knowledge, skills,  |                 |   |                 |
| maintain |   | and abilities.      |                 |   |                 |
| and      |   |                     |                 |   |                 |
| improve  |   | The agency provides |                 |   |                 |
| job      |   | appropriate         |                 |   |                 |
| com      |   | training program to |                 |   |                 |
| petency. |   | meet the needs of   |                 |   |                 |
|          |   | staff, emphasizes   |                 |   |                 |
|          |   | the need for        |                 |   |                 |
|          |   | continuing          |                 |   |                 |
|          |   | training, and has a |                 |   |                 |
|          |   | control mechanism   |                 |   |                 |
|          |   | to ensure that      |                 |   |                 |
|          |   | staff received      |                 |   |                 |
|          |   | appropriate         |                 |   |                 |
|          |   | training.           |                 |   |                 |
|          |   |                     |                 |   |                 |
|          |   | Supervisors have    |                 |   |                 |
|          |   | the necessary       |                 |   |                 |
|          |   | training and        |                 |   |                 |
|          |   | management skills   |                 |   |                 |
|          |   | to provide          |                 |   |                 |
|          |   | effective job       |                 |   |                 |
|          |   | performance         |                 |   |                 |
|          |   | counseling, and     |                 |   |                 |
|          |   | provide staff       |                 |   |                 |
|          |   | candid and          |                 |   |                 |
|          |   | constructive job    |                 |   |                 |
|          |   | performance         |                 |   |                 |
|          |   | counseling.         |                 |   |                 |
|          |   |                     |                 |   |                 |
|          |   | Management bases    |                 |   |                 |
|          |   | performance         |                 |   |                 |
|          |   | appraisals on an    |                 |   |                 |
|          |   | assessment of       |                 |   |                 |
|          |   | competencies and    |                 |   |                 |
|          |   | clearly identifies  |                 |   |                 |
|          |   | areas in which      |                 |   |                 |
|          |   | staff are           |                 |   |                 |
|          |   | performing well and |                 |   |                 |
|          |   | areas that need     |                 |   |                 |
|          |   | improvement.        |                 |   |                 |
+----------+---+---------------------+-----------------+---+-----------------+
| **Ma     |   |                     |                 |   |                 |
| nagement |   |                     |                 |   |                 |
| Ph       |   |                     |                 |   |                 |
| ilosophy |   |                     |                 |   |                 |
| and      |   |                     |                 |   |                 |
| O        |   |                     |                 |   |                 |
| perating |   |                     |                 |   |                 |
| Style**  |   |                     |                 |   |                 |
+----------+---+---------------------+-----------------+---+-----------------+
| 1\.      |   | Management conducts |                 |   |                 |
| Ma       |   | risk assessments    |                 |   |                 |
| nagement |   | for new ventures.   |                 |   |                 |
| analyzes |   |                     |                 |   |                 |
| the      |   | Management pursues  |                 |   |                 |
| risks of |   | strategies to       |                 |   |                 |
| new      |   | minimize risk for   |                 |   |                 |
| ventures |   | major new ventures  |                 |   |                 |
| or       |   | and operations.     |                 |   |                 |
| op       |   |                     |                 |   |                 |
| erations |   |                     |                 |   |                 |
| and      |   |                     |                 |   |                 |
| de       |   |                     |                 |   |                 |
| termines |   |                     |                 |   |                 |
| app      |   |                     |                 |   |                 |
| ropriate |   |                     |                 |   |                 |
| mi       |   |                     |                 |   |                 |
| tigation |   |                     |                 |   |                 |
| and      |   |                     |                 |   |                 |
| mini     |   |                     |                 |   |                 |
| mization |   |                     |                 |   |                 |
| str      |   |                     |                 |   |                 |
| ategies. |   |                     |                 |   |                 |
+----------+---+---------------------+-----------------+---+-----------------+
| 2\.      |   | Management analyzes |                 |   |                 |
| Ma       |   | patterns of staff   |                 |   |                 |
| nagement |   | turnover, including |                 |   |                 |
| analyzes |   | loss of key staff   |                 |   |                 |
| agency   |   | or excessive        |                 |   |                 |
| staffing |   | turnover.           |                 |   |                 |
| and      |   | Management develops |                 |   |                 |
| endorses |   | transitions plans.  |                 |   |                 |
| the use  |   |                     |                 |   |                 |
| of       |   |                     |                 |   |                 |
| p        |   |                     |                 |   |                 |
| erforman |   |                     |                 |   |                 |
| ce-based |   |                     |                 |   |                 |
| man      |   |                     |                 |   |                 |
| agement. |   |                     |                 |   |                 |
+----------+---+---------------------+-----------------+---+-----------------+
| 3\.      |   | Management monitors |                 |   |                 |
| Ma       |   | the coordination    |                 |   |                 |
| nagement |   | between operations  |                 |   |                 |
| and      |   | and program to      |                 |   |                 |
| o        |   | ensure that the     |                 |   |                 |
| perating |   | agency mission is   |                 |   |                 |
| /program |   | achieved.           |                 |   |                 |
| ma       |   |                     |                 |   |                 |
| nagement |   |                     |                 |   |                 |
| interact |   |                     |                 |   |                 |
| to carry |   |                     |                 |   |                 |
| out the  |   |                     |                 |   |                 |
| mission. |   |                     |                 |   |                 |
+----------+---+---------------------+-----------------+---+-----------------+
| **Organi |   |                     |                 |   |                 |
| zational |   |                     |                 |   |                 |
| Str      |   |                     |                 |   |                 |
| ucture** |   |                     |                 |   |                 |
+----------+---+---------------------+-----------------+---+-----------------+
| 1\.      |   | Staff members       |                 |   |                 |
| Ma       |   | understand their    |                 |   |                 |
| nagement |   | areas of            |                 |   |                 |
| defines  |   | responsibility.     |                 |   |                 |
| and      |   |                     |                 |   |                 |
| comm     |   | Staff members       |                 |   |                 |
| unicates |   | understand their    |                 |   |                 |
| key      |   | internal control    |                 |   |                 |
| areas of |   | responsibilities.   |                 |   |                 |
| a        |   |                     |                 |   |                 |
| uthority |   |                     |                 |   |                 |
| and      |   |                     |                 |   |                 |
| respons  |   |                     |                 |   |                 |
| ibility. |   |                     |                 |   |                 |
+----------+---+---------------------+-----------------+---+-----------------+
| 2\.      |   | The organization    |                 |   |                 |
| Ma       |   | structure           |                 |   |                 |
| nagement |   | facilitates the     |                 |   |                 |
| est      |   | flow of information |                 |   |                 |
| ablishes |   | throughout the      |                 |   |                 |
| clear    |   | agency.             |                 |   |                 |
| internal |   |                     |                 |   |                 |
| r        |   | Management makes    |                 |   |                 |
| eporting |   | staff aware of the  |                 |   |                 |
| relati   |   | established         |                 |   |                 |
| onships. |   | reporting           |                 |   |                 |
|          |   | relationships.      |                 |   |                 |
+----------+---+---------------------+-----------------+---+-----------------+
| 3\.      |   | Management conducts |                 |   |                 |
| Ma       |   | periodic reviews of |                 |   |                 |
| nagement |   | the organizational  |                 |   |                 |
| e        |   | structure.          |                 |   |                 |
| valuates |   |                     |                 |   |                 |
| the      |   | Management          |                 |   |                 |
| organi   |   | establishes a       |                 |   |                 |
| zational |   | process for making  |                 |   |                 |
| s        |   | organizational      |                 |   |                 |
| tructure |   | changes when        |                 |   |                 |
| and      |   | conditions warrant. |                 |   |                 |
| makes    |   |                     |                 |   |                 |
| n        |   |                     |                 |   |                 |
| ecessary |   |                     |                 |   |                 |
| changes  |   |                     |                 |   |                 |
| to       |   |                     |                 |   |                 |
| respond  |   |                     |                 |   |                 |
| to       |   |                     |                 |   |                 |
| changing |   |                     |                 |   |                 |
| con      |   |                     |                 |   |                 |
| ditions. |   |                     |                 |   |                 |
+----------+---+---------------------+-----------------+---+-----------------+
| 4\.      |   | Staff members have  |                 |   |                 |
| Ma       |   | time to carry out   |                 |   |                 |
| nagement |   | their duties and    |                 |   |                 |
| supports |   | responsibilities.   |                 |   |                 |
| app      |   |                     |                 |   |                 |
| ropriate |   | Staff members do    |                 |   |                 |
| staffing |   | not have to work    |                 |   |                 |
| levels   |   | excessive overtime  |                 |   |                 |
| to carry |   | or outside the      |                 |   |                 |
| out the  |   | ordinary workweek   |                 |   |                 |
| mission  |   | to complete         |                 |   |                 |
| of the   |   | assigned tasks.     |                 |   |                 |
| agency.  |   |                     |                 |   |                 |
|          |   | Management and      |                 |   |                 |
|          |   | supervisors are not |                 |   |                 |
|          |   | fulfilling more     |                 |   |                 |
|          |   | than one role.      |                 |   |                 |
+----------+---+---------------------+-----------------+---+-----------------+
| **As     |   |                     |                 |   |                 |
| signment |   |                     |                 |   |                 |
| of       |   |                     |                 |   |                 |
| A        |   |                     |                 |   |                 |
| uthority |   |                     |                 |   |                 |
| and      |   |                     |                 |   |                 |
| Responsi |   |                     |                 |   |                 |
| bility** |   |                     |                 |   |                 |
+----------+---+---------------------+-----------------+---+-----------------+
| 1\. The  | M |                     |                 |   |                 |
| agency   | a |                     |                 |   |                 |
| appro    | n |                     |                 |   |                 |
| priately | a |                     |                 |   |                 |
| assigns  | g |                     |                 |   |                 |
| a        | e |                     |                 |   |                 |
| uthority | m |                     |                 |   |                 |
| and      | e |                     |                 |   |                 |
| d        | n |                     |                 |   |                 |
| elegates | t |                     |                 |   |                 |
| respon   | c |                     |                 |   |                 |
| sibility | o |                     |                 |   |                 |
| to the   | m |                     |                 |   |                 |
| proper   | m |                     |                 |   |                 |
| staff.   | u |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | u |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | y |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | b |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | y |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | . |                     |                 |   |                 |
|          |   |                     |                 |   |                 |
|          | M |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | v |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | u |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | u |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | b |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | u |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | w |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | b |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | y |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | u |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | y |                     |                 |   |                 |
|          | . |                     |                 |   |                 |
|          |   |                     |                 |   |                 |
|          | M |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | v |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | u |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | u |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | . |                     |                 |   |                 |
|          |   |                     |                 |   |                 |
|          | M |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | y |                     |                 |   |                 |
|          | b |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | u |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | y |                     |                 |   |                 |
|          | b |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | w |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | w |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | v |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | j |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | b |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | . |                     |                 |   |                 |
+----------+---+---------------------+-----------------+---+-----------------+
| **Human  |   |                     |                 |   |                 |
| Resource |   |                     |                 |   |                 |
| Policies |   |                     |                 |   |                 |
| and      |   |                     |                 |   |                 |
| Pra      |   |                     |                 |   |                 |
| ctices** |   |                     |                 |   |                 |
+----------+---+---------------------+-----------------+---+-----------------+
| 1\.      | M |                     |                 |   |                 |
| Policies | a |                     |                 |   |                 |
| and      | n |                     |                 |   |                 |
| pr       | a |                     |                 |   |                 |
| ocedures | g |                     |                 |   |                 |
| are in   | e |                     |                 |   |                 |
| place    | m |                     |                 |   |                 |
| for      | e |                     |                 |   |                 |
| hiring,  | n |                     |                 |   |                 |
| or       | t |                     |                 |   |                 |
| ienting, | p |                     |                 |   |                 |
| t        | a |                     |                 |   |                 |
| raining, | r |                     |                 |   |                 |
| eva      | t |                     |                 |   |                 |
| luating, | i |                     |                 |   |                 |
| cou      | c |                     |                 |   |                 |
| nseling, | i |                     |                 |   |                 |
| pr       | p |                     |                 |   |                 |
| omoting, | a |                     |                 |   |                 |
| compe    | t |                     |                 |   |                 |
| nsating, | e |                     |                 |   |                 |
| disci    | s |                     |                 |   |                 |
| plining, | i |                     |                 |   |                 |
| and      | n |                     |                 |   |                 |
| ter      | t |                     |                 |   |                 |
| minating | h |                     |                 |   |                 |
| staff.   | e |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | . |                     |                 |   |                 |
|          |   |                     |                 |   |                 |
|          | M |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | u |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | q |                     |                 |   |                 |
|          | u |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | S |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | u |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | z |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | u |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | u |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | y |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | j |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | b |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | . |                     |                 |   |                 |
|          |   |                     |                 |   |                 |
|          | M |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | b |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | u |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | w |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | u |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | u |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | . |                     |                 |   |                 |
|          |   |                     |                 |   |                 |
|          | M |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | u |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | , |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | , |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | b |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | u |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | . |                     |                 |   |                 |
|          |   |                     |                 |   |                 |
|          | M |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | k |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | b |                     |                 |   |                 |
|          | j |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | v |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | . |                     |                 |   |                 |
|          |   |                     |                 |   |                 |
|          | P |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | y |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | v |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | u |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | . |                     |                 |   |                 |
|          |   |                     |                 |   |                 |
|          | S |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | v |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | b |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | k |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | u |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | j |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | b |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | . |                     |                 |   |                 |
|          |   |                     |                 |   |                 |
|          | M |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | g |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | v |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | f |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | w |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | h |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | s |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | p |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | r |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | m |                     |                 |   |                 |
|          | e |                     |                 |   |                 |
|          | d |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | l |                     |                 |   |                 |
|          | a |                     |                 |   |                 |
|          | c |                     |                 |   |                 |
|          | t |                     |                 |   |                 |
|          | i |                     |                 |   |                 |
|          | o |                     |                 |   |                 |
|          | n |                     |                 |   |                 |
|          | . |                     |                 |   |                 |
+----------+---+---------------------+-----------------+---+-----------------+
| **O      |   |                     |                 |   |                 |
| versight |   |                     |                 |   |                 |
| Groups** |   |                     |                 |   |                 |
+----------+---+---------------------+-----------------+---+-----------------+
| 1\. The  |   | An independent      |                 |   |                 |
| agency   |   | entity audits and   |                 |   |                 |
| has      |   | reviews agency      |                 |   |                 |
| me       |   | activity.           |                 |   |                 |
| chanisms |   |                     |                 |   |                 |
| in place |   | An audit committee  |                 |   |                 |
| to       |   | or senior           |                 |   |                 |
| monitor  |   | management council  |                 |   |                 |
| and      |   | reviews the         |                 |   |                 |
| review   |   | internal audit work |                 |   |                 |
| op       |   | and coordinates     |                 |   |                 |
| erations |   | closely with the    |                 |   |                 |
| and      |   | independent entity  |                 |   |                 |
| p        |   | and external        |                 |   |                 |
| rograms. |   | auditors.           |                 |   |                 |
|          |   |                     |                 |   |                 |
|          |   | The Internal audit  |                 |   |                 |
|          |   | unit reports to the |                 |   |                 |
|          |   | agency head.        |                 |   |                 |
|          |   |                     |                 |   |                 |
|          |   | The internal audit  |                 |   |                 |
|          |   | function reviews    |                 |   |                 |
|          |   | agency activities   |                 |   |                 |
|          |   | and systems and     |                 |   |                 |
|          |   | provides            |                 |   |                 |
|          |   | information,        |                 |   |                 |
|          |   | analyses,           |                 |   |                 |
|          |   | recommendations,    |                 |   |                 |
|          |   | and counsel to      |                 |   |                 |
|          |   | management.         |                 |   |                 |
+----------+---+---------------------+-----------------+---+-----------------+
| 2\. The  |   | The agency provides |                 |   |                 |
| agency   |   | the Legislature     |                 |   |                 |
| works    |   | with timely and     |                 |   |                 |
| closely  |   | accurate            |                 |   |                 |
| with all |   | information to      |                 |   |                 |
| e        |   | allow for           |                 |   |                 |
| xecutive |   | monitoring of       |                 |   |                 |
| and      |   | agency activities,  |                 |   |                 |
| leg      |   | including review of |                 |   |                 |
| islative |   | the agency's        |                 |   |                 |
| branch   |   | mission and goals   |                 |   |                 |
| o        |   | and provision of    |                 |   |                 |
| versight |   | reports on agency   |                 |   |                 |
| organi   |   | performance,        |                 |   |                 |
| zations. |   | finances, and       |                 |   |                 |
|          |   | operating issues.   |                 |   |                 |
|          |   |                     |                 |   |                 |
|          |   | High-level agency   |                 |   |                 |
|          |   | officials meet      |                 |   |                 |
|          |   | regularly with      |                 |   |                 |
|          |   | staff from the      |                 |   |                 |
|          |   | Legislature and     |                 |   |                 |
|          |   | Governor's Office   |                 |   |                 |
|          |   | to discuss major    |                 |   |                 |
|          |   | issues affecting    |                 |   |                 |
|          |   | operations,         |                 |   |                 |
|          |   | internal control,   |                 |   |                 |
|          |   | performance, and    |                 |   |                 |
|          |   | other issues        |                 |   |                 |
|          |   | affecting agency    |                 |   |                 |
|          |   | programs.           |                 |   |                 |
+----------+---+---------------------+-----------------+---+-----------------+

+-----------------------------------------------------------------------+
| **II. RISK ASSESSMENT**                                               |
+-----------------------------------------------------------------------+
| The second internal control standard is Risk Assessment. Clear,       |
| consistent agency goals and objectives at both the agency and program |
| level are essential for agencies to operate efficiently and           |
| effectively. When an agency has established and articulated           |
| objectives, the agency may be able to identify actual or potential    |
| risks/problems---internal and external---that could impede the        |
| accomplishment of those objectives in an efficient manner. When an    |
| agency identifies potential risks/problems and their possible effect  |
| on the organization, they may be able to prevent those problems or    |
| reduce their impact. This section is designed to assist agencies in   |
| this process.                                                         |
|                                                                       |
| Once again, this is not an all-inclusive list. It is a starting point |
| from which States can begin to build a dynamic assessment of actual   |
| or potential risks/ problems and mitigation strategies. Some of the   |
| elements and criteria are subjective in nature. It is important to    |
| examine each of the elements and criteria, as each is important.      |
+-----------------------------------------------------------------------+
| **Establishment of Entity-wide Objectives**                           |
+-----------------------------------------------------------------------+

+----------+---+---------------------+-----------------+------------------+
| **El     |   | **Criteria**        | **              | **               |
| ements** |   |                     | Documentation** | Findings/Results |
|          |   |                     |                 | & Suggested      |
|          |   |                     | **(Provide all  | Follow-up if     |
|          |   |                     | applicable      | Necessary**      |
|          |   |                     | d               |                  |
|          |   |                     | ocumentation)** |                  |
+==========+===+=====================+=================+==================+
| 1\.      |   | Management          |                 |                  |
| Ma       |   | establishes a       |                 |                  |
| nagement |   | strategic plan that |                 |                  |
| est      |   | includes agency     |                 |                  |
| ablishes |   | mission, goals, and |                 |                  |
| agency   |   | objectives.         |                 |                  |
| specific |   |                     |                 |                  |
| ob       |   | Management          |                 |                  |
| jectives |   | establishes         |                 |                  |
| and      |   | objectives based on |                 |                  |
| comm     |   | program             |                 |                  |
| unicates |   | requirements.       |                 |                  |
| them to  |   |                     |                 |                  |
| all      |   |                     |                 |                  |
| staff.   |   |                     |                 |                  |
+----------+---+---------------------+-----------------+------------------+
| 2\.      |   | Strategic plans     |                 |                  |
| Ma       |   | address resource    |                 |                  |
| nagement |   | allocations and     |                 |                  |
| has an   |   | priorities.         |                 |                  |
| in       |   |                     |                 |                  |
| tegrated |   | Management designs  |                 |                  |
| ma       |   | strategic plans and |                 |                  |
| nagement |   | budgets with an     |                 |                  |
| s        |   | appropriate level   |                 |                  |
| trategy, |   | of detail for       |                 |                  |
| risk     |   | various management  |                 |                  |
| ass      |   | levels.             |                 |                  |
| essment, |   |                     |                 |                  |
| and      |   |                     |                 |                  |
| control  |   |                     |                 |                  |
| s        |   |                     |                 |                  |
| tructure |   |                     |                 |                  |
| to       |   |                     |                 |                  |
| address  |   |                     |                 |                  |
| risks    |   |                     |                 |                  |
| and      |   |                     |                 |                  |
| ope      |   |                     |                 |                  |
| rational |   |                     |                 |                  |
| st       |   |                     |                 |                  |
| rategies |   |                     |                 |                  |
| that     |   |                     |                 |                  |
| support  |   |                     |                 |                  |
| ent      |   |                     |                 |                  |
| ity-wide |   |                     |                 |                  |
| ob       |   |                     |                 |                  |
| jectives |   |                     |                 |                  |
+----------+---+---------------------+-----------------+------------------+
| **Estab  |   |                     |                 |                  |
| lishment |   |                     |                 |                  |
| of       |   |                     |                 |                  |
| Ac       |   |                     |                 |                  |
| tivity** |   |                     |                 |                  |
+----------+---+---------------------+-----------------+------------------+
| 1\.      |   | Management reviews  |                 |                  |
| Ma       |   | program strategies  |                 |                  |
| nagement |   | periodically to     |                 |                  |
| id       |   | assure that they    |                 |                  |
| entifies |   | have continued      |                 |                  |
| and      |   | relevance.          |                 |                  |
| reviews  |   |                     |                 |                  |
| mission  |   | Management reviews  |                 |                  |
| critical |   | and monitors        |                 |                  |
| program  |   | critical            |                 |                  |
| str      |   | activity-level      |                 |                  |
| ategies, |   | objectives          |                 |                  |
| agency   |   | regularly.          |                 |                  |
| obj      |   |                     |                 |                  |
| ectives, |   |                     |                 |                  |
| and      |   |                     |                 |                  |
| outcome  |   |                     |                 |                  |
| criteria |   |                     |                 |                  |
| and      |   |                     |                 |                  |
| m        |   |                     |                 |                  |
| easures. |   |                     |                 |                  |
+----------+---+---------------------+-----------------+------------------+
| 2\.      |   | Management provides |                 |                  |
| Ma       |   | the necessary       |                 |                  |
| nagement |   | resources to review |                 |                  |
| a        |   | and monitor the     |                 |                  |
| llocates |   | agency objectives   |                 |                  |
| su       |   | and outcome         |                 |                  |
| fficient |   | measures on a       |                 |                  |
| r        |   | regular basis.      |                 |                  |
| esources |   |                     |                 |                  |
| to meet  |   |                     |                 |                  |
| obj      |   |                     |                 |                  |
| ectives. |   |                     |                 |                  |
+----------+---+---------------------+-----------------+------------------+
| **Risk   |   |                     |                 |                  |
| Identifi |   |                     |                 |                  |
| cation** |   |                     |                 |                  |
+----------+---+---------------------+-----------------+------------------+
| 1\.      |   | Management uses     |                 |                  |
| Ma       |   | qualitative and     |                 |                  |
| nagement |   | quantitative        |                 |                  |
| id       |   | methods to identify |                 |                  |
| entifies |   | risk and quantify   |                 |                  |
| risk     |   | relative risk       |                 |                  |
| using    |   | rankings on a       |                 |                  |
| app      |   | scheduled and       |                 |                  |
| ropriate |   | periodic basis.     |                 |                  |
| method   |   |                     |                 |                  |
| ologies. |   | Risk identification |                 |                  |
|          |   | and discussion      |                 |                  |
|          |   | occur at all levels |                 |                  |
|          |   | of the agency.      |                 |                  |
|          |   |                     |                 |                  |
|          |   | Risk identification |                 |                  |
|          |   | includes, but is    |                 |                  |
|          |   | not limited to,     |                 |                  |
|          |   | findings from       |                 |                  |
|          |   | audits,             |                 |                  |
|          |   | evaluations, and    |                 |                  |
|          |   | other assessments.  |                 |                  |
+----------+---+---------------------+-----------------+------------------+
| 2\.      |   | External factors    |                 |                  |
| Ma       |   | include, but are    |                 |                  |
| nagement |   | not limited to:     |                 |                  |
| c        |   |                     |                 |                  |
| onsiders |   | -   Technological   |                 |                  |
| all      |   |     advancements    |                 |                  |
| factors  |   |     and             |                 |                  |
| when     |   |     developments;   |                 |                  |
| ide      |   |                     |                 |                  |
| ntifying |   | -   Changing needs  |                 |                  |
| risk,    |   |     or expectations |                 |                  |
| i        |   |     of the          |                 |                  |
| ncluding |   |     Legislature,    |                 |                  |
| e        |   |     agency          |                 |                  |
| xternal, |   |     officials, and  |                 |                  |
| i        |   |     the public;     |                 |                  |
| nternal, |   |                     |                 |                  |
| and      |   | -   New legislation |                 |                  |
| outside  |   |     or regulations; |                 |                  |
| factors. |   |                     |                 |                  |
|          |   | -   Natural         |                 |                  |
|          |   |     catastrophes or |                 |                  |
|          |   |     criminal or     |                 |                  |
|          |   |     terrorist       |                 |                  |
|          |   |     actions;        |                 |                  |
|          |   |                     |                 |                  |
|          |   | -   Business,       |                 |                  |
|          |   |     political, and  |                 |                  |
|          |   |     economic        |                 |                  |
|          |   |     changes;        |                 |                  |
|          |   |                     |                 |                  |
|          |   | -   Major suppliers |                 |                  |
|          |   |     and             |                 |                  |
|          |   |     contractors;    |                 |                  |
|          |   |     and             |                 |                  |
|          |   |                     |                 |                  |
|          |   | -   Other entities. |                 |                  |
|          |   |                     |                 |                  |
|          |   | Internal factors    |                 |                  |
|          |   | include, but are    |                 |                  |
|          |   | not limited to:     |                 |                  |
|          |   |                     |                 |                  |
|          |   | -   Downsizing of   |                 |                  |
|          |   |     agency          |                 |                  |
|          |   |     operations and  |                 |                  |
|          |   |     staff;          |                 |                  |
|          |   |                     |                 |                  |
|          |   | -   Business        |                 |                  |
|          |   |     process         |                 |                  |
|          |   |     reengineering   |                 |                  |
|          |   |     or redesign of  |                 |                  |
|          |   |     operating       |                 |                  |
|          |   |     processes;      |                 |                  |
|          |   |                     |                 |                  |
|          |   | -   Disruption of   |                 |                  |
|          |   |     information     |                 |                  |
|          |   |     systems and     |                 |                  |
|          |   |     disaster        |                 |                  |
|          |   |     recovery plans; |                 |                  |
|          |   |                     |                 |                  |
|          |   | -   Decentralized   |                 |                  |
|          |   |     program         |                 |                  |
|          |   |     operations;     |                 |                  |
|          |   |                     |                 |                  |
|          |   | -   Qualifications  |                 |                  |
|          |   |     and training of |                 |                  |
|          |   |     staff;          |                 |                  |
|          |   |                     |                 |                  |
|          |   | -   Reliance on     |                 |                  |
|          |   |     contractors or  |                 |                  |
|          |   |     other parties   |                 |                  |
|          |   |     to perform      |                 |                  |
|          |   |     critical agency |                 |                  |
|          |   |     operations;     |                 |                  |
|          |   |                     |                 |                  |
|          |   | -   Major changes   |                 |                  |
|          |   |     in managerial   |                 |                  |
|          |   |                     |                 |                  |
|          |   |   responsibilities; |                 |                  |
|          |   |                     |                 |                  |
|          |   | -   Unusual staff   |                 |                  |
|          |   |     access to       |                 |                  |
|          |   |     vulnerable      |                 |                  |
|          |   |     assets;         |                 |                  |
|          |   |                     |                 |                  |
|          |   | -   Succession      |                 |                  |
|          |   |     planning and    |                 |                  |
|          |   |     retention of    |                 |                  |
|          |   |     key staff;      |                 |                  |
|          |   |                     |                 |                  |
|          |   | -   Competitive     |                 |                  |
|          |   |     compensation    |                 |                  |
|          |   |     and benefit     |                 |                  |
|          |   |     programs; and   |                 |                  |
|          |   |                     |                 |                  |
|          |   | -   Availability    |                 |                  |
|          |   |     and adequacy of |                 |                  |
|          |   |     funding.        |                 |                  |
+----------+---+---------------------+-----------------+------------------+
| **Risk   |   |                     |                 |                  |
| An       |   |                     |                 |                  |
| alysis** |   |                     |                 |                  |
+----------+---+---------------------+-----------------+------------------+
| 1\.      |   | Management sets     |                 |                  |
| Ma       |   | specific tolerance  |                 |                  |
| nagement |   | levels and assigns  |                 |                  |
| develops |   | specific acceptable |                 |                  |
| a risk   |   | levels of risk for  |                 |                  |
| t        |   | the agency as well  |                 |                  |
| olerance |   | as each relevant    |                 |                  |
| process. |   | program area.       |                 |                  |
|          |   |                     |                 |                  |
|          |   | Management expects  |                 |                  |
|          |   | programs to         |                 |                  |
|          |   | implement control   |                 |                  |
|          |   | activities and      |                 |                  |
|          |   | monitor the         |                 |                  |
|          |   | results.            |                 |                  |
+----------+---+---------------------+-----------------+------------------+
| **       |   |                     |                 |                  |
| Managing |   |                     |                 |                  |
| Risk     |   |                     |                 |                  |
| During   |   |                     |                 |                  |
| Change** |   |                     |                 |                  |
+----------+---+---------------------+-----------------+------------------+
| 1\.      | M |                     |                 |                  |
| Ma       | a |                     |                 |                  |
| nagement | n |                     |                 |                  |
| has a    | a |                     |                 |                  |
| m        | g |                     |                 |                  |
| echanism | e |                     |                 |                  |
| for      | m |                     |                 |                  |
| reacting | e |                     |                 |                  |
| to risks | n |                     |                 |                  |
| p        | t |                     |                 |                  |
| resented | g |                     |                 |                  |
| by       | i |                     |                 |                  |
| changes  | v |                     |                 |                  |
| that can | e |                     |                 |                  |
| have a   | s |                     |                 |                  |
| dramatic | s |                     |                 |                  |
| and      | p |                     |                 |                  |
| p        | e |                     |                 |                  |
| ervasive | c |                     |                 |                  |
| effect.  | i |                     |                 |                  |
|          | a |                     |                 |                  |
|          | l |                     |                 |                  |
|          | c |                     |                 |                  |
|          | o |                     |                 |                  |
|          | n |                     |                 |                  |
|          | s |                     |                 |                  |
|          | i |                     |                 |                  |
|          | d |                     |                 |                  |
|          | e |                     |                 |                  |
|          | r |                     |                 |                  |
|          | a |                     |                 |                  |
|          | t |                     |                 |                  |
|          | i |                     |                 |                  |
|          | o |                     |                 |                  |
|          | n |                     |                 |                  |
|          | t |                     |                 |                  |
|          | o |                     |                 |                  |
|          | : |                     |                 |                  |
|          |   |                     |                 |                  |
|          | - |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | S |                     |                 |                  |
|          | t |                     |                 |                  |
|          | a |                     |                 |                  |
|          | f |                     |                 |                  |
|          | f |                     |                 |                  |
|          | i |                     |                 |                  |
|          | n |                     |                 |                  |
|          | g |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | o |                     |                 |                  |
|          | f |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | k |                     |                 |                  |
|          | e |                     |                 |                  |
|          | y |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | p |                     |                 |                  |
|          | o |                     |                 |                  |
|          | s |                     |                 |                  |
|          | i |                     |                 |                  |
|          | t |                     |                 |                  |
|          | i |                     |                 |                  |
|          | o |                     |                 |                  |
|          | n |                     |                 |                  |
|          | s |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | o |                     |                 |                  |
|          | r |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | s |                     |                 |                  |
|          | t |                     |                 |                  |
|          | a |                     |                 |                  |
|          | f |                     |                 |                  |
|          | f |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | t |                     |                 |                  |
|          | u |                     |                 |                  |
|          | r |                     |                 |                  |
|          | n |                     |                 |                  |
|          | o |                     |                 |                  |
|          | v |                     |                 |                  |
|          | e |                     |                 |                  |
|          | r |                     |                 |                  |
|          | ; |                     |                 |                  |
|          |   |                     |                 |                  |
|          | - |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | I |                     |                 |                  |
|          | n |                     |                 |                  |
|          | t |                     |                 |                  |
|          | r |                     |                 |                  |
|          | o |                     |                 |                  |
|          | d |                     |                 |                  |
|          | u |                     |                 |                  |
|          | c |                     |                 |                  |
|          | t |                     |                 |                  |
|          | i |                     |                 |                  |
|          | o |                     |                 |                  |
|          | n |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | a |                     |                 |                  |
|          | n |                     |                 |                  |
|          | d |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | t |                     |                 |                  |
|          | r |                     |                 |                  |
|          | a |                     |                 |                  |
|          | i |                     |                 |                  |
|          | n |                     |                 |                  |
|          | i |                     |                 |                  |
|          | n |                     |                 |                  |
|          | g |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | o |                     |                 |                  |
|          | f |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | n |                     |                 |                  |
|          | e |                     |                 |                  |
|          | w |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | o |                     |                 |                  |
|          | r |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | c |                     |                 |                  |
|          | h |                     |                 |                  |
|          | a |                     |                 |                  |
|          | n |                     |                 |                  |
|          | g |                     |                 |                  |
|          | e |                     |                 |                  |
|          | d |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | i |                     |                 |                  |
|          | n |                     |                 |                  |
|          | f |                     |                 |                  |
|          | o |                     |                 |                  |
|          | r |                     |                 |                  |
|          | m |                     |                 |                  |
|          | a |                     |                 |                  |
|          | t |                     |                 |                  |
|          | i |                     |                 |                  |
|          | o |                     |                 |                  |
|          | n |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | s |                     |                 |                  |
|          | y |                     |                 |                  |
|          | s |                     |                 |                  |
|          | t |                     |                 |                  |
|          | e |                     |                 |                  |
|          | m |                     |                 |                  |
|          | s |                     |                 |                  |
|          | ; |                     |                 |                  |
|          |   |                     |                 |                  |
|          | - |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | R |                     |                 |                  |
|          | a |                     |                 |                  |
|          | p |                     |                 |                  |
|          | i |                     |                 |                  |
|          | d |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | g |                     |                 |                  |
|          | r |                     |                 |                  |
|          | o |                     |                 |                  |
|          | w |                     |                 |                  |
|          | t |                     |                 |                  |
|          | h |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | a |                     |                 |                  |
|          | n |                     |                 |                  |
|          | d |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | e |                     |                 |                  |
|          | x |                     |                 |                  |
|          | p |                     |                 |                  |
|          | a |                     |                 |                  |
|          | n |                     |                 |                  |
|          | s |                     |                 |                  |
|          | i |                     |                 |                  |
|          | o |                     |                 |                  |
|          | n |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | o |                     |                 |                  |
|          | r |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | r |                     |                 |                  |
|          | a |                     |                 |                  |
|          | p |                     |                 |                  |
|          | i |                     |                 |                  |
|          | d |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | d |                     |                 |                  |
|          | o |                     |                 |                  |
|          | w |                     |                 |                  |
|          | n |                     |                 |                  |
|          | s |                     |                 |                  |
|          | i |                     |                 |                  |
|          | z |                     |                 |                  |
|          | i |                     |                 |                  |
|          | n |                     |                 |                  |
|          | g |                     |                 |                  |
|          | ; |                     |                 |                  |
|          |   |                     |                 |                  |
|          | - |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | N |                     |                 |                  |
|          | e |                     |                 |                  |
|          | w |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | t |                     |                 |                  |
|          | e |                     |                 |                  |
|          | c |                     |                 |                  |
|          | h |                     |                 |                  |
|          | n |                     |                 |                  |
|          | o |                     |                 |                  |
|          | l |                     |                 |                  |
|          | o |                     |                 |                  |
|          | g |                     |                 |                  |
|          | i |                     |                 |                  |
|          | c |                     |                 |                  |
|          | a |                     |                 |                  |
|          | l |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | d |                     |                 |                  |
|          | e |                     |                 |                  |
|          | v |                     |                 |                  |
|          | e |                     |                 |                  |
|          | l |                     |                 |                  |
|          | o |                     |                 |                  |
|          | p |                     |                 |                  |
|          | m |                     |                 |                  |
|          | e |                     |                 |                  |
|          | n |                     |                 |                  |
|          | t |                     |                 |                  |
|          | s |                     |                 |                  |
|          | ; |                     |                 |                  |
|          |   |                     |                 |                  |
|          | - |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | N |                     |                 |                  |
|          | e |                     |                 |                  |
|          | w |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | o |                     |                 |                  |
|          | u |                     |                 |                  |
|          | t |                     |                 |                  |
|          | p |                     |                 |                  |
|          | u |                     |                 |                  |
|          | t |                     |                 |                  |
|          | s |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | o |                     |                 |                  |
|          | r |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | s |                     |                 |                  |
|          | e |                     |                 |                  |
|          | r |                     |                 |                  |
|          | v |                     |                 |                  |
|          | i |                     |                 |                  |
|          | c |                     |                 |                  |
|          | e |                     |                 |                  |
|          | s |                     |                 |                  |
|          | ; |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | a |                     |                 |                  |
|          | n |                     |                 |                  |
|          | d |                     |                 |                  |
|          |   |                     |                 |                  |
|          | - |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | G |                     |                 |                  |
|          | e |                     |                 |                  |
|          | o |                     |                 |                  |
|          | g |                     |                 |                  |
|          | r |                     |                 |                  |
|          | a |                     |                 |                  |
|          | p |                     |                 |                  |
|          | h |                     |                 |                  |
|          | i |                     |                 |                  |
|          | c |                     |                 |                  |
|          | a |                     |                 |                  |
|          | l |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          |   |                     |                 |                  |
|          | r |                     |                 |                  |
|          | e |                     |                 |                  |
|          | a |                     |                 |                  |
|          | l |                     |                 |                  |
|          | i |                     |                 |                  |
|          | g |                     |                 |                  |
|          | n |                     |                 |                  |
|          | m |                     |                 |                  |
|          | e |                     |                 |                  |
|          | n |                     |                 |                  |
|          | t |                     |                 |                  |
|          | . |                     |                 |                  |
+----------+---+---------------------+-----------------+------------------+

+-----------------------------------------------------------------------+
| **III. CONTROL ACTIVITIES**                                           |
+-----------------------------------------------------------------------+
| States use internal Control Activities to mitigate the risks          |
| identified during the risk assessment process. These activities are   |
| an integral part of agencies\' planning, implementation, and review   |
| processes. Internal control activities are essential to holding       |
| programs accountable for effective and efficient program results.     |
|                                                                       |
| Control includes a wide range of diverse activities, such as          |
| approvals, authorizations, verifications, reconciliations,            |
| performance reviews, security activities, and the production of       |
| records and documentation. Agencies\' management directives guide     |
| controls on how to address the risks associated with program missions |
| and objectives. Managers or evaluators will assess whether control    |
| activities are appropriate, adequate, and effectively and efficiently |
| applied. This analysis would include controls for computerized        |
| information systems.                                                  |
|                                                                       |
| Control Activities may vary considerably from agency to agency. These |
| differences may result from (1) variations in missions, goals, and    |
| objectives of the agencies; (2) differences in agency environments    |
| and how they operate; (3) differing degree of organizational          |
| complexity; (4) differences in agency histories and culture; and (5)  |
| variations in the risks each agency faces and is trying to mitigate.  |
| Even if two agencies have the same missions, goals, objectives, and   |
| organizational structures, they would probably use different control  |
| activities. Control Activities vary by individual judgment,           |
| implementation strategies, and management approaches.                 |
|                                                                       |
| This section pertains specifically to the child care program. These   |
| elements and criteria are in italics and child care staff will        |
| complete this section; however, .even when the elements are specific  |
| to the child care program, there may overall elements that also refer |
| to the agency as a whole. The overall agency elements should also be  |
| included during the review process because they may directly or       |
| indirectly affect the child care program. States are encouraged to    |
| use this Instrument for other programs as well, such as Food Stamps   |
| and TANF. If States do expand the use of this Instrument to these     |
| programs, they would revise the language to reflect the specifics of  |
| the additional programs. The elements and criteria in this section    |
| are a beginning point. They are not an all inclusive set of elements  |
| and criteria.                                                         |
+-----------------------------------------------------------------------+
| **General Application**                                               |
+-----------------------------------------------------------------------+

+----------+---------------------+-----------------+------------------+
| **El     | **Criteria**        | **              | **               |
| ements** |                     | Documentation** | Findings/Results |
|          |                     |                 | & Suggested      |
|          |                     | **(Provide all  | Follow-up if     |
|          |                     | applicable      | Necessary**      |
|          |                     | d               |                  |
|          |                     | ocumentation)** |                  |
+==========+=====================+=================+==================+
| 1\.      | Management          |                 |                  |
| Ma       | establishes         |                 |                  |
| nagement | objectives and      |                 |                  |
| est      | associated risks,   |                 |                  |
| ablishes | identifies the      |                 |                  |
| app      | actions and control |                 |                  |
| ropriate | activities needed   |                 |                  |
| p        | to address the      |                 |                  |
| olicies, | risks, and directs  |                 |                  |
| pro      | their               |                 |                  |
| cedures, | implementation.     |                 |                  |
| tec      |                     |                 |                  |
| hniques, |                     |                 |                  |
| and      |                     |                 |                  |
| me       |                     |                 |                  |
| chanisms |                     |                 |                  |
| with     |                     |                 |                  |
| respect  |                     |                 |                  |
| to each  |                     |                 |                  |
| of the   |                     |                 |                  |
| child    |                     |                 |                  |
| care     |                     |                 |                  |
| p        |                     |                 |                  |
| rogram's |                     |                 |                  |
| act      |                     |                 |                  |
| ivities. |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 2\. For  | Staff applies       |                 |                  |
| id       | control activities  |                 |                  |
| entified | properly and        |                 |                  |
| control  | understands their   |                 |                  |
| act      | purpose.            |                 |                  |
| ivities, |                     |                 |                  |
| ma       | Staff review        |                 |                  |
| nagement | established control |                 |                  |
| e        | activities and      |                 |                  |
| valuates | provide input.      |                 |                  |
| the      |                     |                 |                  |
| child    | Management takes    |                 |                  |
| care     | timely action on    |                 |                  |
| p        | exceptions,         |                 |                  |
| rogram's | implementation      |                 |                  |
| overall  | problems, or        |                 |                  |
| act      | information that    |                 |                  |
| ivities. | requires follow-up. |                 |                  |
+----------+---------------------+-----------------+------------------+
| **Common |                     |                 |                  |
| Ca       |                     |                 |                  |
| tegories |                     |                 |                  |
| of       |                     |                 |                  |
| Control  |                     |                 |                  |
| Acti     |                     |                 |                  |
| vities** |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 1\.      | Management          |                 |                  |
| Ma       | regularly reviews   |                 |                  |
| nagement | actual performance  |                 |                  |
| tracks   | against budgets,    |                 |                  |
| major    | forecasts, and      |                 |                  |
| child    | prior period        |                 |                  |
| care     | results and         |                 |                  |
| program  | compliance with     |                 |                  |
| achi     | applicable Federal  |                 |                  |
| evements | regulations and the |                 |                  |
| in       | current State Plan. |                 |                  |
| relation |                     |                 |                  |
| to the   | Management develops |                 |                  |
| ACF      | performance plans,  |                 |                  |
| approved | measures and        |                 |                  |
| State    | reports results,    |                 |                  |
| Plan.    | and takes follow-up |                 |                  |
|          | action as           |                 |                  |
|          | necessary.          |                 |                  |
+----------+---------------------+-----------------+------------------+
| 2\.      | Managers at all     |                 |                  |
| Ma       | levels review       |                 |                  |
| nagement | performance         |                 |                  |
| reviews  | reports, analyze    |                 |                  |
| specific | trends, and measure |                 |                  |
| per      | results and         |                 |                  |
| formance | compliance with the |                 |                  |
| measures | ACF approved State  |                 |                  |
| with     | plan.               |                 |                  |
| respect  |                     |                 |                  |
| to each  | Financial and       |                 |                  |
| of the   | program managers    |                 |                  |
| agency's | review and compare  |                 |                  |
| overall  | financial,          |                 |                  |
| ac       | budgetary, Federal  |                 |                  |
| tivities | financial           |                 |                  |
| part     | compliance, and     |                 |                  |
| icularly | operational         |                 |                  |
| those    | performance to      |                 |                  |
| ac       | planned or expected |                 |                  |
| tivities | results.            |                 |                  |
| related  |                     |                 |                  |
| to the   | Managers use        |                 |                  |
| child    | appropriate control |                 |                  |
| care     | activities such as  |                 |                  |
| program. | reconciling summary |                 |                  |
|          | information to      |                 |                  |
|          | supporting detail   |                 |                  |
|          | and checking the    |                 |                  |
|          | accuracy of         |                 |                  |
|          | summaries.          |                 |                  |
+----------+---------------------+-----------------+------------------+
| 3\. The  | The agency          |                 |                  |
| agency   | incorporates the    |                 |                  |
| eff      | overall agency      |                 |                  |
| ectively | mission, goals, and |                 |                  |
| manages  | values in its       |                 |                  |
| the      | strategic plan and  |                 |                  |
| organi   | other guiding       |                 |                  |
| zation's | documents and       |                 |                  |
| child    | communicates this   |                 |                  |
| care     | information to all  |                 |                  |
| w        | staff.              |                 |                  |
| orkforce |                     |                 |                  |
| to       | The agency has a    |                 |                  |
| achieve  | workforce planning  |                 |                  |
| results  | strategy, which     |                 |                  |
| with     | identifies current  |                 |                  |
| respect  | and future staffing |                 |                  |
| to each  | needs.              |                 |                  |
| of the   |                     |                 |                  |
| agency's | The agency has a    |                 |                  |
| overall  | process in place to |                 |                  |
| act      | ensure performance  |                 |                  |
| ivities. | management and      |                 |                  |
|          | compliance with     |                 |                  |
|          | applicable Federal  |                 |                  |
|          | regulations.        |                 |                  |
|          |                     |                 |                  |
|          | The agency has a    |                 |                  |
|          | formal recruiting,  |                 |                  |
|          | hiring, and         |                 |                  |
|          | retention process   |                 |                  |
|          | to ensure a         |                 |                  |
|          | competent           |                 |                  |
|          | workforce.          |                 |                  |
|          |                     |                 |                  |
|          | The agency provides |                 |                  |
|          | orientation,        |                 |                  |
|          | training, and tools |                 |                  |
|          | for staff to        |                 |                  |
|          | perform their       |                 |                  |
|          | duties and          |                 |                  |
|          | responsibilities,   |                 |                  |
|          | improve             |                 |                  |
|          | performance,        |                 |                  |
|          | enhance their       |                 |                  |
|          | capabilities, and   |                 |                  |
|          | meet the demands of |                 |                  |
|          | changing            |                 |                  |
|          | organizational      |                 |                  |
|          | needs.              |                 |                  |
|          |                     |                 |                  |
|          | The compensation    |                 |                  |
|          | system is adequate  |                 |                  |
|          | to acquire,         |                 |                  |
|          | motivate, and       |                 |                  |
|          | retain staff. Staff |                 |                  |
|          | receive incentives  |                 |                  |
|          | and rewards to      |                 |                  |
|          | encourage them to   |                 |                  |
|          | perform at maximum  |                 |                  |
|          | capability.         |                 |                  |
|          |                     |                 |                  |
|          | The agency provides |                 |                  |
|          | workplace           |                 |                  |
|          | flexibility,        |                 |                  |
|          | services, and       |                 |                  |
|          | facilities (e.g.,   |                 |                  |
|          | career counseling,  |                 |                  |
|          | flextime,           |                 |                  |
|          | casual-dress days,  |                 |                  |
|          | and child care) to  |                 |                  |
|          | help it compete for |                 |                  |
|          | talent and enhance  |                 |                  |
|          | staff satisfaction  |                 |                  |
|          | and commitment.     |                 |                  |
|          |                     |                 |                  |
|          | The agency provides |                 |                  |
|          | qualified and       |                 |                  |
|          | continuous          |                 |                  |
|          | supervision to      |                 |                  |
|          | ensure the          |                 |                  |
|          | achievement of      |                 |                  |
|          | internal control    |                 |                  |
|          | objectives.         |                 |                  |
|          |                     |                 |                  |
|          | Management provides |                 |                  |
|          | timely, meaningful, |                 |                  |
|          | honest, and         |                 |                  |
|          | constructive        |                 |                  |
|          | performance         |                 |                  |
|          | evaluations and     |                 |                  |
|          | feedback to help    |                 |                  |
|          | staff understand    |                 |                  |
|          | the connection      |                 |                  |
|          | between their       |                 |                  |
|          | performance and the |                 |                  |
|          | achievement of the  |                 |                  |
|          | agency's goals.     |                 |                  |
|          |                     |                 |                  |
|          | Management conducts |                 |                  |
|          | succession planning |                 |                  |
|          | to ensure           |                 |                  |
|          | continuity of       |                 |                  |
|          | needed skills and   |                 |                  |
|          | abilities.          |                 |                  |
+----------+---------------------+-----------------+------------------+
| 4\. The  | The agency has      |                 |                  |
| agency   | physical            |                 |                  |
| employs  | safeguarding        |                 |                  |
| physical | policies and        |                 |                  |
| control  | procedures          |                 |                  |
| to       | developed,          |                 |                  |
| secure   | implemented, and    |                 |                  |
| and      | communicated to     |                 |                  |
| s        | staff.              |                 |                  |
| afeguard |                     |                 |                  |
| vu       | The agency          |                 |                  |
| lnerable | regularly updates   |                 |                  |
| assets   | and communicates    |                 |                  |
| within   | its disaster        |                 |                  |
| the      | recovery plan to    |                 |                  |
| child    | staff.              |                 |                  |
| care     |                     |                 |                  |
| program. | The agency secures  |                 |                  |
|          | and controls        |                 |                  |
|          | vulnerable assets   |                 |                  |
|          | such as cash,       |                 |                  |
|          | securities,         |                 |                  |
|          | supplies,           |                 |                  |
|          | inventories, and    |                 |                  |
|          | equipment.          |                 |                  |
|          |                     |                 |                  |
|          | The agency          |                 |                  |
|          | periodically counts |                 |                  |
|          | assets and compares |                 |                  |
|          | the count to        |                 |                  |
|          | control records and |                 |                  |
|          | exceptions such as  |                 |                  |
|          | cash, securities,   |                 |                  |
|          | supplies,           |                 |                  |
|          | inventories, and    |                 |                  |
|          | equipment.          |                 |                  |
|          |                     |                 |                  |
|          | The agency          |                 |                  |
|          | maintains cash and  |                 |                  |
|          | negotiable          |                 |                  |
|          | securities under    |                 |                  |
|          | lock and key with   |                 |                  |
|          | access strictly     |                 |                  |
|          | controlled.         |                 |                  |
|          |                     |                 |                  |
|          | Forms such as blank |                 |                  |
|          | checks and purchase |                 |                  |
|          | orders are          |                 |                  |
|          | sequentially        |                 |                  |
|          | pre-numbered,       |                 |                  |
|          | physically secured, |                 |                  |
|          | and access to them  |                 |                  |
|          | is strictly         |                 |                  |
|          | controlled.         |                 |                  |
|          |                     |                 |                  |
|          | Inventories,        |                 |                  |
|          | supplies, and       |                 |                  |
|          | finished            |                 |                  |
|          | items/goods are     |                 |                  |
|          | stored in           |                 |                  |
|          | physically secured  |                 |                  |
|          | areas and protected |                 |                  |
|          | from damage.        |                 |                  |
|          |                     |                 |                  |
|          | The agency secures  |                 |                  |
|          | facilities from     |                 |                  |
|          | fire with fire      |                 |                  |
|          | alarms and          |                 |                  |
|          | sprinkler systems.  |                 |                  |
|          |                     |                 |                  |
|          | The agency controls |                 |                  |
|          | access to premises  |                 |                  |
|          | and facilities.     |                 |                  |
|          |                     |                 |                  |
|          | The agency ensures  |                 |                  |
|          | that contractors    |                 |                  |
|          | employ physical     |                 |                  |
|          | control to secure   |                 |                  |
|          | and safeguard       |                 |                  |
|          | vulnerable assets.  |                 |                  |
+----------+---------------------+-----------------+------------------+
| 5\.      | The agency does not |                 |                  |
| Ma       | allow one           |                 |                  |
| nagement | individual to       |                 |                  |
| divides  | control all key     |                 |                  |
| key      | aspects of a        |                 |                  |
| duties   | transaction or      |                 |                  |
| and      | event.              |                 |                  |
| responsi |                     |                 |                  |
| bilities | Examples include:   |                 |                  |
| among    |                     |                 |                  |
| d        | -   Separation of   |                 |                  |
| ifferent |                     |                 |                  |
| people   |    responsibilities |                 |                  |
| to       |     and duties      |                 |                  |
| reduce   |     involving       |                 |                  |
| the risk |     transactions    |                 |                  |
| of       |     and events      |                 |                  |
| error,   |     among different |                 |                  |
| waste,   |     staff with      |                 |                  |
| or fraud |     respect to      |                 |                  |
| in the   |     authorization,  |                 |                  |
| child    |     approval,       |                 |                  |
| care     |     processing and  |                 |                  |
| program. |     recording,      |                 |                  |
|          |     making payments |                 |                  |
|          |     or receiving    |                 |                  |
|          |     funds, review   |                 |                  |
|          |     and auditing,   |                 |                  |
|          |     and the         |                 |                  |
|          |     custodial       |                 |                  |
|          |     functions and   |                 |                  |
|          |     handling of     |                 |                  |
|          |     related assets; |                 |                  |
|          |                     |                 |                  |
|          | -   Duties are      |                 |                  |
|          |     assigned        |                 |                  |
|          |     systematically  |                 |                  |
|          |     to a number of  |                 |                  |
|          |     individuals to  |                 |                  |
|          |     ensure that     |                 |                  |
|          |     effective       |                 |                  |
|          |     checks and      |                 |                  |
|          |     balances exist; |                 |                  |
|          |                     |                 |                  |
|          | -   No one          |                 |                  |
|          |     individual can  |                 |                  |
|          |     work alone with |                 |                  |
|          |     cash,           |                 |                  |
|          |     negotiable      |                 |                  |
|          |     securities, or  |                 |                  |
|          |     other highly    |                 |                  |
|          |     vulnerable      |                 |                  |
|          |     assets without  |                 |                  |
|          |     prior           |                 |                  |
|          |     authorization   |                 |                  |
|          |     or monitoring;  |                 |                  |
|          |                     |                 |                  |
|          | -   Individuals     |                 |                  |
|          |     responsible for |                 |                  |
|          |     opening mail    |                 |                  |
|          |     cannot have     |                 |                  |
|          |     responsibility  |                 |                  |
|          |     for or access   |                 |                  |
|          |     to files or     |                 |                  |
|          |     documents       |                 |                  |
|          |     pertaining to   |                 |                  |
|          |     accounts        |                 |                  |
|          |     receivable or   |                 |                  |
|          |     cash accounts;  |                 |                  |
|          |                     |                 |                  |
|          | -   Staff with      |                 |                  |
|          |     responsibility  |                 |                  |
|          |     for case        |                 |                  |
|          |     receipts or     |                 |                  |
|          |     disbursements   |                 |                  |
|          |     cannot          |                 |                  |
|          |     reconcile those |                 |                  |
|          |     accounts; and   |                 |                  |
|          |                     |                 |                  |
|          | -   Management      |                 |                  |
|          |     reduces the     |                 |                  |
|          |     opportunity for |                 |                  |
|          |     collusion to    |                 |                  |
|          |     occur.          |                 |                  |
+----------+---------------------+-----------------+------------------+
| 6\.      | Management          |                 |                  |
| Ma       | establishes         |                 |                  |
| nagement | appropriate         |                 |                  |
| au       | controls.           |                 |                  |
| thorizes |                     |                 |                  |
| app      | Management ensures  |                 |                  |
| ropriate | the terms of        |                 |                  |
| staff to | authorizations are  |                 |                  |
| perform  | in accordance with  |                 |                  |
| and      | directives, within  |                 |                  |
| document | limitations         |                 |                  |
| all      | established by law  |                 |                  |
| tran     | and regulation, and |                 |                  |
| sactions | communicated to     |                 |                  |
| and      | staff and           |                 |                  |
| other    | contractors.        |                 |                  |
| sig      |                     |                 |                  |
| nificant | Management          |                 |                  |
| events   | maintains written   |                 |                  |
| within   | documentation that  |                 |                  |
| the      | is readily          |                 |                  |
| child    | available,          |                 |                  |
| care     | complete, useful,   |                 |                  |
| program. | properly managed,   |                 |                  |
|          | maintained, and     |                 |                  |
|          | periodically        |                 |                  |
|          | updated.            |                 |                  |
+----------+---------------------+-----------------+------------------+
| 7\.      | Proper              |                 |                  |
| Ma       | classification and  |                 |                  |
| nagement | recording take      |                 |                  |
| ensures  | place throughout    |                 |                  |
| the      | the entire life     |                 |                  |
| proper   | cycle of each       |                 |                  |
| classi   | transaction or      |                 |                  |
| fication | event, including    |                 |                  |
| and      | authorization,      |                 |                  |
| timely   | initiation,         |                 |                  |
| r        | processing, and     |                 |                  |
| ecording | final               |                 |                  |
| of       | classification in   |                 |                  |
| sig      | summary records.    |                 |                  |
| nificant |                     |                 |                  |
| events   | Proper              |                 |                  |
| in the   | classification of   |                 |                  |
| child    | transactions and    |                 |                  |
| care     | events includes     |                 |                  |
| program. | appropriate         |                 |                  |
|          | organization and    |                 |                  |
|          | formatting of       |                 |                  |
|          | information on      |                 |                  |
|          | original documents  |                 |                  |
|          | (hardcopy or        |                 |                  |
|          | electronic) and     |                 |                  |
|          | summary records     |                 |                  |
|          | from which reports  |                 |                  |
|          | and statements are  |                 |                  |
|          | prepared.           |                 |                  |
|          |                     |                 |                  |
|          | The agency          |                 |                  |
|          | maintains accurate  |                 |                  |
|          | records to minimize |                 |                  |
|          | adjustments.        |                 |                  |
+----------+---------------------+-----------------+------------------+
| 8\.      | Managers review and |                 |                  |
| Ma       | maintain access     |                 |                  |
| nagement | restrictions,       |                 |                  |
| limits   | clearly assign      |                 |                  |
| access   | custody, and        |                 |                  |
| and      | communicate with    |                 |                  |
| assigns  | those responsible.  |                 |                  |
| custody  |                     |                 |                  |
| to       | Management compares |                 |                  |
| r        | resources with      |                 |                  |
| esources | records.            |                 |                  |
| and      |                     |                 |                  |
| records  |                     |                 |                  |
| within   |                     |                 |                  |
| the      |                     |                 |                  |
| child    |                     |                 |                  |
| care     |                     |                 |                  |
| program. |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 9\.      | Management          |                 |                  |
| Ma       | establishes         |                 |                  |
| nagement | appropriate         |                 |                  |
| ensures  | controls.           |                 |                  |
| that     |                     |                 |                  |
| policies | Management ensures  |                 |                  |
| and      | the terms of        |                 |                  |
| pr       | authorizations are  |                 |                  |
| ocedures | in accordance with  |                 |                  |
| are in   | directives, within  |                 |                  |
| place    | limitations         |                 |                  |
| for      | established by law  |                 |                  |
| adequate | and regulation, and |                 |                  |
| mo       | communicated to the |                 |                  |
| nitoring | sub-recipients,     |                 |                  |
| of       | vendor, or          |                 |                  |
| sub-rec  | provider.           |                 |                  |
| ipients, |                     |                 |                  |
| vendors, | Management          |                 |                  |
| or       | maintains written   |                 |                  |
| p        | documentation that  |                 |                  |
| roviders | is readily          |                 |                  |
| for      | available,          |                 |                  |
| co       | complete, useful,   |                 |                  |
| mpliance | properly managed,   |                 |                  |
| with     | maintained, and     |                 |                  |
| ap       | periodically        |                 |                  |
| plicable | updated.            |                 |                  |
| Federal  |                     |                 |                  |
| regu     |                     |                 |                  |
| lations. |                     |                 |                  |
+----------+---------------------+-----------------+------------------+

+-----------------------------------------------------------------------+
| **III. Control Activities Specific for Information Systems---General  |
| Control**                                                             |
+-----------------------------------------------------------------------+
| Many State agencies use information systems. This section of the      |
| Instrument addresses two areas of information systems Control         |
| Activities\--General Control and Application Control. Because         |
| internal controls within information technology affect any agency     |
| using those services, the elements and Criteria apply across the      |
| agency as a whole. However, States completing the Instrument need to  |
| pay particular attention to determine if controls are in place        |
| specifically for the child care system. The child care system         |
| includes any entity providing child care services under contract to   |
| the States.                                                           |
|                                                                       |
| The General Control subsection addresses the structure, policies, and |
| procedures that govern agencies\' computer operations. These elements |
| and criteria apply to all aspects of the agency's computer            |
| operations, ranging from mainframe, servers, and networks all the way |
| to the end user environment of personal computers, laptops, and other |
| devices.                                                              |
|                                                                       |
| The General Control section governs how States\' computer functions   |
| operate. This section examines six areas of the information systems   |
| general control activities:                                           |
|                                                                       |
| -   Entity wide security management program;                          |
|                                                                       |
| -   Access control;                                                   |
|                                                                       |
| -   Application software development and change;                      |
|                                                                       |
| -   System software control;                                          |
|                                                                       |
| -   Segregation of duties; and                                        |
|                                                                       |
| -   Service continuity.                                               |
|                                                                       |
| As with the other sections of this Instrument, these elements and     |
| criteria are a beginning point, They are not an all inclusive set of  |
| elements and criteria.                                                |
+-----------------------------------------------------------------------+
| **Entity-wide Security Management Program**                           |
+-----------------------------------------------------------------------+

+----------+---------------------+-----------------+------------------+
| **El     | **Criteria**        | **              | **               |
| ements** |                     | Documentation** | Findings/Results |
|          |                     |                 | & Suggested      |
|          |                     | **(Provide all  | Follow-up if     |
|          |                     | applicable      | Necessary**      |
|          |                     | d               |                  |
|          |                     | ocumentation)** |                  |
+==========+=====================+=================+==================+
| 1\. The  | Management performs |                 |                  |
| agency   | and documents risk  |                 |                  |
| peri     | assessments         |                 |                  |
| odically | regularly and       |                 |                  |
| performs | whenever systems,   |                 |                  |
| a        | facilities, or      |                 |                  |
| compre   | other conditions    |                 |                  |
| hensive, | change.             |                 |                  |
| hi       |                     |                 |                  |
| gh-level | Risk assessments    |                 |                  |
| as       | consider data       |                 |                  |
| sessment | sensitivity and     |                 |                  |
| of risks | integrity.          |                 |                  |
| to its   |                     |                 |                  |
| inf      | Management          |                 |                  |
| ormation | documents final     |                 |                  |
| systems, | risk determinations |                 |                  |
| i        | and managerial      |                 |                  |
| ncluding | approvals and keeps |                 |                  |
| its      | them on file.       |                 |                  |
| child    |                     |                 |                  |
| care     |                     |                 |                  |
| system.  |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 2\. The  | The agency security |                 |                  |
| agency   | plan includes       |                 |                  |
| has      | physical security   |                 |                  |
| d        | of all hardware,    |                 |                  |
| eveloped | software, and       |                 |                  |
| a plan   | peripheral          |                 |                  |
| that     | equipment, as well  |                 |                  |
| clearly  | as e-mail and       |                 |                  |
| d        | Internet access.    |                 |                  |
| escribes |                     |                 |                  |
| its      | A comprehensive set |                 |                  |
| security | of security         |                 |                  |
| program, | software is in      |                 |                  |
| p        | place and kept      |                 |                  |
| olicies, | current.            |                 |                  |
| and      |                     |                 |                  |
| pro      |                     |                 |                  |
| cedures. |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 3\.      | The agency has      |                 |                  |
| Ma       | established         |                 |                  |
| nagement | policies and        |                 |                  |
| est      | procedures for      |                 |                  |
| ablishes | managing the        |                 |                  |
| and      | security program.   |                 |                  |
| comm     |                     |                 |                  |
| unicates | The agency has a    |                 |                  |
| a        | mechanism to        |                 |                  |
| clearly  | examine the         |                 |                  |
| defined  | security procedures |                 |                  |
| s        | employed by child   |                 |                  |
| tructure | care contractors.   |                 |                  |
| for      |                     |                 |                  |
| impl     |                     |                 |                  |
| ementing |                     |                 |                  |
| and      |                     |                 |                  |
| managing |                     |                 |                  |
| the      |                     |                 |                  |
| security |                     |                 |                  |
| program  |                     |                 |                  |
| th       |                     |                 |                  |
| roughout |                     |                 |                  |
| the      |                     |                 |                  |
| agency   |                     |                 |                  |
| and its  |                     |                 |                  |
| con      |                     |                 |                  |
| tractors |                     |                 |                  |
| and      |                     |                 |                  |
| defines  |                     |                 |                  |
| security |                     |                 |                  |
| r        |                     |                 |                  |
| esponsib |                     |                 |                  |
| ilities. |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 4\. The  | The agency ensures  |                 |                  |
| agency   | that                |                 |                  |
| im       | security-related    |                 |                  |
| plements | personnel policies  |                 |                  |
| e        | are in place both   |                 |                  |
| ffective | internally and with |                 |                  |
| security | child care          |                 |                  |
| -related | contractors.        |                 |                  |
| p        |                     |                 |                  |
| ersonnel |                     |                 |                  |
| p        |                     |                 |                  |
| olicies. |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 5\. The  | The agency          |                 |                  |
| agency   | implements, tests,  |                 |                  |
| monitors | and monitors        |                 |                  |
| the      | security policy,    |                 |                  |
| security | compliance, and     |                 |                  |
| p        | corrective actions. |                 |                  |
| rogram's |                     |                 |                  |
| effec    |                     |                 |                  |
| tiveness |                     |                 |                  |
| and      |                     |                 |                  |
| makes    |                     |                 |                  |
| changes  |                     |                 |                  |
| as       |                     |                 |                  |
| needed.  |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| **Access |                     |                 |                  |
| C        |                     |                 |                  |
| ontrol** |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 1\. The  | The agency has a    |                 |                  |
| agency   | consistent policy   |                 |                  |
| cl       | in place to define  |                 |                  |
| assifies | critical and        |                 |                  |
| critical | sensitive           |                 |                  |
| and      | information.        |                 |                  |
| s        |                     |                 |                  |
| ensitive |                     |                 |                  |
| inf      |                     |                 |                  |
| ormation |                     |                 |                  |
| re       |                     |                 |                  |
| sources. |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 2\. The  | The agency has      |                 |                  |
| agency   | established         |                 |                  |
| has      | policies and        |                 |                  |
| est      | procedures to       |                 |                  |
| ablished | control and/or      |                 |                  |
| physical | detect unauthorized |                 |                  |
| and      | access to           |                 |                  |
| logical  | agency-computerized |                 |                  |
| controls | resources.          |                 |                  |
| to       |                     |                 |                  |
| prevent  |                     |                 |                  |
| or       |                     |                 |                  |
| detect   |                     |                 |                  |
| unau     |                     |                 |                  |
| thorized |                     |                 |                  |
| access.  |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 3\. The  | The agency has      |                 |                  |
| agency   | policies and        |                 |                  |
| monitors | procedures in place |                 |                  |
| inf      | to monitor, detect, |                 |                  |
| ormation | and investigate     |                 |                  |
| systems  | unauthorized access |                 |                  |
| access,  | to                  |                 |                  |
| inve     | agency-computerized |                 |                  |
| stigates | resources.          |                 |                  |
| apparent |                     |                 |                  |
| vio      | The agency had      |                 |                  |
| lations, | established         |                 |                  |
| and      | disciplinary        |                 |                  |
| takes    | procedures in place |                 |                  |
| app      | to address          |                 |                  |
| ropriate | unauthorized        |                 |                  |
| remedial | access.             |                 |                  |
| and      |                     |                 |                  |
| disc     |                     |                 |                  |
| iplinary |                     |                 |                  |
| action.  |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| **App    |                     |                 |                  |
| lication |                     |                 |                  |
| Software |                     |                 |                  |
| Dev      |                     |                 |                  |
| elopment |                     |                 |                  |
| and      |                     |                 |                  |
| Change   |                     |                 |                  |
| C        |                     |                 |                  |
| ontrol** |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 1\. The  |                     |                 |                  |
| agency   |                     |                 |                  |
| au       |                     |                 |                  |
| thorizes |                     |                 |                  |
| inf      |                     |                 |                  |
| ormation |                     |                 |                  |
| system   |                     |                 |                  |
| pr       |                     |                 |                  |
| ocessing |                     |                 |                  |
| features |                     |                 |                  |
| and      |                     |                 |                  |
| program  |                     |                 |                  |
| modifi   |                     |                 |                  |
| cations. |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 2\. The  |                     |                 |                  |
| agency   |                     |                 |                  |
| tests    |                     |                 |                  |
| and      |                     |                 |                  |
| approves |                     |                 |                  |
| new and  |                     |                 |                  |
| revised  |                     |                 |                  |
| s        |                     |                 |                  |
| oftware. |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 3\. The  |                     |                 |                  |
| agency   |                     |                 |                  |
| has      |                     |                 |                  |
| est      |                     |                 |                  |
| ablished |                     |                 |                  |
| pr       |                     |                 |                  |
| ocedures |                     |                 |                  |
| to       |                     |                 |                  |
| ensure   |                     |                 |                  |
| control  |                     |                 |                  |
| of its   |                     |                 |                  |
| software |                     |                 |                  |
| li       |                     |                 |                  |
| braries, |                     |                 |                  |
| i        |                     |                 |                  |
| ncluding |                     |                 |                  |
| l        |                     |                 |                  |
| abeling, |                     |                 |                  |
| access   |                     |                 |                  |
| restr    |                     |                 |                  |
| ictions, |                     |                 |                  |
| and use  |                     |                 |                  |
| of       |                     |                 |                  |
| inv      |                     |                 |                  |
| entories |                     |                 |                  |
| and      |                     |                 |                  |
| separate |                     |                 |                  |
| li       |                     |                 |                  |
| braries. |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| **System |                     |                 |                  |
| Software |                     |                 |                  |
| C        |                     |                 |                  |
| ontrol** |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 1\. The  |                     |                 |                  |
| agency   |                     |                 |                  |
| limits   |                     |                 |                  |
| access   |                     |                 |                  |
| to       |                     |                 |                  |
| system   |                     |                 |                  |
| and      |                     |                 |                  |
| d        |                     |                 |                  |
| ocuments |                     |                 |                  |
| autho    |                     |                 |                  |
| rization |                     |                 |                  |
| to       |                     |                 |                  |
| system   |                     |                 |                  |
| software |                     |                 |                  |
| based on |                     |                 |                  |
| job      |                     |                 |                  |
| r        |                     |                 |                  |
| esponsib |                     |                 |                  |
| ilities. |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 2\. The  |                     |                 |                  |
| agency   |                     |                 |                  |
| controls |                     |                 |                  |
| changes  |                     |                 |                  |
| made to  |                     |                 |                  |
| the      |                     |                 |                  |
| system   |                     |                 |                  |
| s        |                     |                 |                  |
| oftware. |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| **Seg    |                     |                 |                  |
| regation |                     |                 |                  |
| of       |                     |                 |                  |
| Duties** |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 1\. The  |                     |                 |                  |
| agency   |                     |                 |                  |
| est      |                     |                 |                  |
| ablishes |                     |                 |                  |
| access   |                     |                 |                  |
| controls |                     |                 |                  |
| to       |                     |                 |                  |
| enforce  |                     |                 |                  |
| seg      |                     |                 |                  |
| regation |                     |                 |                  |
| of       |                     |                 |                  |
| duties.  |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 2\. The  |                     |                 |                  |
| agency   |                     |                 |                  |
| e        |                     |                 |                  |
| xercises |                     |                 |                  |
| control  |                     |                 |                  |
| over     |                     |                 |                  |
| staff    |                     |                 |                  |
| ac       |                     |                 |                  |
| tivities |                     |                 |                  |
| using    |                     |                 |                  |
| formal   |                     |                 |                  |
| o        |                     |                 |                  |
| perating |                     |                 |                  |
| pro      |                     |                 |                  |
| cedures, |                     |                 |                  |
| supe     |                     |                 |                  |
| rvision, |                     |                 |                  |
| and      |                     |                 |                  |
| review.  |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| *        |                     |                 |                  |
| *Service |                     |                 |                  |
| Cont     |                     |                 |                  |
| inuity** |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 1\. The  | Management          |                 |                  |
| agency   | develops,           |                 |                  |
| ide      | documents, and      |                 |                  |
| ntifies, | tests a             |                 |                  |
| a        | comprehensive       |                 |                  |
| ssesses, | contingency plan.   |                 |                  |
| and      |                     |                 |                  |
| pri      |                     |                 |                  |
| oritizes |                     |                 |                  |
| computer |                     |                 |                  |
| op       |                     |                 |                  |
| erations |                     |                 |                  |
| and      |                     |                 |                  |
| su       |                     |                 |                  |
| pportive |                     |                 |                  |
| r        |                     |                 |                  |
| esources |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 2\. The  | The agency uses     |                 |                  |
| agency   | data and program    |                 |                  |
| takes    | backup procedures,  |                 |                  |
| steps to | including off-site  |                 |                  |
| prevent  | storage of backup   |                 |                  |
| and      | data, as well as    |                 |                  |
| minimize | environmental       |                 |                  |
| p        | controls, staff     |                 |                  |
| otential | training, and       |                 |                  |
| damage   | hardware            |                 |                  |
| and      | maintenance and     |                 |                  |
| inter    | management.         |                 |                  |
| ruption. |                     |                 |                  |
+----------+---------------------+-----------------+------------------+

+-----------------------------------------------------------------------+
| **III Control Activities Specific for Information                     |
| Systems---Application Control**                                       |
+-----------------------------------------------------------------------+
| Information Systems Application Controls attempt to measure the       |
| completeness, accuracy, and validity of all transactions that take    |
| place within the State's computer application. The controls include   |
| the computer programs themselves, as well as the policies and         |
| procedures that govern the operation of specific applications.        |
| States\'                                                              |
|                                                                       |
| reviews of the elements need to include a review of all contractors   |
| that provide child care services to ensure the adequacy of their      |
| internal controls.                                                    |
|                                                                       |
| Some elements in this section are self-explanatory. Associated        |
| criteria are not necessary.                                           |
|                                                                       |
| Four major factors make up the Information Systems Application        |
| Control activities. States need to consider the following:            |
|                                                                       |
| -   Authorization control;                                            |
|                                                                       |
| -   Completeness control;                                             |
|                                                                       |
| -   Accuracy control; and                                             |
|                                                                       |
| -   Control over integrity of processing and data files.              |
|                                                                       |
| As in previous sections, the elements and criteria provided here      |
| serve as a beginning point for States.                                |
+-----------------------------------------------------------------------+
| **Authorization Control**                                             |
+-----------------------------------------------------------------------+

+----------+---------------------+-----------------+------------------+
| **El     | **Criteria**        | **              | **               |
| ements** |                     | Documentation** | Findings/Results |
|          |                     |                 | & Suggested      |
|          |                     | **(Provide all  | Follow-up if     |
|          |                     | applicable      | Necessary**      |
|          |                     | d               |                  |
|          |                     | ocumentation)** |                  |
+==========+=====================+=================+==================+
| 1\. The  | Agency restricts    |                 |                  |
| agency   | access to           |                 |                  |
| requires | incomplete source   |                 |                  |
| and      | documents.          |                 |                  |
| controls |                     |                 |                  |
| au       | The agency          |                 |                  |
| thorized | sequentially        |                 |                  |
| access   | pre-numbers source  |                 |                  |
| to       | documents.          |                 |                  |
| source   |                     |                 |                  |
| do       | The agency requires |                 |                  |
| cuments. | authorizing         |                 |                  |
|          | signatures to get   |                 |                  |
|          | key source          |                 |                  |
|          | documents.          |                 |                  |
|          |                     |                 |                  |
|          | The agency uses     |                 |                  |
|          | batch control       |                 |                  |
|          | sheets for batch    |                 |                  |
|          | application         |                 |                  |
|          | systems, such as    |                 |                  |
|          | date, control       |                 |                  |
|          | number, number of   |                 |                  |
|          | documents, and      |                 |                  |
|          | control totals for  |                 |                  |
|          | key fields.         |                 |                  |
|          |                     |                 |                  |
|          | Supervisory or      |                 |                  |
|          | independent review  |                 |                  |
|          | of data occurs      |                 |                  |
|          | before entry into   |                 |                  |
|          | the application     |                 |                  |
|          | system.             |                 |                  |
+----------+---------------------+-----------------+------------------+
| 2\. Data | Data entry devices  |                 |                  |
| entry    | include: Desktop    |                 |                  |
| devices  | PC's, Laptops,      |                 |                  |
| have     | PDA's,              |                 |                  |
| re       | Blackberries,       |                 |                  |
| stricted | Tablet PC's, etc.   |                 |                  |
| access.  |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 3\. The  |                     |                 |                  |
| agency   |                     |                 |                  |
| uses     |                     |                 |                  |
| master   |                     |                 |                  |
| files    |                     |                 |                  |
| and      |                     |                 |                  |
| e        |                     |                 |                  |
| xception |                     |                 |                  |
| reports  |                     |                 |                  |
| to       |                     |                 |                  |
| ensure   |                     |                 |                  |
| proper   |                     |                 |                  |
| data     |                     |                 |                  |
| pr       |                     |                 |                  |
| ocessing |                     |                 |                  |
| author   |                     |                 |                  |
| ization. |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| **Comp   |                     |                 |                  |
| leteness |                     |                 |                  |
| C        |                     |                 |                  |
| ontrol** |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 1\. The  |                     |                 |                  |
| agency   |                     |                 |                  |
| enters   |                     |                 |                  |
| all      |                     |                 |                  |
| au       |                     |                 |                  |
| thorized |                     |                 |                  |
| tran     |                     |                 |                  |
| sactions |                     |                 |                  |
| into the |                     |                 |                  |
| computer |                     |                 |                  |
| for      |                     |                 |                  |
| pro      |                     |                 |                  |
| cessing. |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 2\. The  |                     |                 |                  |
| agency   |                     |                 |                  |
| performs |                     |                 |                  |
| timely   |                     |                 |                  |
| reconc   |                     |                 |                  |
| iliation |                     |                 |                  |
| to       |                     |                 |                  |
| verify   |                     |                 |                  |
| data     |                     |                 |                  |
| compl    |                     |                 |                  |
| eteness. |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| **       |                     |                 |                  |
| Accuracy |                     |                 |                  |
| C        |                     |                 |                  |
| ontrol** |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 1\.      | The agency data     |                 |                  |
| Features | system includes:    |                 |                  |
| of the   |                     |                 |                  |
| agency's | -   Data validation |                 |                  |
| data     |     and editing to  |                 |                  |
| system   |     identify        |                 |                  |
| co       |     erroneous data; |                 |                  |
| ntribute |                     |                 |                  |
| to data  | -   The ability to  |                 |                  |
| a        |     capture,        |                 |                  |
| ccuracy. |     report,         |                 |                  |
|          |     investigate,    |                 |                  |
|          |     and promptly    |                 |                  |
|          |     corrects        |                 |                  |
|          |     erroneous data; |                 |                  |
|          |     and             |                 |                  |
|          |                     |                 |                  |
|          | -   Staff review of |                 |                  |
|          |     output reports  |                 |                  |
|          |     to maintain     |                 |                  |
|          |     data accuracy   |                 |                  |
|          |     and validity.   |                 |                  |
+----------+---------------------+-----------------+------------------+
| *        |                     |                 |                  |
| *Control |                     |                 |                  |
| Over     |                     |                 |                  |
| I        |                     |                 |                  |
| ntegrity |                     |                 |                  |
| of       |                     |                 |                  |
| Pr       |                     |                 |                  |
| ocessing |                     |                 |                  |
| and Data |                     |                 |                  |
| Files**  |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 1\. The  | Computer routines   |                 |                  |
| agency   | include:            |                 |                  |
| ensures  |                     |                 |                  |
| that     | -   Procedures to   |                 |                  |
| pr       |     verify version  |                 |                  |
| oduction |     control;        |                 |                  |
| programs |                     |                 |                  |
| and data | -   Routines for    |                 |                  |
| files    |     checking        |                 |                  |
| used     |     internal file   |                 |                  |
| during   |     header labels   |                 |                  |
| pr       |     before          |                 |                  |
| ocessing |     processing; and |                 |                  |
| are      |                     |                 |                  |
| current. | -   Protection      |                 |                  |
|          |     against         |                 |                  |
|          |     concurrent file |                 |                  |
|          |     updates.        |                 |                  |
+----------+---------------------+-----------------+------------------+

+-----------------------------------------------------------------------+
| **IV. INFORMATION AND COMMUNICATIONS**                                |
+-----------------------------------------------------------------------+
| States must have relevant, reliable information---financial and       |
| non-financial---on relevant external and internal activities. This is |
| the basis for the fourth standard, Information and Communications.    |
| All of the communication tools and methods of processing information  |
| within the agency are part of this standard. Information and          |
| communication need to be broad based and accountable, whether the     |
| communication is done manually or automated. Communications must be   |
| reliable, continuous, appropriate, and secure. The elements and       |
| criteria contained in this standard are a way of measuring the degree |
| to which States are providing these types of communications.          |
|                                                                       |
| As with the other sections of this Instrument, the elements and       |
| criteria are a beginning point for States. They are not an all        |
| inclusive set of elements and criteria.                               |
+-----------------------------------------------------------------------+
| **Information**                                                       |
+-----------------------------------------------------------------------+

+----------+---------------------+-----------------+------------------+
| **El     | **Criteria**        | **              | **               |
| ements** |                     | Documentation** | Findings/Results |
|          |                     |                 | & Suggested      |
|          |                     | **(Provide all  | Follow-up if     |
|          |                     | applicable      | Necessary**      |
|          |                     | d               |                  |
|          |                     | ocumentation)** |                  |
+==========+=====================+=================+==================+
| 1\.      | The agency obtains  |                 |                  |
| Ma       | and reports to      |                 |                  |
| nagement | managers any        |                 |                  |
| c        | relevant internal   |                 |                  |
| ollects, | and external        |                 |                  |
| reviews, | information that    |                 |                  |
| and      | may affect the      |                 |                  |
| dis      | achievement of its  |                 |                  |
| tributes | missions, goal, and |                 |                  |
| internal | objectives,         |                 |                  |
| and      | particularly those  |                 |                  |
| external | related to          |                 |                  |
| per      | legislative or      |                 |                  |
| formance | regulatory          |                 |                  |
| info     | developments and    |                 |                  |
| rmation. | political or        |                 |                  |
|          | economic changes.   |                 |                  |
|          |                     |                 |                  |
|          | Management ensures  |                 |                  |
|          | information that:   |                 |                  |
|          |                     |                 |                  |
|          | -   Has been        |                 |                  |
|          |     analyzed;       |                 |                  |
|          |                     |                 |                  |
|          | -   Provides the    |                 |                  |
|          |     appropriate     |                 |                  |
|          |     level of        |                 |                  |
|          |     detail;         |                 |                  |
|          |                     |                 |                  |
|          | -   Is summarized   |                 |                  |
|          |     and presented   |                 |                  |
|          |     appropriately;  |                 |                  |
|          |                     |                 |                  |
|          | -   Is timely;      |                 |                  |
|          |                     |                 |                  |
|          | -   Is pertinent;   |                 |                  |
|          |     and             |                 |                  |
|          |                     |                 |                  |
|          | -   Contains        |                 |                  |
|          |     operational,    |                 |                  |
|          |     financial, and  |                 |                  |
|          |     budgetary       |                 |                  |
|          |     information.    |                 |                  |
+----------+---------------------+-----------------+------------------+
| **       |                     |                 |                  |
| Communic |                     |                 |                  |
| ations** |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 1\.      | Senior management   |                 |                  |
| Ma       | provides a clear    |                 |                  |
| nagement | message throughout  |                 |                  |
| ensures  | the agency that     |                 |                  |
| that     | internal control    |                 |                  |
| e        | responsibilities    |                 |                  |
| ffective | are important and   |                 |                  |
| internal | management takes    |                 |                  |
| commun   | them seriously.     |                 |                  |
| ications |                     |                 |                  |
| occurs   | Management clearly  |                 |                  |
| within   | communicates        |                 |                  |
| the      | specific duties to  |                 |                  |
| agency.  | staff members, so   |                 |                  |
|          | they understand the |                 |                  |
|          | relevant aspects of |                 |                  |
|          | internal control.   |                 |                  |
|          | This includes how   |                 |                  |
|          | their roles fit the |                 |                  |
|          | agency mission, and |                 |                  |
|          | how their work      |                 |                  |
|          | relates to the work |                 |                  |
|          | of others.          |                 |                  |
|          |                     |                 |                  |
|          | Staff are informed  |                 |                  |
|          | that, when the      |                 |                  |
|          | unexpected occurs   |                 |                  |
|          | in performing their |                 |                  |
|          | duties, they must   |                 |                  |
|          | be not only assess  |                 |                  |
|          | the event, but also |                 |                  |
|          | the underlying      |                 |                  |
|          | cause. Staff are    |                 |                  |
|          | informed that       |                 |                  |
|          | potential internal  |                 |                  |
|          | control weaknesses  |                 |                  |
|          | must be identified  |                 |                  |
|          | and corrected       |                 |                  |
|          | before they can do  |                 |                  |
|          | further harm to the |                 |                  |
|          | agency.             |                 |                  |
|          |                     |                 |                  |
|          | Communication       |                 |                  |
|          | processes allow the |                 |                  |
|          | easy flow of        |                 |                  |
|          | information down,   |                 |                  |
|          | across, and up the  |                 |                  |
|          | organization.       |                 |                  |
|          | Communication       |                 |                  |
|          | exists between      |                 |                  |
|          | functional          |                 |                  |
|          | activities, such as |                 |                  |
|          | between procurement |                 |                  |
|          | activities and      |                 |                  |
|          | production          |                 |                  |
|          | activities.         |                 |                  |
|          |                     |                 |                  |
|          | Staff understand    |                 |                  |
|          | that there will be  |                 |                  |
|          | no reprisals for    |                 |                  |
|          | reporting adverse   |                 |                  |
|          | information,        |                 |                  |
|          | improper conduct,   |                 |                  |
|          | or circumvention of |                 |                  |
|          | internal control    |                 |                  |
|          | activities.         |                 |                  |
|          |                     |                 |                  |
|          | Staff have          |                 |                  |
|          | procedures for      |                 |                  |
|          | recommending        |                 |                  |
|          | improvements in     |                 |                  |
|          | operations and      |                 |                  |
|          | management          |                 |                  |
|          | acknowledges good   |                 |                  |
|          | staff suggestions   |                 |                  |
|          | with meaningful     |                 |                  |
|          | recognition.        |                 |                  |
|          |                     |                 |                  |
|          | Management          |                 |                  |
|          | communicates        |                 |                  |
|          | frequently with     |                 |                  |
|          | internal oversight  |                 |                  |
|          | groups, such as     |                 |                  |
|          | senior management   |                 |                  |
|          | councils.           |                 |                  |
|          | Management keeps    |                 |                  |
|          | these groups        |                 |                  |
|          | informed about      |                 |                  |
|          | performance, risks, |                 |                  |
|          | major initiatives,  |                 |                  |
|          | and any other       |                 |                  |
|          | significant events. |                 |                  |
+----------+---------------------+-----------------+------------------+
| 2\.      | Management has open |                 |                  |
| Ma       | and effective       |                 |                  |
| nagement | communication       |                 |                  |
| ensures  | channels with       |                 |                  |
| that     | clients, suppliers, |                 |                  |
| e        | contractors,        |                 |                  |
| ffective | consultants, and    |                 |                  |
| external | others that can     |                 |                  |
| commun   | provide suggestions |                 |                  |
| ications | on quality and      |                 |                  |
| occur    | design of agency    |                 |                  |
| with     | products and        |                 |                  |
| groups   | services.           |                 |                  |
| that can |                     |                 |                  |
| have a   | Management clearly  |                 |                  |
| serious  | informs all outside |                 |                  |
| impact   | parties dealing     |                 |                  |
| on       | with the agency of  |                 |                  |
| p        | the agency's        |                 |                  |
| rograms, | ethical standards   |                 |                  |
| p        | and that the agency |                 |                  |
| rojects, | will not tolerate   |                 |                  |
| ope      | improper actions.   |                 |                  |
| rations, |                     |                 |                  |
| and      | Management          |                 |                  |
| other    | encourages          |                 |                  |
| act      | communication from  |                 |                  |
| ivities, | external parties,   |                 |                  |
| i        | such as Federal     |                 |                  |
| ncluding | agencies, State and |                 |                  |
| b        | local governments,  |                 |                  |
| udgeting | and other related   |                 |                  |
| and      | third parties,      |                 |                  |
| fi       | since these parties |                 |                  |
| nancing. | may be a source of  |                 |                  |
|          | information on how  |                 |                  |
|          | well internal       |                 |                  |
|          | controls are        |                 |                  |
|          | functioning.        |                 |                  |
|          |                     |                 |                  |
|          | Complaints or       |                 |                  |
|          | inquires are        |                 |                  |
|          | welcomed, since     |                 |                  |
|          | they can identify   |                 |                  |
|          | control problems.   |                 |                  |
|          |                     |                 |                  |
|          | Management makes    |                 |                  |
|          | certain that the    |                 |                  |
|          | advice and          |                 |                  |
|          | recommendations of  |                 |                  |
|          | auditors and        |                 |                  |
|          | evaluators are      |                 |                  |
|          | fully considered,   |                 |                  |
|          | and that the agency |                 |                  |
|          | implements actions  |                 |                  |
|          | to correct any      |                 |                  |
|          | problems or         |                 |                  |
|          | weaknesses          |                 |                  |
|          | identified.         |                 |                  |
+----------+---------------------+-----------------+------------------+
| **Forms  |                     |                 |                  |
| and      |                     |                 |                  |
| Means of |                     |                 |                  |
| Communic |                     |                 |                  |
| ations** |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 1\.      |                     |                 |                  |
| Ma       |                     |                 |                  |
| nagement |                     |                 |                  |
| uses     |                     |                 |                  |
| e        |                     |                 |                  |
| ffective |                     |                 |                  |
| methods  |                     |                 |                  |
| to       |                     |                 |                  |
| com      |                     |                 |                  |
| municate |                     |                 |                  |
| with     |                     |                 |                  |
| e        |                     |                 |                  |
| mployees |                     |                 |                  |
| and      |                     |                 |                  |
| others.  |                     |                 |                  |
+----------+---------------------+-----------------+------------------+
| 2\. The  | Agency integrates   |                 |                  |
| agency   | the IT strategic    |                 |                  |
| manages  | plan with the       |                 |                  |
| its      | agency plan to      |                 |                  |
| info     | assure:             |                 |                  |
| rmation, |                     |                 |                  |
| i        | -   Identifying     |                 |                  |
| ncluding |     emerging        |                 |                  |
| its      |     information     |                 |                  |
| inf      |     needs;          |                 |                  |
| ormation |                     |                 |                  |
| systems, | -   Utilizing       |                 |                  |
| to       |     advances in IT; |                 |                  |
| ensure   |                     |                 |                  |
| the      | -   Monitoring the  |                 |                  |
| us       |     quality of      |                 |                  |
| efulness |     data; and       |                 |                  |
| and      |                     |                 |                  |
| rel      | -   Committing      |                 |                  |
| iability |     sufficient      |                 |                  |
| of the   |     resources to    |                 |                  |
| inf      |     IT.             |                 |                  |
| ormation |                     |                 |                  |
| derived  |                     |                 |                  |
| from the |                     |                 |                  |
| systems. |                     |                 |                  |
+----------+---------------------+-----------------+------------------+

+----------+---------------------+-----------------+-----------------+---+
| **V.     |                     |                 |                 |   |
| MONI     |                     |                 |                 |   |
| TORING** |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| The last |                     |                 |                 |   |
| internal |                     |                 |                 |   |
| control  |                     |                 |                 |   |
| standard |                     |                 |                 |   |
| is       |                     |                 |                 |   |
| Mon      |                     |                 |                 |   |
| itoring. |                     |                 |                 |   |
| An       |                     |                 |                 |   |
| integral |                     |                 |                 |   |
| part of  |                     |                 |                 |   |
| the      |                     |                 |                 |   |
| child    |                     |                 |                 |   |
| care     |                     |                 |                 |   |
| program  |                     |                 |                 |   |
| is       |                     |                 |                 |   |
| mon      |                     |                 |                 |   |
| itoring, |                     |                 |                 |   |
| which    |                     |                 |                 |   |
| allows   |                     |                 |                 |   |
| the      |                     |                 |                 |   |
| States   |                     |                 |                 |   |
| to       |                     |                 |                 |   |
| examine  |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| evaluate |                     |                 |                 |   |
| the      |                     |                 |                 |   |
| per      |                     |                 |                 |   |
| formance |                     |                 |                 |   |
| of       |                     |                 |                 |   |
| contract |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| non-     |                     |                 |                 |   |
| contract |                     |                 |                 |   |
| p        |                     |                 |                 |   |
| roviders |                     |                 |                 |   |
| who      |                     |                 |                 |   |
| provide  |                     |                 |                 |   |
| child    |                     |                 |                 |   |
| care and |                     |                 |                 |   |
| other    |                     |                 |                 |   |
| related  |                     |                 |                 |   |
| s        |                     |                 |                 |   |
| ervices. |                     |                 |                 |   |
| This     |                     |                 |                 |   |
| standard |                     |                 |                 |   |
| provides |                     |                 |                 |   |
| elements |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| criteria |                     |                 |                 |   |
| to gauge |                     |                 |                 |   |
| the      |                     |                 |                 |   |
| effec    |                     |                 |                 |   |
| tiveness |                     |                 |                 |   |
| of the   |                     |                 |                 |   |
| program. |                     |                 |                 |   |
| The      |                     |                 |                 |   |
| standard |                     |                 |                 |   |
| also     |                     |                 |                 |   |
| a        |                     |                 |                 |   |
| ddresses |                     |                 |                 |   |
| the      |                     |                 |                 |   |
| effec    |                     |                 |                 |   |
| tiveness |                     |                 |                 |   |
| of       |                     |                 |                 |   |
| audits   |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| other    |                     |                 |                 |   |
| ongoing  |                     |                 |                 |   |
| mo       |                     |                 |                 |   |
| nitoring |                     |                 |                 |   |
| ac       |                     |                 |                 |   |
| tivities |                     |                 |                 |   |
| within   |                     |                 |                 |   |
| the      |                     |                 |                 |   |
| States.  |                     |                 |                 |   |
|          |                     |                 |                 |   |
| States   |                     |                 |                 |   |
| must     |                     |                 |                 |   |
| u        |                     |                 |                 |   |
| ndertake |                     |                 |                 |   |
| ongoing  |                     |                 |                 |   |
| mo       |                     |                 |                 |   |
| nitoring |                     |                 |                 |   |
| during   |                     |                 |                 |   |
| normal   |                     |                 |                 |   |
| op       |                     |                 |                 |   |
| erations |                     |                 |                 |   |
| as part  |                     |                 |                 |   |
| of their |                     |                 |                 |   |
| normal   |                     |                 |                 |   |
| business |                     |                 |                 |   |
| p        |                     |                 |                 |   |
| ractice. |                     |                 |                 |   |
| These    |                     |                 |                 |   |
| mo       |                     |                 |                 |   |
| nitoring |                     |                 |                 |   |
| ac       |                     |                 |                 |   |
| tivities |                     |                 |                 |   |
| include  |                     |                 |                 |   |
| regular  |                     |                 |                 |   |
| ma       |                     |                 |                 |   |
| nagement |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| sup      |                     |                 |                 |   |
| ervisory |                     |                 |                 |   |
| act      |                     |                 |                 |   |
| ivities, |                     |                 |                 |   |
| comp     |                     |                 |                 |   |
| arisons, |                     |                 |                 |   |
| reconcil |                     |                 |                 |   |
| iations, |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| other    |                     |                 |                 |   |
| actions  |                     |                 |                 |   |
| people   |                     |                 |                 |   |
| take in  |                     |                 |                 |   |
| pe       |                     |                 |                 |   |
| rforming |                     |                 |                 |   |
| their    |                     |                 |                 |   |
| duties.  |                     |                 |                 |   |
| Managers |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| sup      |                     |                 |                 |   |
| ervisors |                     |                 |                 |   |
| must     |                     |                 |                 |   |
| know     |                     |                 |                 |   |
| their    |                     |                 |                 |   |
| responsi |                     |                 |                 |   |
| bilities |                     |                 |                 |   |
| for      |                     |                 |                 |   |
| internal |                     |                 |                 |   |
| control  |                     |                 |                 |   |
| and they |                     |                 |                 |   |
| need to  |                     |                 |                 |   |
| make     |                     |                 |                 |   |
| control  |                     |                 |                 |   |
| mo       |                     |                 |                 |   |
| nitoring |                     |                 |                 |   |
| an       |                     |                 |                 |   |
| integral |                     |                 |                 |   |
| part of  |                     |                 |                 |   |
| their    |                     |                 |                 |   |
| regular  |                     |                 |                 |   |
| o        |                     |                 |                 |   |
| perating |                     |                 |                 |   |
| pr       |                     |                 |                 |   |
| ocesses. |                     |                 |                 |   |
| Separate |                     |                 |                 |   |
| eva      |                     |                 |                 |   |
| luations |                     |                 |                 |   |
| are a    |                     |                 |                 |   |
| way to   |                     |                 |                 |   |
| take a   |                     |                 |                 |   |
| fresh    |                     |                 |                 |   |
| look at  |                     |                 |                 |   |
| internal |                     |                 |                 |   |
| control  |                     |                 |                 |   |
| by       |                     |                 |                 |   |
| focusing |                     |                 |                 |   |
| directly |                     |                 |                 |   |
| on the   |                     |                 |                 |   |
| c        |                     |                 |                 |   |
| ontrol's |                     |                 |                 |   |
| effec    |                     |                 |                 |   |
| tiveness |                     |                 |                 |   |
| at a     |                     |                 |                 |   |
| specific |                     |                 |                 |   |
| time.    |                     |                 |                 |   |
| These    |                     |                 |                 |   |
| eva      |                     |                 |                 |   |
| luations |                     |                 |                 |   |
| may take |                     |                 |                 |   |
| the form |                     |                 |                 |   |
| of       |                     |                 |                 |   |
| self-as  |                     |                 |                 |   |
| sessment |                     |                 |                 |   |
| as well  |                     |                 |                 |   |
| as       |                     |                 |                 |   |
| review   |                     |                 |                 |   |
| of       |                     |                 |                 |   |
| control  |                     |                 |                 |   |
| design   |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| direct   |                     |                 |                 |   |
| testing, |                     |                 |                 |   |
| and may  |                     |                 |                 |   |
| include  |                     |                 |                 |   |
| the use  |                     |                 |                 |   |
| of this  |                     |                 |                 |   |
| ma       |                     |                 |                 |   |
| nagement |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| ev       |                     |                 |                 |   |
| aluation |                     |                 |                 |   |
| tool. In |                     |                 |                 |   |
| a        |                     |                 |                 |   |
| ddition, |                     |                 |                 |   |
| mo       |                     |                 |                 |   |
| nitoring |                     |                 |                 |   |
| includes |                     |                 |                 |   |
| policies |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| pr       |                     |                 |                 |   |
| ocedures |                     |                 |                 |   |
| for      |                     |                 |                 |   |
| ensuring |                     |                 |                 |   |
| that any |                     |                 |                 |   |
| audit    |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| review   |                     |                 |                 |   |
| findings |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| recomme  |                     |                 |                 |   |
| ndations |                     |                 |                 |   |
| are      |                     |                 |                 |   |
| brought  |                     |                 |                 |   |
| to the   |                     |                 |                 |   |
| a        |                     |                 |                 |   |
| ttention |                     |                 |                 |   |
| of       |                     |                 |                 |   |
| ma       |                     |                 |                 |   |
| nagement |                     |                 |                 |   |
| and are  |                     |                 |                 |   |
| resolved |                     |                 |                 |   |
| p        |                     |                 |                 |   |
| romptly. |                     |                 |                 |   |
| Managers |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| ev       |                     |                 |                 |   |
| aluators |                     |                 |                 |   |
| should   |                     |                 |                 |   |
| consider |                     |                 |                 |   |
| the      |                     |                 |                 |   |
| appropr  |                     |                 |                 |   |
| iateness |                     |                 |                 |   |
| of the   |                     |                 |                 |   |
| agency's |                     |                 |                 |   |
| internal |                     |                 |                 |   |
| control  |                     |                 |                 |   |
| mo       |                     |                 |                 |   |
| nitoring |                     |                 |                 |   |
| and the  |                     |                 |                 |   |
| degree   |                     |                 |                 |   |
| to which |                     |                 |                 |   |
| it helps |                     |                 |                 |   |
| them     |                     |                 |                 |   |
| ac       |                     |                 |                 |   |
| complish |                     |                 |                 |   |
| their    |                     |                 |                 |   |
| obj      |                     |                 |                 |   |
| ectives. |                     |                 |                 |   |
| Listed   |                     |                 |                 |   |
| below    |                     |                 |                 |   |
| are      |                     |                 |                 |   |
| factors  |                     |                 |                 |   |
| a user   |                     |                 |                 |   |
| might    |                     |                 |                 |   |
| c        |                     |                 |                 |   |
| onsider. |                     |                 |                 |   |
| The list |                     |                 |                 |   |
| is a     |                     |                 |                 |   |
| b        |                     |                 |                 |   |
| eginning |                     |                 |                 |   |
| point.   |                     |                 |                 |   |
| It is    |                     |                 |                 |   |
| not      |                     |                 |                 |   |
| all-in   |                     |                 |                 |   |
| clusive, |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| every    |                     |                 |                 |   |
| item     |                     |                 |                 |   |
| might    |                     |                 |                 |   |
| not      |                     |                 |                 |   |
| apply to |                     |                 |                 |   |
| every    |                     |                 |                 |   |
| agency   |                     |                 |                 |   |
| or       |                     |                 |                 |   |
| activity |                     |                 |                 |   |
| within   |                     |                 |                 |   |
| the      |                     |                 |                 |   |
| agency.  |                     |                 |                 |   |
| Even     |                     |                 |                 |   |
| though   |                     |                 |                 |   |
| some of  |                     |                 |                 |   |
| the      |                     |                 |                 |   |
| f        |                     |                 |                 |   |
| unctions |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| points   |                     |                 |                 |   |
| may be   |                     |                 |                 |   |
| su       |                     |                 |                 |   |
| bjective |                     |                 |                 |   |
| in       |                     |                 |                 |   |
| nature   |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| require  |                     |                 |                 |   |
| the use  |                     |                 |                 |   |
| of       |                     |                 |                 |   |
| j        |                     |                 |                 |   |
| udgment, |                     |                 |                 |   |
| they are |                     |                 |                 |   |
| i        |                     |                 |                 |   |
| mportant |                     |                 |                 |   |
| in       |                     |                 |                 |   |
| esta     |                     |                 |                 |   |
| blishing |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| mai      |                     |                 |                 |   |
| ntaining |                     |                 |                 |   |
| good     |                     |                 |                 |   |
| internal |                     |                 |                 |   |
| control  |                     |                 |                 |   |
| mo       |                     |                 |                 |   |
| nitoring |                     |                 |                 |   |
| policies |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| pro      |                     |                 |                 |   |
| cedures. |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| *        |                     |                 |                 |   |
| *Ongoing |                     |                 |                 |   |
| Moni     |                     |                 |                 |   |
| toring** |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| **El     | **Criteria**        | **              | **F             |   |
| ements** |                     | Documentation** | indings/Results |   |
|          |                     |                 | & Suggested     |   |
|          |                     | **(Provide all  | Follow-up if    |   |
|          |                     | applicable      | Necessary**     |   |
|          |                     | d               |                 |   |
|          |                     | ocumentation)** |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 1\.      | The agency's        |                 |                 |   |
| Ma       | monitoring          |                 |                 |   |
| nagement | includes:           |                 |                 |   |
| ensures  |                     |                 |                 |   |
| e        | -   Communication   |                 |                 |   |
| ffective |     to managers     |                 |                 |   |
| mo       |     regarding their |                 |                 |   |
| nitoring |                     |                 |                 |   |
| and      |    responsibilities |                 |                 |   |
| internal |     for internal    |                 |                 |   |
| control. |     control and     |                 |                 |   |
|          |     regular         |                 |                 |   |
|          |     monitoring; and |                 |                 |   |
|          |                     |                 |                 |   |
|          | -   Periodic        |                 |                 |   |
|          |     evaluation of   |                 |                 |   |
|          |     control         |                 |                 |   |
|          |     activities for  |                 |                 |   |
|          |     critical        |                 |                 |   |
|          |     operational and |                 |                 |   |
|          |     mission support |                 |                 |   |
|          |     systems.        |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 2\. The  |                     |                 |                 |   |
| agency   |                     |                 |                 |   |
| produces |                     |                 |                 |   |
| reports  |                     |                 |                 |   |
| used to  |                     |                 |                 |   |
| monitor  |                     |                 |                 |   |
| program  |                     |                 |                 |   |
| ac       |                     |                 |                 |   |
| tivities |                     |                 |                 |   |
| and to   |                     |                 |                 |   |
| identify |                     |                 |                 |   |
| inac     |                     |                 |                 |   |
| curacies |                     |                 |                 |   |
| or other |                     |                 |                 |   |
| issues   |                     |                 |                 |   |
| r        |                     |                 |                 |   |
| equiring |                     |                 |                 |   |
| fo       |                     |                 |                 |   |
| llow-up. |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 3\.      | Management          |                 |                 |   |
| Ma       | investigates        |                 |                 |   |
| nagement | customer complaints |                 |                 |   |
| monitors | for potential       |                 |                 |   |
| commun   | deficiencies.       |                 |                 |   |
| ications |                     |                 |                 |   |
| from     | Management uses     |                 |                 |   |
| external | communications and  |                 |                 |   |
| p        | reports from        |                 |                 |   |
| artners. | external partners   |                 |                 |   |
|          | as control          |                 |                 |   |
|          | monitoring          |                 |                 |   |
|          | techniques.         |                 |                 |   |
|          |                     |                 |                 |   |
|          | Management uses     |                 |                 |   |
|          | information from    |                 |                 |   |
|          | oversight groups    |                 |                 |   |
|          | about compliance or |                 |                 |   |
|          | internal control    |                 |                 |   |
|          | functions to        |                 |                 |   |
|          | identify problems   |                 |                 |   |
|          | requiring           |                 |                 |   |
|          | follow-up.          |                 |                 |   |
|          |                     |                 |                 |   |
|          | Management          |                 |                 |   |
|          | reassesses weak     |                 |                 |   |
|          | control activities. |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 4\.      | Management uses     |                 |                 |   |
| Ma       | automated edits and |                 |                 |   |
| nagement | checks and other    |                 |                 |   |
| uses the | activities to       |                 |                 |   |
| agency's | determine control   |                 |                 |   |
| organi   | accuracy and        |                 |                 |   |
| zational | completeness of     |                 |                 |   |
| s        | transaction         |                 |                 |   |
| tructure | processing.         |                 |                 |   |
| to       |                     |                 |                 |   |
| provide  | Management uses     |                 |                 |   |
| o        | separation of       |                 |                 |   |
| versight | duties and          |                 |                 |   |
| of       | responsibilities to |                 |                 |   |
| internal | help deter fraud.   |                 |                 |   |
| control  |                     |                 |                 |   |
| fu       |                     |                 |                 |   |
| nctions. |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 5\. The  |                     |                 |                 |   |
| agency's |                     |                 |                 |   |
| internal |                     |                 |                 |   |
| audit    |                     |                 |                 |   |
| de       |                     |                 |                 |   |
| partment |                     |                 |                 |   |
| is       |                     |                 |                 |   |
| a        |                     |                 |                 |   |
| vailable |                     |                 |                 |   |
| to       |                     |                 |                 |   |
| research |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| r        |                     |                 |                 |   |
| ecommend |                     |                 |                 |   |
| impr     |                     |                 |                 |   |
| ovements |                     |                 |                 |   |
| within   |                     |                 |                 |   |
| the      |                     |                 |                 |   |
| internal |                     |                 |                 |   |
| control  |                     |                 |                 |   |
| st       |                     |                 |                 |   |
| ructure. |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 6\.      | Management uses     |                 |                 |   |
| Ma       | information, and    |                 |                 |   |
| nagement | feedback concerning |                 |                 |   |
| meets    | internal control    |                 |                 |   |
| with     | from training and   |                 |                 |   |
| staff to | planning sessions   |                 |                 |   |
| receive  | and other meetings, |                 |                 |   |
| feedback | to address problems |                 |                 |   |
| on       | or strengthen the   |                 |                 |   |
| effec    | internal control    |                 |                 |   |
| tiveness | structure.          |                 |                 |   |
| of       |                     |                 |                 |   |
| internal | Management uses     |                 |                 |   |
| control. | staff suggestions   |                 |                 |   |
|          | In evaluating the   |                 |                 |   |
|          | effectiveness of    |                 |                 |   |
|          | internal controls.  |                 |                 |   |
|          |                     |                 |                 |   |
|          | Management          |                 |                 |   |
|          | encourages staff to |                 |                 |   |
|          | identify and report |                 |                 |   |
|          | internal control    |                 |                 |   |
|          | weaknesses.         |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 7\.      | Management uses     |                 |                 |   |
| Ma       | separate            |                 |                 |   |
| nagement | evaluations and     |                 |                 |   |
| uses     | audits to evaluate  |                 |                 |   |
| separate | significant agency  |                 |                 |   |
| eva      | or program changes. |                 |                 |   |
| luations |                     |                 |                 |   |
| or       | Management uses     |                 |                 |   |
| audits   | qualified staff or  |                 |                 |   |
| to       | external providers  |                 |                 |   |
| review   | to conduct separate |                 |                 |   |
| risk     | evaluations or      |                 |                 |   |
| as       | audits.             |                 |                 |   |
| sessment |                     |                 |                 |   |
| results, | Management          |                 |                 |   |
| effec    | considers risk      |                 |                 |   |
| tiveness | assessment results  |                 |                 |   |
| of       | and the             |                 |                 |   |
| ongoing  | effectiveness of    |                 |                 |   |
| mon      | ongoing monitoring  |                 |                 |   |
| itoring, | when determining    |                 |                 |   |
| and      | the scope and       |                 |                 |   |
| internal | frequency of        |                 |                 |   |
| c        | evaluations.        |                 |                 |   |
| ontrols. |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 8\.      | The agency's        |                 |                 |   |
| Ma       | methodologies may   |                 |                 |   |
| nagement | include:            |                 |                 |   |
| ensures  |                     |                 |                 |   |
| the      | -                   |                 |                 |   |
| effec    |    Self-assessment; |                 |                 |   |
| tiveness |                     |                 |                 |   |
| of       | -   Review of       |                 |                 |   |
| ev       |     control design; |                 |                 |   |
| aluation |                     |                 |                 |   |
| te       | -   Direct testing  |                 |                 |   |
| chniques |     of internal     |                 |                 |   |
| and      |     control         |                 |                 |   |
| metho    |     activities; and |                 |                 |   |
| dologies |                     |                 |                 |   |
| used.    | -                   |                 |                 |   |
|          |   Computer-assisted |                 |                 |   |
|          |     audit           |                 |                 |   |
|          |     techniques.     |                 |                 |   |
|          |                     |                 |                 |   |
|          | The agency's        |                 |                 |   |
|          | evaluation plan is: |                 |                 |   |
|          |                     |                 |                 |   |
|          | -   Coordinated     |                 |                 |   |
|          |     with            |                 |                 |   |
|          |     appropriate     |                 |                 |   |
|          |     parties;        |                 |                 |   |
|          |                     |                 |                 |   |
|          | -   Managed and     |                 |                 |   |
|          |     conducted by    |                 |                 |   |
|          |     qualified       |                 |                 |   |
|          |     staff; and      |                 |                 |   |
|          |                     |                 |                 |   |
|          | -   Well            |                 |                 |   |
|          |     documented.     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 9\. If   | The internal audit  |                 |                 |   |
| the      | department or like  |                 |                 |   |
| agency's | entity has          |                 |                 |   |
| internal | sufficient levels   |                 |                 |   |
| audit    | of competent and    |                 |                 |   |
| de       | experienced staff.  |                 |                 |   |
| partment |                     |                 |                 |   |
| conducts | The internal audit  |                 |                 |   |
| eval     | department or like  |                 |                 |   |
| uations, | entity is           |                 |                 |   |
| the      | independent and     |                 |                 |   |
| agency   | reports to the      |                 |                 |   |
| has      | highest levels      |                 |                 |   |
| su       | within the agency.  |                 |                 |   |
| fficient |                     |                 |                 |   |
| re       |                     |                 |                 |   |
| sources, |                     |                 |                 |   |
| ability, |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| indep    |                     |                 |                 |   |
| endence. |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 10\.     |                     |                 |                 |   |
| Ma       |                     |                 |                 |   |
| nagement |                     |                 |                 |   |
| promptly |                     |                 |                 |   |
| reports  |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| resolves |                     |                 |                 |   |
| defi     |                     |                 |                 |   |
| ciencies |                     |                 |                 |   |
| found    |                     |                 |                 |   |
| during   |                     |                 |                 |   |
| eval     |                     |                 |                 |   |
| uations. |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| **Audit  |                     |                 |                 |   |
| Reso     |                     |                 |                 |   |
| lution** |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 1\.      | Managers review and |                 |                 |   |
| Ma       | evaluate audit      |                 |                 |   |
| nagement | findings,           |                 |                 |   |
| ensures  | assessments, and    |                 |                 |   |
| prompt   | other reviews,      |                 |                 |   |
| re       | including those     |                 |                 |   |
| solution | showing             |                 |                 |   |
| of       | deficiencies and    |                 |                 |   |
| findings | those identifying   |                 |                 |   |
| from     | opportunities for   |                 |                 |   |
| audits   | improvements.       |                 |                 |   |
| and      |                     |                 |                 |   |
| other    | Management          |                 |                 |   |
| reviews. | determines the      |                 |                 |   |
|          | proper actions to   |                 |                 |   |
|          | take in response to |                 |                 |   |
|          | findings and        |                 |                 |   |
|          | recommendations.    |                 |                 |   |
|          |                     |                 |                 |   |
|          | Management takes    |                 |                 |   |
|          | corrective action   |                 |                 |   |
|          | within established  |                 |                 |   |
|          | time frames to      |                 |                 |   |
|          | resolve the         |                 |                 |   |
|          | deficiencies.       |                 |                 |   |
|          |                     |                 |                 |   |
|          | Management uses     |                 |                 |   |
|          | consultations with  |                 |                 |   |
|          | internal and        |                 |                 |   |
|          | external auditors   |                 |                 |   |
|          | and other reviewers |                 |                 |   |
|          | as appropriate.     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 2\.      | Senior management   |                 |                 |   |
| Ma       | evaluates findings  |                 |                 |   |
| nagement | and recommendations |                 |                 |   |
| responds | and determines the  |                 |                 |   |
| to       | appropriate         |                 |                 |   |
| findings | actions.            |                 |                 |   |
| and      |                     |                 |                 |   |
| recomme  | Management ensures  |                 |                 |   |
| ndations | implementation of   |                 |                 |   |
| of       | changes to internal |                 |                 |   |
| audits   | controls.           |                 |                 |   |
| and      |                     |                 |                 |   |
| other    | Senior management   |                 |                 |   |
| reviews  | reviews periodic    |                 |                 |   |
| and      | reports to ensure   |                 |                 |   |
| takes    | the quality and     |                 |                 |   |
| app      | timeliness of       |                 |                 |   |
| ropriate | resolution          |                 |                 |   |
| f        | decisions.          |                 |                 |   |
| ollow-up |                     |                 |                 |   |
| action.  |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+

[]{#__RefHeading___Toc165450429 .anchor}**Appendix N. STATE INTERNAL
CONTROL SELF-ASSESSMENT INSTRUMENT**

**(Original)**

**STATE INTERNAL CONTROL SELF-ASSESSMENT INSTRUMENT**

**STATE**

**DATE**

**STATE INTERNAL CONTROL SELF-ASSESSMENT INSTRUMENT**

  ------------------------ ---------------------- ------------------------
  **STATE TEAM (Insert                            
  State Name)**                                   

  (List all members of the                        
  State Team, their                               
  organization, title,                            
  Phone, Fax, and E-mail                          
  addresses)                                      

  NAME:                    ORGANIZATION/TITLE:    

  PHONE:                   FAX:                   E-MAIL:

  NAME:                    ORGANIZATION/TITLE:    

  PHONE:                   FAX:                   E-MAIL:

  NAME:                    ORGANIZATION/TITLE:    

  PHONE:                   FAX:                   E-MAIL:

  NAME:                    ORGANIZATION/TITLE:    

  PHONE:                   FAX:                   E-MAIL:

  NAME:                    ORGANIZATION/TITLE:    

  PHONE:                   FAX:                   E-MAIL:

  NAME:                    ORGANIZATION/TITLE:    

  PHONE:                   FAX:                   E-MAIL:

  NAME:                    ORGANIZATION/TITLE:    

  PHONE:                   FAX:                   E-MAIL:

  NAME:                    ORGANIZATION/TITLE:    

  PHONE:                   FAX:                   E-MAIL:

  NAME:                    ORGANIZATION/TITLE:    

  PHONE:                   FAX:                   E-MAIL:
  ------------------------ ---------------------- ------------------------

Add additional pages to capture all staff involved in the assessment
process.

+----------------------------------------------------------------------+---+
| **STATE INTERNAL CONTROL SELF-ASSESSMENT INSTRUMENT**                |   |
+----------------------------------------------------------------------+---+
| **GENERAL INSTRUCTIONS**                                             |   |
+----------------------------------------------------------------------+---+
| This tool is a State Internal Control Self-Assessment Instrument to  |   |
| be used for management control and evaluation of the Child Care      |   |
| program. The tool can be used to help both State and Federal         |   |
| managers determine how well an agency's internal controls are        |   |
| designed and functioning and help them to determine what, where, and |   |
| how improvements can be implemented. States can use this tool        |   |
| specifically for the Child Care Program or more broadly where the    |   |
| Child Care Program is one of many program components.                |   |
|                                                                      |   |
| The tool contains five sections corresponding to the five standards  |   |
| for internal control outlined by the General Accountability Office   |   |
| (GAO) in its document, GAO-01-1008G -- Internal Control Management   |   |
| and Evaluation Tool (8/01). The third standard, Control Activities,  |   |
| is further broken down into three additional sections, one dealing   |   |
| with Common Activities and two dealing with Information Systems. The |   |
| standards are:                                                       |   |
|                                                                      |   |
| -   Control Environment;                                             |   |
|                                                                      |   |
| -   Risk Assessment;                                                 |   |
|                                                                      |   |
| -   Control Activities:                                              |   |
|                                                                      |   |
|     -   Common Categories of Control Activities;                     |   |
|                                                                      |   |
|     -   Control Activities Specific for Information                  |   |
|         Systems---General Control;                                   |   |
|                                                                      |   |
|     -   Control Activities Specific for Information                  |   |
|         Systems---Application Control;                               |   |
|                                                                      |   |
| -   Information and Communications; and                              |   |
|                                                                      |   |
| -   Monitoring.                                                      |   |
|                                                                      |   |
| Each section contains a list of major elements and criteria for      |   |
| consideration when reviewing internal controls as they relate to the |   |
| particular standards. These elements represent some of the more      |   |
| important issues addressed by the standard. Included under each      |   |
| element are criteria that States should consider when addressing the |   |
| element. States should use the criteria to consider specific items   |   |
| that indicate the degree to which internal controls are functioning. |   |
|                                                                      |   |
| States need to evaluate how well their agency meets each element and |   |
| criterion and identify those areas where they may be deficient. The  |   |
| States should then take the opportunity to begin formulating a plan  |   |
| of action to address the identified deficiencies.                    |   |
|                                                                      |   |
| States should view this tool as a living document, a starting point  |   |
| that can fit the circumstances, conditions, and risks relevant to    |   |
| their agency. Not all of the elements or criteria will be applicable |   |
| for every agency. States should attempt to complete all of the       |   |
| sections, but should feel free to note those areas that they do not  |   |
| consider relevant. If a State chooses to use the tool to assess the  |   |
| whole agency, then the sections specific to Child Care (and other    |   |
| program areas) should be completed by the appropriate areas and the  |   |
| sections that apply to all areas (such as HR or IT) would be         |   |
| completed by those program areas.                                    |   |
|                                                                      |   |
| The goal is for this tool to be useful in assessing internal         |   |
| controls as they relate to the achievements of the objectives of the |   |
| agency, identifying areas of concern, and providing a documented way |   |
| of addressing those concerns. Ultimately, this tool can help States  |   |
| become more effective and efficient in their internal controls. This |   |
| tool may also be useful in identifying issues with respect to        |   |
| safeguarding assets from improper payments caused by mistakes,       |   |
| inadequate controls, fraud, waste, or abuse.                         |   |
+----------------------------------------------------------------------+---+
| **STATE INTERNAL CONTROL SELF-ASSESSMENT INSTRUMENT**                |   |
+----------------------------------------------------------------------+---+
| **I. CONTROL ENVIRONMENT**                                           |   |
+----------------------------------------------------------------------+---+
| The Control Environment is the first Internal Control Standard. This |   |
| standard addresses how the State establishes and maintains an        |   |
| environment throughout the organization that sets a positive and     |   |
| supportive attitude toward internal control and conscientious        |   |
| management. The State reviews and addresses each of the key factors  |   |
| that affect the accomplishment of this goal. State managers and      |   |
| evaluators consider each of these control environment factors as     |   |
| they determine if there is a positive control environment in their   |   |
| State.                                                               |   |
|                                                                      |   |
| States should view the elements and criteria contained in this       |   |
| Instrument as a beginning point and not as an all inclusive set of   |   |
| elements and criteria. Some of the elements and criteria are         |   |
| subjective in nature and require the State to use judgment when      |   |
| assessing them. States should examine each of the elements and       |   |
| criteria, as they are important and can help in achieving control    |   |
| environment effectiveness.                                           |   |
+----------------------------------------------------------------------+---+
| **Integrity and Ethical Values (CE_1)**                              |   |
+----------------------------------------------------------------------+---+

+------------+----------------------+-----------------+---------------+
| **         | **Criteria**         | **              | **Fin         |
| Elements** |                      | Documentation** | dings/Results |
|            |                      |                 | & Suggested   |
|            |                      | **(Provide all  | Follow-up if  |
|            |                      | applicable      | Necessary**   |
|            |                      | d               |               |
|            |                      | ocumentation)** |               |
+============+======================+=================+===============+
| 1\. The    | Codes of conduct are |                 |               |
| agency has | comprehensive in     |                 |               |
| e          | nature and include   |                 |               |
| stablished | such issues as       |                 |               |
| and uses a | appropriate use of   |                 |               |
| formal     | resources, conflicts |                 |               |
| code or    | of interest,         |                 |               |
| codes of   | political activities |                 |               |
| conduct    | of staff, acceptance |                 |               |
| and other  | of gifts or          |                 |               |
| policies   | donations or foreign |                 |               |
| com        | decorations, and use |                 |               |
| municating | of due professional  |                 |               |
| a          | care.                |                 |               |
| ppropriate |                      |                 |               |
| ethical    | The agency           |                 |               |
| and moral  | periodically reviews |                 |               |
| behavioral | codes of conduct and |                 |               |
| standards  | obtains signatures   |                 |               |
| and        | from all staff       |                 |               |
| addressing | members.             |                 |               |
| acceptable |                      |                 |               |
| o          | Staff members        |                 |               |
| perational | indicate that they   |                 |               |
| practices  | know what kind of    |                 |               |
| and        | behavior is          |                 |               |
| conflicts  | acceptable and       |                 |               |
| of         | unacceptable, what   |                 |               |
| interest.  | penalties            |                 |               |
|            | unacceptable         |                 |               |
|            | behavior may bring,  |                 |               |
|            | and what to do if    |                 |               |
|            | they become aware of |                 |               |
|            | unacceptable         |                 |               |
|            | behavior.            |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\. The    | Management           |                 |               |
| agency     | emphasizes the       |                 |               |
| e          | importance of        |                 |               |
| stablished | integrity and        |                 |               |
| an ethical | ethical values       |                 |               |
| culture at | through oral         |                 |               |
| the top of | communications in    |                 |               |
| the        | meetings, via        |                 |               |
| or         | one-on-one           |                 |               |
| ganization | discussions, and by  |                 |               |
| and it has | example in daily     |                 |               |
| been       | activities.          |                 |               |
| co         |                      |                 |               |
| mmunicated | Management takes     |                 |               |
| throughout | quick and            |                 |               |
| the        | appropriate action   |                 |               |
| agency.    | as soon as there are |                 |               |
|            | any signs that a     |                 |               |
|            | problem may exist.   |                 |               |
+------------+----------------------+-----------------+---------------+
| 3\. The    | Financial,           |                 |               |
| agency     | budgetary, and       |                 |               |
| ensures    | oper                 |                 |               |
| that it    | ational/programmatic |                 |               |
| employs    | reports to the       |                 |               |
| high       | Legislature, Federal |                 |               |
| ethical    | Government, and the  |                 |               |
| standards  | public are proper    |                 |               |
| in         | and accurate.        |                 |               |
| dealings   |                      |                 |               |
| with the   | Management           |                 |               |
| public,    | cooperates with      |                 |               |
| Le         | auditors and other   |                 |               |
| gislature, | evaluators,          |                 |               |
| staff,     | discloses known      |                 |               |
| suppliers, | problems to them,    |                 |               |
| auditors,  | and values their     |                 |               |
| and        | comments and         |                 |               |
| others.    | recommendations.     |                 |               |
|            |                      |                 |               |
|            | The agency has a     |                 |               |
|            | well-defined and     |                 |               |
|            | understood process   |                 |               |
|            | for dealing with     |                 |               |
|            | claims and concerns  |                 |               |
|            | in a timely and      |                 |               |
|            | appropriate manner.  |                 |               |
+------------+----------------------+-----------------+---------------+
| 4\.        | Management takes     |                 |               |
| Management | action when there    |                 |               |
| takes      | are intentional      |                 |               |
| a          | violations of        |                 |               |
| ppropriate | policies,            |                 |               |
| di         | procedures, or the   |                 |               |
| sciplinary | code(s) of conduct.  |                 |               |
| action in  |                      |                 |               |
| response   | Management           |                 |               |
| to         | communicates the     |                 |               |
| departures | types of             |                 |               |
| from       | disciplinary actions |                 |               |
| approved   | taken throughout the |                 |               |
| policies   | agency.              |                 |               |
| and        |                      |                 |               |
| procedures |                      |                 |               |
| or         |                      |                 |               |
| violations |                      |                 |               |
| of the     |                      |                 |               |
| code of    |                      |                 |               |
| conduct.   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 5\.        | Management provides  |                 |               |
| Management | guidance on when to  |                 |               |
| e          | intervene and the    |                 |               |
| stablishes | management levels    |                 |               |
| internal   | which may take such  |                 |               |
| controls   | action.              |                 |               |
| and        |                      |                 |               |
| int        | Management fully     |                 |               |
| ervention. | documents the        |                 |               |
|            | reasons for any      |                 |               |
|            | intervention or      |                 |               |
|            | overriding of        |                 |               |
|            | internal control and |                 |               |
|            | specific actions     |                 |               |
|            | taken.               |                 |               |
|            |                      |                 |               |
|            | Management prohibits |                 |               |
|            | overriding of        |                 |               |
|            | internal control by  |                 |               |
|            | low-level management |                 |               |
|            | staff except in      |                 |               |
|            | emergency            |                 |               |
|            | situations.          |                 |               |
|            | Notification and     |                 |               |
|            | documentation to     |                 |               |
|            | upper-level          |                 |               |
|            | management occurs    |                 |               |
|            | immediately.         |                 |               |
+------------+----------------------+-----------------+---------------+
| **         |                      |                 |               |
| Commitment |                      |                 |               |
| to         |                      |                 |               |
| Competence |                      |                 |               |
| (CE_2)**   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\.        | Management analyzes  |                 |               |
| Management | the tasks and        |                 |               |
| has        | competencies needed  |                 |               |
| identified | for particular jobs, |                 |               |
| and        | such things as the   |                 |               |
| defined    | level of judgment    |                 |               |
| the tasks  | required and the     |                 |               |
| required   | extent of            |                 |               |
| to         | supervision          |                 |               |
| accomplish | necessary.           |                 |               |
| particular |                      |                 |               |
| jobs.      | Management           |                 |               |
|            | establishes formal   |                 |               |
|            | job descriptions or  |                 |               |
|            | other means of       |                 |               |
|            | identifying and      |                 |               |
|            | defining specific    |                 |               |
|            | competencies         |                 |               |
|            | required for job     |                 |               |
|            | positions and keeps  |                 |               |
|            | them up-to-date.     |                 |               |
|            |                      |                 |               |
|            | Management           |                 |               |
|            | identifies the       |                 |               |
|            | knowledge, skills,   |                 |               |
|            | and abilities needed |                 |               |
|            | for various jobs and |                 |               |
|            | makes them known to  |                 |               |
|            | staff.               |                 |               |
|            |                      |                 |               |
|            | Evidence exists that |                 |               |
|            | the agency makes     |                 |               |
|            | every effort to      |                 |               |
|            | assure that staff    |                 |               |
|            | selected for various |                 |               |
|            | positions have the   |                 |               |
|            | requisite knowledge, |                 |               |
|            | skills, and          |                 |               |
|            | abilities.           |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\. The    | The agency provides  |                 |               |
| agency     | appropriate training |                 |               |
| provides   | program to meet the  |                 |               |
| training   | needs of staff.      |                 |               |
| and        |                      |                 |               |
| counseling | The agency           |                 |               |
| to help    | emphasizes the need  |                 |               |
| staff      | for continuing       |                 |               |
| maintain   | training and has a   |                 |               |
| and        | control mechanism to |                 |               |
| improve    | ensure that staff    |                 |               |
| job        | received appropriate |                 |               |
| c          | training.            |                 |               |
| ompetency. |                      |                 |               |
|            | Supervisors have the |                 |               |
|            | necessary training   |                 |               |
|            | and management       |                 |               |
|            | skills to provide    |                 |               |
|            | effective job        |                 |               |
|            | performance          |                 |               |
|            | counseling.          |                 |               |
|            |                      |                 |               |
|            | Management bases     |                 |               |
|            | performance          |                 |               |
|            | appraisals on an     |                 |               |
|            | assessment of        |                 |               |
|            | competencies and     |                 |               |
|            | clearly identifies   |                 |               |
|            | areas in which staff |                 |               |
|            | are performing well  |                 |               |
|            | and areas that need  |                 |               |
|            | improvement.         |                 |               |
|            |                      |                 |               |
|            | Management provides  |                 |               |
|            | staff candid and     |                 |               |
|            | constructive job     |                 |               |
|            | performance          |                 |               |
|            | counseling.          |                 |               |
+------------+----------------------+-----------------+---------------+
| **         |                      |                 |               |
| Management |                      |                 |               |
| Philosophy |                      |                 |               |
| and        |                      |                 |               |
| Operating  |                      |                 |               |
| Style      |                      |                 |               |
| (CE_3)**   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\.        |                      |                 |               |
| Management |                      |                 |               |
| analyzes   |                      |                 |               |
| the risks  |                      |                 |               |
| of new     |                      |                 |               |
| ventures   |                      |                 |               |
| or         |                      |                 |               |
| operations |                      |                 |               |
| and        |                      |                 |               |
| determines |                      |                 |               |
| a          |                      |                 |               |
| ppropriate |                      |                 |               |
| mitigation |                      |                 |               |
| and        |                      |                 |               |
| mi         |                      |                 |               |
| nimization |                      |                 |               |
| s          |                      |                 |               |
| trategies. |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\.        |                      |                 |               |
| Management |                      |                 |               |
| endorses   |                      |                 |               |
| the use of |                      |                 |               |
| perform    |                      |                 |               |
| ance-based |                      |                 |               |
| m          |                      |                 |               |
| anagement. |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 3\.        | Management analyzes  |                 |               |
| Management | patterns of staff    |                 |               |
| analyzes   | turnover, including  |                 |               |
| agency     | loss of key staff or |                 |               |
| staffing.  | excessive turnover.  |                 |               |
|            | Management develops  |                 |               |
|            | transitions plans.   |                 |               |
+------------+----------------------+-----------------+---------------+
| 4\.        | Management uses      |                 |               |
| Management | accounting,          |                 |               |
| supports   | financial, and       |                 |               |
| financial, | programmatic data    |                 |               |
| admin      | from its systems for |                 |               |
| istrative, | decision-making and  |                 |               |
| and        | performance          |                 |               |
| o          | evaluation.          |                 |               |
| perational |                      |                 |               |
| functions. | Management reviews   |                 |               |
|            | and coordinates      |                 |               |
|            | financial            |                 |               |
|            | management,          |                 |               |
|            | accounting           |                 |               |
|            | operations, and      |                 |               |
|            | budget with external |                 |               |
|            | entities.            |                 |               |
|            |                      |                 |               |
|            | Management supports  |                 |               |
|            | efforts to make      |                 |               |
|            | improvements in the  |                 |               |
|            | systems as           |                 |               |
|            | technology advances. |                 |               |
|            |                      |                 |               |
|            | Personnel operations |                 |               |
|            | have a high          |                 |               |
|            | priority.            |                 |               |
|            |                      |                 |               |
|            | Management supports  |                 |               |
|            | and uses the work of |                 |               |
|            | quality assurance,   |                 |               |
|            | internal audits,     |                 |               |
|            | external audits, and |                 |               |
|            | other evaluations    |                 |               |
|            | and studies.         |                 |               |
+------------+----------------------+-----------------+---------------+
| 5\.        |                      |                 |               |
| Management |                      |                 |               |
| safeguards |                      |                 |               |
| valuable   |                      |                 |               |
| assets and |                      |                 |               |
| i          |                      |                 |               |
| nformation |                      |                 |               |
| from       |                      |                 |               |
| un         |                      |                 |               |
| authorized |                      |                 |               |
| access or  |                      |                 |               |
| use.       |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 6\. Senior |                      |                 |               |
| management |                      |                 |               |
| and        |                      |                 |               |
| operati    |                      |                 |               |
| ng/program |                      |                 |               |
| management |                      |                 |               |
| interact   |                      |                 |               |
| to carry   |                      |                 |               |
| out the    |                      |                 |               |
| mission.   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 7\.        | Management is        |                 |               |
| Management | responsible for      |                 |               |
| ensures    | critical financial   |                 |               |
| sound      | reporting and        |                 |               |
| financial, | conservative         |                 |               |
| budgetary, | application of       |                 |               |
| and        | accounting           |                 |               |
| o          | principles and       |                 |               |
| perational | estimates.           |                 |               |
| pr         |                      |                 |               |
| ogrammatic | Management financial |                 |               |
| reporting. | and budgetary        |                 |               |
|            | information is       |                 |               |
|            | provided to the      |                 |               |
|            | appropriate          |                 |               |
|            | entities.            |                 |               |
|            |                      |                 |               |
|            | Management ensures   |                 |               |
|            | that short-term      |                 |               |
|            | goals are consistent |                 |               |
|            | with long term       |                 |               |
|            | strategies.          |                 |               |
+------------+----------------------+-----------------+---------------+
| **Orga     |                      |                 |               |
| nizational |                      |                 |               |
| Structure  |                      |                 |               |
| (CE_4)**   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\.        | Staff members        |                 |               |
| Management | understand their     |                 |               |
| defines    | areas of             |                 |               |
| and        | responsibility.      |                 |               |
| co         |                      |                 |               |
| mmunicates | Staff members        |                 |               |
| key areas  | understand their     |                 |               |
| of         | internal control     |                 |               |
| authority  | responsibilities.    |                 |               |
| and        |                      |                 |               |
| respo      |                      |                 |               |
| nsibility. |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\.        | The organization     |                 |               |
| Management | structure            |                 |               |
| e          | facilitates the flow |                 |               |
| stablishes | of information       |                 |               |
| clear      | throughout the       |                 |               |
| internal   | agency.              |                 |               |
| reporting  |                      |                 |               |
| rela       | Management makes     |                 |               |
| tionships. | staff aware of the   |                 |               |
|            | established          |                 |               |
|            | reporting            |                 |               |
|            | relationships.       |                 |               |
+------------+----------------------+-----------------+---------------+
| 3\.        |                      |                 |               |
| Management |                      |                 |               |
| pe         |                      |                 |               |
| riodically |                      |                 |               |
| evaluates  |                      |                 |               |
| the        |                      |                 |               |
| orga       |                      |                 |               |
| nizational |                      |                 |               |
| structure  |                      |                 |               |
| and makes  |                      |                 |               |
| necessary  |                      |                 |               |
| changes to |                      |                 |               |
| respond to |                      |                 |               |
| changing   |                      |                 |               |
| c          |                      |                 |               |
| onditions. |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 4\.        | Staff members have   |                 |               |
| Management | time to carry out    |                 |               |
| supports   | their duties and     |                 |               |
| a          | responsibilities.    |                 |               |
| ppropriate |                      |                 |               |
| staffing   | Staff members do not |                 |               |
| levels to  | have to work         |                 |               |
| carry out  | excessive overtime   |                 |               |
| the        | or outside the       |                 |               |
| mission of | ordinary workweek to |                 |               |
| the        | complete assigned    |                 |               |
| agency.    | tasks.               |                 |               |
|            |                      |                 |               |
|            | Management and       |                 |               |
|            | supervisors are not  |                 |               |
|            | fulfilling more than |                 |               |
|            | one role.            |                 |               |
+------------+----------------------+-----------------+---------------+
| **         |                      |                 |               |
| Assignment |                      |                 |               |
| of         |                      |                 |               |
| Authority  |                      |                 |               |
| and        |                      |                 |               |
| Resp       |                      |                 |               |
| onsibility |                      |                 |               |
| (CE_5)**   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\. The    | Management           |                 |               |
| agency     | communicates the     |                 |               |
| app        | assigned authority   |                 |               |
| ropriately | and responsibility   |                 |               |
| assigns    | to staff.            |                 |               |
| authority  |                      |                 |               |
| and        | Management holds     |                 |               |
| delegates  | individuals          |                 |               |
| resp       | accountable for      |                 |               |
| onsibility | decisions and        |                 |               |
| to the     | outcomes within      |                 |               |
| proper     | their responsibility |                 |               |
| staff.     | and authority.       |                 |               |
|            |                      |                 |               |
|            | Management has       |                 |               |
|            | effective procedures |                 |               |
|            | to monitor results.  |                 |               |
|            |                      |                 |               |
|            | Management           |                 |               |
|            | appropriately        |                 |               |
|            | balances the         |                 |               |
|            | delegation of        |                 |               |
|            | authority between    |                 |               |
|            | senior staff and     |                 |               |
|            | staff at lower       |                 |               |
|            | levels to get the    |                 |               |
|            | job done.            |                 |               |
+------------+----------------------+-----------------+---------------+
| **Human    |                      |                 |               |
| Resource   |                      |                 |               |
| Policies   |                      |                 |               |
| and        |                      |                 |               |
| Practices  |                      |                 |               |
| (CE_6)**   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\.        | Management           |                 |               |
| Policies   | participates in the  |                 |               |
| and        | hiring process.      |                 |               |
| procedures |                      |                 |               |
| are in     | Management ensures   |                 |               |
| place for  | that position        |                 |               |
| hiring,    | descriptions and     |                 |               |
| orienting, | qualifications meet  |                 |               |
| training,  | State Personnel      |                 |               |
| e          | rules and are        |                 |               |
| valuating, | standardized         |                 |               |
| c          | throughout the       |                 |               |
| ounseling, | agency for similar   |                 |               |
| promoting, | jobs.                |                 |               |
| com        |                      |                 |               |
| pensating, | Management           |                 |               |
| dis        | establishes a        |                 |               |
| ciplining, | training program     |                 |               |
| and        | that includes        |                 |               |
| t          | orientation programs |                 |               |
| erminating | for new staff and    |                 |               |
| staff.     | continuing education |                 |               |
|            | for all staff.       |                 |               |
|            |                      |                 |               |
|            | Management supports  |                 |               |
|            | promotion,           |                 |               |
|            | compensation, or     |                 |               |
|            | rotation of staff    |                 |               |
|            | based upon periodic  |                 |               |
|            | performance          |                 |               |
|            | appraisals.          |                 |               |
|            |                      |                 |               |
|            | Management links     |                 |               |
|            | performance          |                 |               |
|            | appraisals to its    |                 |               |
|            | goals and            |                 |               |
|            | objectives.          |                 |               |
|            |                      |                 |               |
|            | Performance          |                 |               |
|            | appraisal criteria   |                 |               |
|            | reflect the          |                 |               |
|            | importance of        |                 |               |
|            | integrity and        |                 |               |
|            | ethical values.      |                 |               |
|            |                      |                 |               |
|            | Staff receive        |                 |               |
|            | appropriate feedback |                 |               |
|            | and counseling on    |                 |               |
|            | their job            |                 |               |
|            | performance.         |                 |               |
|            |                      |                 |               |
|            | Management responds  |                 |               |
|            | to violations of     |                 |               |
|            | policies or ethical  |                 |               |
|            | standards with       |                 |               |
|            | appropriate          |                 |               |
|            | discipline or        |                 |               |
|            | remedial action.     |                 |               |
+------------+----------------------+-----------------+---------------+
| *          |                      |                 |               |
| *Oversight |                      |                 |               |
| Groups     |                      |                 |               |
| (CE_7)**   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\. The    | An independent       |                 |               |
| agency has | entity audits and    |                 |               |
| mechanisms | reviews agency       |                 |               |
| in place   | activity.            |                 |               |
| to monitor |                      |                 |               |
| and review | An audit committee   |                 |               |
| operations | or senior management |                 |               |
| and        | council reviews the  |                 |               |
| programs.  | internal audit work  |                 |               |
|            | and coordinates      |                 |               |
|            | closely with the     |                 |               |
|            | independent entity   |                 |               |
|            | and external         |                 |               |
|            | auditors.            |                 |               |
|            |                      |                 |               |
|            | The Internal audit   |                 |               |
|            | unit reports to the  |                 |               |
|            | agency head.         |                 |               |
|            |                      |                 |               |
|            | The internal audit   |                 |               |
|            | function reviews     |                 |               |
|            | agency activities    |                 |               |
|            | and systems and      |                 |               |
|            | provides             |                 |               |
|            | information,         |                 |               |
|            | analyses,            |                 |               |
|            | recommendations, and |                 |               |
|            | counsel to           |                 |               |
|            | management.          |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\. The    | The agency works     |                 |               |
| agency     | with the State's     |                 |               |
| works      | Budget Office and    |                 |               |
| closely    | key officials. The   |                 |               |
| with       | agency provides      |                 |               |
| Executive  | financial and        |                 |               |
| Branch     | budgetary reporting  |                 |               |
| oversight  | and information on   |                 |               |
| orga       | internal controls    |                 |               |
| nizations. | and management's     |                 |               |
|            | performance.         |                 |               |
|            |                      |                 |               |
|            | High-level agency    |                 |               |
|            | staff maintain good  |                 |               |
|            | working              |                 |               |
|            | relationships with   |                 |               |
|            | other executive      |                 |               |
|            | branch agencies that |                 |               |
|            | exercise             |                 |               |
|            | multi-agency control |                 |               |
|            | responsibilities.    |                 |               |
+------------+----------------------+-----------------+---------------+
| 3\. The    | The agency provides  |                 |               |
| agency     | the Legislature with |                 |               |
| maintains  | timely and accurate  |                 |               |
| a close    | information to allow |                 |               |
| re         | monitoring of agency |                 |               |
| lationship | activities. This     |                 |               |
| with the   | includes review of   |                 |               |
| Le         | the agency's mission |                 |               |
| gislature. | and goals, reports   |                 |               |
|            | on agency            |                 |               |
|            | performance, and     |                 |               |
|            | reports on finances  |                 |               |
|            | and operating        |                 |               |
|            | issues.              |                 |               |
|            |                      |                 |               |
|            | High-level agency    |                 |               |
|            | officials meet       |                 |               |
|            | regularly with staff |                 |               |
|            | from the Legislature |                 |               |
|            | and Governor's       |                 |               |
|            | office to discuss    |                 |               |
|            | major issues         |                 |               |
|            | affecting            |                 |               |
|            | operations, internal |                 |               |
|            | control,             |                 |               |
|            | performance, and     |                 |               |
|            | other issues         |                 |               |
|            | affecting major      |                 |               |
|            | agency activities    |                 |               |
|            | and programs.        |                 |               |
+------------+----------------------+-----------------+---------------+

+-----------------------------------------------------------------------+
| **II. RISK ASSESSMENT**                                               |
+-----------------------------------------------------------------------+
| The second internal control standard is Risk Assessment. Clear,       |
| consistent agency goals and objectives at both the agency and program |
| level are essential for the agency to operate efficiently and         |
| effectively. When an agency has established and articulated           |
| objectives, the agency may be able to identify actual or potential    |
| risks/problems---internal and external---that could impede the        |
| accomplishment of those objectives in an efficient manner. When an    |
| agency identifies potential risks/problems and their possible effect  |
| on the organization, they may be able to prevent those problems or    |
| reduce their impact. This section is designed to help agencies in     |
| this process.                                                         |
|                                                                       |
| Once again, this is not an all-inclusive list. It is a starting point |
| from which States can begin to build a dynamic assessment of actual   |
| or potential risks/ problems and mitigation strategies. Some of the   |
| elements and criteria are subjective in nature. Nevertheless, each of |
| the elements and criteria are important and it is recommended that    |
| the State examine them closely.                                       |
+-----------------------------------------------------------------------+
| **Establishment of Entity-wide Objectives (RA_1)**                    |
+-----------------------------------------------------------------------+

+------------+----------------------+-----------------+---------------+
| **         | **Criteria**         | **              | **Fin         |
| Elements** |                      | Documentation** | dings/Results |
|            |                      |                 | & Suggested   |
|            |                      | **(Provide all  | Follow-up if  |
|            |                      | applicable      | Necessary**   |
|            |                      | d               |               |
|            |                      | ocumentation)** |               |
+============+======================+=================+===============+
| 1\.        | Management           |                 |               |
| Management | establishes a        |                 |               |
| e          | strategic plan that  |                 |               |
| stablishes | includes agency      |                 |               |
| agency     | mission, goals, and  |                 |               |
| specific   | objectives.          |                 |               |
| o          |                      |                 |               |
| bjectives. | Management           |                 |               |
|            | establishes          |                 |               |
|            | objectives based on  |                 |               |
|            | program              |                 |               |
|            | requirements.        |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\.        |                      |                 |               |
| Management |                      |                 |               |
| co         |                      |                 |               |
| mmunicates |                      |                 |               |
| objectives |                      |                 |               |
| to all     |                      |                 |               |
| staff and  |                      |                 |               |
| obtains    |                      |                 |               |
| feedback.  |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 3\.        | Strategic plans      |                 |               |
| O          | address resource     |                 |               |
| perational | allocations and      |                 |               |
| strategies | priorities.          |                 |               |
| support    |                      |                 |               |
| e          | Management designs   |                 |               |
| ntity-wide | strategic plans and  |                 |               |
| o          | budgets with an      |                 |               |
| bjectives. | appropriate level of |                 |               |
|            | detail for various   |                 |               |
|            | management levels.   |                 |               |
+------------+----------------------+-----------------+---------------+
| 4\.        |                      |                 |               |
| Management |                      |                 |               |
| has an     |                      |                 |               |
| integrated |                      |                 |               |
| management |                      |                 |               |
| strategy,  |                      |                 |               |
| risk       |                      |                 |               |
| a          |                      |                 |               |
| ssessment, |                      |                 |               |
| and        |                      |                 |               |
| control    |                      |                 |               |
| structure  |                      |                 |               |
| to address |                      |                 |               |
| risks.     |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| **Est      |                      |                 |               |
| ablishment |                      |                 |               |
| of         |                      |                 |               |
| Activity   |                      |                 |               |
| (RA_2)**   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\.        | Management reviews   |                 |               |
| Program    | program strategies   |                 |               |
| strategies | periodically to      |                 |               |
| support    | assure that they     |                 |               |
| agency     | have continued       |                 |               |
| o          | relevance.           |                 |               |
| bjectives. |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\.        | Management           |                 |               |
| Program    | establishes program  |                 |               |
| strategies | strategies for the   |                 |               |
| are        | key operational and  |                 |               |
| relevant,  | support activities.  |                 |               |
| comp       |                      |                 |               |
| lementary. |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 3\.        |                      |                 |               |
| Program    |                      |                 |               |
| outcome    |                      |                 |               |
| criteria   |                      |                 |               |
| include    |                      |                 |               |
| mea        |                      |                 |               |
| surements. |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 4\.        |                      |                 |               |
| Management |                      |                 |               |
| allocates  |                      |                 |               |
| sufficient |                      |                 |               |
| resources  |                      |                 |               |
| to meet    |                      |                 |               |
| o          |                      |                 |               |
| bjectives. |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 5\.        | Management reviews   |                 |               |
| Management | and monitors         |                 |               |
| identifies | critical             |                 |               |
| and        | activity-level       |                 |               |
| reviews    | objectives           |                 |               |
| Mission    | regularly.           |                 |               |
| Critical   |                      |                 |               |
| program    |                      |                 |               |
| strategies |                      |                 |               |
| to address |                      |                 |               |
| o          |                      |                 |               |
| bjectives. |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| **Risk     |                      |                 |               |
| Iden       |                      |                 |               |
| tification |                      |                 |               |
| (RA_3)**   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\.        | Management uses      |                 |               |
| Management | qualitative and      |                 |               |
| identifies | quantitative methods |                 |               |
| risk using | to identify risk and |                 |               |
| a          | quantify relative    |                 |               |
| ppropriate | risk rankings on a   |                 |               |
| meth       | scheduled and        |                 |               |
| odologies. | periodic basis.      |                 |               |
|            |                      |                 |               |
|            | Risk identification  |                 |               |
|            | and discussion occur |                 |               |
|            | at all levels of the |                 |               |
|            | agency.              |                 |               |
|            |                      |                 |               |
|            | Risk identification  |                 |               |
|            | includes, but is not |                 |               |
|            | limited to, findings |                 |               |
|            | from audits,         |                 |               |
|            | evaluations, and     |                 |               |
|            | other assessments.   |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\.        | External factors     |                 |               |
| Management | include but are not  |                 |               |
| considers  | limited to:          |                 |               |
| external   |                      |                 |               |
| factors    | -   Technological    |                 |               |
| when       |     advancements and |                 |               |
| i          |     developments;    |                 |               |
| dentifying |                      |                 |               |
| risk.      | -   Changing needs   |                 |               |
|            |     or expectations  |                 |               |
|            |     of the           |                 |               |
|            |     Legislature,     |                 |               |
|            |     agency           |                 |               |
|            |     officials, and   |                 |               |
|            |     the public;      |                 |               |
|            |                      |                 |               |
|            | -   New legislation  |                 |               |
|            |     or regulations;  |                 |               |
|            |                      |                 |               |
|            | -   Natural          |                 |               |
|            |     catastrophes or  |                 |               |
|            |     criminal or      |                 |               |
|            |     terrorist        |                 |               |
|            |     actions;         |                 |               |
|            |                      |                 |               |
|            | -   Business,        |                 |               |
|            |     political, and   |                 |               |
|            |     economic         |                 |               |
|            |     changes;         |                 |               |
|            |                      |                 |               |
|            | -   Major suppliers  |                 |               |
|            |     and contractors; |                 |               |
|            |     and              |                 |               |
|            |                      |                 |               |
|            | -   Other entities.  |                 |               |
+------------+----------------------+-----------------+---------------+
| 3\.        | Internal factors     |                 |               |
| Management | include, but are not |                 |               |
| considers  | limited to:          |                 |               |
| internal   |                      |                 |               |
| factors    | -   Downsizing of    |                 |               |
| when       |     agency           |                 |               |
| i          |     operations and   |                 |               |
| dentifying |     staff;           |                 |               |
| risk.      |                      |                 |               |
|            | -   Business process |                 |               |
|            |     reengineering or |                 |               |
|            |     redesign of      |                 |               |
|            |     operating        |                 |               |
|            |     processes;       |                 |               |
|            |                      |                 |               |
|            | -   Disruption of    |                 |               |
|            |     information      |                 |               |
|            |     systems and      |                 |               |
|            |     disaster         |                 |               |
|            |     recovery plans;  |                 |               |
|            |                      |                 |               |
|            | -   Decentralized    |                 |               |
|            |     program          |                 |               |
|            |     operations;      |                 |               |
|            |                      |                 |               |
|            | -   Qualifications   |                 |               |
|            |     and training of  |                 |               |
|            |     staff;           |                 |               |
|            |                      |                 |               |
|            | -   Reliance on      |                 |               |
|            |     contractors or   |                 |               |
|            |     other parties to |                 |               |
|            |     perform critical |                 |               |
|            |     agency           |                 |               |
|            |     operations;      |                 |               |
|            |                      |                 |               |
|            | -   Major changes in |                 |               |
|            |     managerial       |                 |               |
|            |                      |                 |               |
|            |    responsibilities; |                 |               |
|            |                      |                 |               |
|            | -   Unusual staff    |                 |               |
|            |     access to        |                 |               |
|            |     vulnerable       |                 |               |
|            |     assets;          |                 |               |
|            |                      |                 |               |
|            | -   Succession       |                 |               |
|            |     planning and     |                 |               |
|            |     retention of key |                 |               |
|            |     staff;           |                 |               |
|            |                      |                 |               |
|            | -   Competitive      |                 |               |
|            |     compensation and |                 |               |
|            |     benefit          |                 |               |
|            |     programs; and    |                 |               |
|            |                      |                 |               |
|            | -   Availability and |                 |               |
|            |     adequacy of      |                 |               |
|            |     funding.         |                 |               |
+------------+----------------------+-----------------+---------------+
| 4\.        |                      |                 |               |
| Management |                      |                 |               |
| considers  |                      |                 |               |
| other risk |                      |                 |               |
| factors.   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| **Risk     |                      |                 |               |
| Analysis   |                      |                 |               |
| (RA_4)**   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\.        | Management sets      |                 |               |
| Management | specific tolerance   |                 |               |
| develops a | levels. Each agency  |                 |               |
| risk       | and program area are |                 |               |
| tolerance  | assigned specific    |                 |               |
| process.   | levels and expected  |                 |               |
|            | to implement control |                 |               |
|            | activities. They are |                 |               |
|            | also expected to     |                 |               |
|            | monitor results.     |                 |               |
+------------+----------------------+-----------------+---------------+
| **Managing |                      |                 |               |
| Risk       |                      |                 |               |
| During     |                      |                 |               |
| Change     |                      |                 |               |
| (RA_5)**   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\.        | Management gives     |                 |               |
| Management | special              |                 |               |
| has a      | consideration to:    |                 |               |
| mechanism  |                      |                 |               |
| for        | -   Staffing of key  |                 |               |
| reacting   |     positions or     |                 |               |
| to risks   |     staff turnover;  |                 |               |
| presented  |                      |                 |               |
| by changes | -   Introduction and |                 |               |
| that can   |     training of new  |                 |               |
| have a     |     or changed       |                 |               |
| dramatic   |     information      |                 |               |
| and        |     systems;         |                 |               |
| pervasive  |                      |                 |               |
| effect.    | -   Rapid growth and |                 |               |
|            |     expansion or     |                 |               |
|            |     rapid            |                 |               |
|            |     downsizing;      |                 |               |
|            |                      |                 |               |
|            | -   New              |                 |               |
|            |     technological    |                 |               |
|            |     developments;    |                 |               |
|            |                      |                 |               |
|            | -   New outputs or   |                 |               |
|            |     services; and    |                 |               |
|            |                      |                 |               |
|            | -   Geographical     |                 |               |
|            |     realignment.     |                 |               |
+------------+----------------------+-----------------+---------------+

+-----------------------------------------------------------------------+
| **III. CONTROL ACTIVITIES**                                           |
+-----------------------------------------------------------------------+
| Internal control activities are used by States to mitigate the risks  |
| identified during the risk assessment process. These activities are   |
| an integral part of the agency's planning, implementation, and review |
| processes. Internal control activities are essential to holding       |
| programs accountable for effective and efficient program results.     |
|                                                                       |
| Control includes a wide range of diverse activities, such as          |
| approvals, authorizations, verifications, reconciliations,            |
| performance reviews, security activities, and the production of       |
| records and documentation. They are guided by the agency's management |
| directives on how to address the risks associated with program        |
| missions and objectives. Therefore, a manager or evaluator will       |
| assess whether control activities are appropriate and adequate for    |
| the risk-assessment process and are being applied effectively and     |
| efficiently. This analysis would include controls for computerized    |
| information systems.                                                  |
|                                                                       |
| The control activities in one agency may vary considerably from those |
| used in another agency. This difference may result from (1)           |
| variations in missions, goals, and objectives of the agencies; (2)    |
| differences in agency environments and how in which they operate; (3) |
| differing degree of organizational complexity; (4) differences in     |
| agency histories and culture; and (5) variations in the risks each    |
| agency faces and is trying to mitigate. Even if two agencies have the |
| same missions, goals, objectives, and organizational structures, they |
| would probably use different control activities. Control activities   |
| vary by individual judgment, implementation strategies, and           |
| management approaches.^1^                                             |
|                                                                       |
| These elements and criteria are a beginning point. They are not an    |
| all inclusive set of elements and criteria.                           |
|                                                                       |
| ^1^ Government Accountability Office. (August 2001). *Internal        |
| Control Management and Evaluation Tool.* (GAO Publication No.         |
| GAO--01--1008G). Washington, DC: U.S. Government Printing Office.     |
+-----------------------------------------------------------------------+
| **General Application (CA_1)**                                        |
+-----------------------------------------------------------------------+

+------------+----------------------+-----------------+---------------+
| **         | **Criteria**         | **              | **Fin         |
| Elements** |                      | Documentation** | dings/Results |
|            |                      |                 | & Suggested   |
|            |                      | **(Provide all  | Follow-up if  |
|            |                      | applicable      | Necessary**   |
|            |                      | d               |               |
|            |                      | ocumentation)** |               |
+============+======================+=================+===============+
| 1\.        | Management           |                 |               |
| Management | establishes          |                 |               |
| e          | objectives and       |                 |               |
| stablishes | associated risks,    |                 |               |
| a          | identifies the       |                 |               |
| ppropriate | actions and control  |                 |               |
| policies,  | activities needed to |                 |               |
| p          | address the risks,   |                 |               |
| rocedures, | and directs their    |                 |               |
| t          | implementation.      |                 |               |
| echniques, |                      |                 |               |
| and        |                      |                 |               |
| mechanisms |                      |                 |               |
| with       |                      |                 |               |
| respect to |                      |                 |               |
| each of    |                      |                 |               |
| the        |                      |                 |               |
| agency's   |                      |                 |               |
| activities |                      |                 |               |
| and those  |                      |                 |               |
| activities |                      |                 |               |
| related to |                      |                 |               |
| the Child  |                      |                 |               |
| Care       |                      |                 |               |
| Program.   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\. For    | Staff applies        |                 |               |
| identified | control activities   |                 |               |
| control    | properly and         |                 |               |
| a          | understands their    |                 |               |
| ctivities, | purpose.             |                 |               |
| management |                      |                 |               |
| evaluates  | Staff review         |                 |               |
| their      | established control  |                 |               |
| agency's   | activities and       |                 |               |
| overall    | provide input.       |                 |               |
| activities |                      |                 |               |
| and those  | Management takes     |                 |               |
| activities | timely action on     |                 |               |
| related to | exceptions,          |                 |               |
| the Child  | implementation       |                 |               |
| Care       | problems, or         |                 |               |
| Program.   | information that     |                 |               |
|            | requires follow-up.  |                 |               |
+------------+----------------------+-----------------+---------------+
| **Common   |                      |                 |               |
| Categories |                      |                 |               |
| of Control |                      |                 |               |
| Activities |                      |                 |               |
| (CA_2)**   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\. Senior | Senior management    |                 |               |
| management | regularly reviews    |                 |               |
| tracks     | actual performance   |                 |               |
| major      | against budgets,     |                 |               |
| agency     | forecasts, and prior |                 |               |
| ac         | period results and   |                 |               |
| hievements | compliance with      |                 |               |
| in         | applicable Federal   |                 |               |
| relation   | regulations.         |                 |               |
| to its     |                      |                 |               |
| plans with | Senior management    |                 |               |
| respect to | develops performance |                 |               |
| each of    | plans, measures and  |                 |               |
| the        | reports results, and |                 |               |
| agency's   | takes follow-up      |                 |               |
| overall    | action as necessary. |                 |               |
| activities |                      |                 |               |
| and those  |                      |                 |               |
| activities |                      |                 |               |
| related to |                      |                 |               |
| the Child  |                      |                 |               |
| Care       |                      |                 |               |
| Program.   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\.        | Managers at all      |                 |               |
| Management | levels review        |                 |               |
| reviews    | performance reports, |                 |               |
| p          | analyze trends,      |                 |               |
| erformance | measure results and  |                 |               |
| with       | compliance with the  |                 |               |
| respect to | ACF approved State   |                 |               |
| each of    | plan.                |                 |               |
| the        |                      |                 |               |
| agency's   | Financial and        |                 |               |
| overall    | program managers     |                 |               |
| activities | review and compare   |                 |               |
| and those  | financial,           |                 |               |
| activities | budgetary, Federal   |                 |               |
| related to | financial            |                 |               |
| the Child  | compliance, and      |                 |               |
| Care       | operational          |                 |               |
| Program.   | performance to       |                 |               |
|            | planned or expected  |                 |               |
|            | results.             |                 |               |
|            |                      |                 |               |
|            | Managers use         |                 |               |
|            | appropriate control  |                 |               |
|            | activities such as   |                 |               |
|            | reconciling summary  |                 |               |
|            | information to       |                 |               |
|            | supporting detail    |                 |               |
|            | and checking the     |                 |               |
|            | accuracy of          |                 |               |
|            | summaries.           |                 |               |
+------------+----------------------+-----------------+---------------+
| 3\. The    | Management           |                 |               |
| agency     | incorporates the     |                 |               |
| e          | agency mission,      |                 |               |
| ffectively | goals, and values in |                 |               |
| manages    | its strategic plan   |                 |               |
| the        | and other guiding    |                 |               |
| orga       | documents and        |                 |               |
| nization's | communicates this    |                 |               |
| workforce  | information to all   |                 |               |
| to achieve | staff.               |                 |               |
| results    |                      |                 |               |
| with       | The agency has a     |                 |               |
| respect to | workforce planning   |                 |               |
| each of    | strategy which       |                 |               |
| the        | identifies current   |                 |               |
| agency's   | and future staffing  |                 |               |
| overall    | needs.               |                 |               |
| activities |                      |                 |               |
| and those  | The agency has a     |                 |               |
| activities | process in place to  |                 |               |
| related to | ensure performance   |                 |               |
| the Child  | management and       |                 |               |
| Care       | compliance with      |                 |               |
| Program.   | applicable Federal   |                 |               |
|            | regulations.         |                 |               |
|            |                      |                 |               |
|            | The agency has a     |                 |               |
|            | formal recruiting,   |                 |               |
|            | hiring, and          |                 |               |
|            | retention process to |                 |               |
|            | ensure a competent   |                 |               |
|            | workforce.           |                 |               |
|            |                      |                 |               |
|            | The agency provides  |                 |               |
|            | orientation,         |                 |               |
|            | training, and tools  |                 |               |
|            | for staff to perform |                 |               |
|            | their duties and     |                 |               |
|            | responsibilities,    |                 |               |
|            | improve performance, |                 |               |
|            | enhance their        |                 |               |
|            | capabilities, and    |                 |               |
|            | meet the demands of  |                 |               |
|            | changing             |                 |               |
|            | organizational       |                 |               |
|            | needs.               |                 |               |
|            |                      |                 |               |
|            | The compensation     |                 |               |
|            | system is adequate   |                 |               |
|            | to acquire,          |                 |               |
|            | motivate, and retain |                 |               |
|            | staff. Staff receive |                 |               |
|            | incentives and       |                 |               |
|            | rewards to encourage |                 |               |
|            | them to perform at   |                 |               |
|            | maximum capability.  |                 |               |
|            |                      |                 |               |
|            | The agency provides  |                 |               |
|            | workplace            |                 |               |
|            | flexibilities,       |                 |               |
|            | services, and        |                 |               |
|            | facilities (e.g.,    |                 |               |
|            | career counseling,   |                 |               |
|            | flextime,            |                 |               |
|            | casual-dress days,   |                 |               |
|            | and child care) to   |                 |               |
|            | help it compete for  |                 |               |
|            | talent and enhance   |                 |               |
|            | staff satisfaction   |                 |               |
|            | and commitment.      |                 |               |
|            |                      |                 |               |
|            | The agency provides  |                 |               |
|            | qualified and        |                 |               |
|            | continuous           |                 |               |
|            | supervision to       |                 |               |
|            | ensure the           |                 |               |
|            | achievement of       |                 |               |
|            | internal control     |                 |               |
|            | objectives.          |                 |               |
|            |                      |                 |               |
|            | Management provides  |                 |               |
|            | timely, meaningful,  |                 |               |
|            | honest, and          |                 |               |
|            | constructive         |                 |               |
|            | performance          |                 |               |
|            | evaluations and      |                 |               |
|            | feedback to help     |                 |               |
|            | staff. This is       |                 |               |
|            | designed to help     |                 |               |
|            | staff understand the |                 |               |
|            | connection between   |                 |               |
|            | their performance    |                 |               |
|            | and the achievement  |                 |               |
|            | of the agency's      |                 |               |
|            | goals.               |                 |               |
|            |                      |                 |               |
|            | Management conducts  |                 |               |
|            | succession planning  |                 |               |
|            | to ensure continuity |                 |               |
|            | of needed skills and |                 |               |
|            | abilities.           |                 |               |
+------------+----------------------+-----------------+---------------+
| 4\. The    | Edit checks are used |                 |               |
| agency     | in controlling data  |                 |               |
| uses a     | entry.               |                 |               |
| variety of |                      |                 |               |
| control    | The system performs  |                 |               |
| activities | accounting for       |                 |               |
| suited to  | transactions in      |                 |               |
| i          | numerical sequences. |                 |               |
| nformation |                      |                 |               |
| processing | The system performs  |                 |               |
| systems to | file totals that     |                 |               |
| ensure     | compares control     |                 |               |
| accuracy   | accounts.            |                 |               |
| and        |                      |                 |               |
| co         | The system           |                 |               |
| mpleteness | identifies           |                 |               |
| with       | exceptions or        |                 |               |
| respect to | violations indicated |                 |               |
| each of    | by other control     |                 |               |
| the        | activities for       |                 |               |
| agency's   | further management   |                 |               |
| overall    | review and action.   |                 |               |
| activities |                      |                 |               |
| and those  |                      |                 |               |
| activities |                      |                 |               |
| related to |                      |                 |               |
| the Child  |                      |                 |               |
| Care       |                      |                 |               |
| Program.   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 5\. The    | The agency has       |                 |               |
| agency     | physical             |                 |               |
| employs    | safeguarding         |                 |               |
| physical   | policies and         |                 |               |
| control to | procedures           |                 |               |
| secure and | developed,           |                 |               |
| safeguard  | implemented, and     |                 |               |
| vulnerable | communicated to      |                 |               |
| assets     | staff.               |                 |               |
| with       |                      |                 |               |
| respect to | The agency regularly |                 |               |
| each of    | updates and          |                 |               |
| the        | communicates its     |                 |               |
| agency's   | disaster recovery    |                 |               |
| overall    | plan to staff.       |                 |               |
| activities |                      |                 |               |
| and those  | The agency secures   |                 |               |
| activities | and controls         |                 |               |
| related to | vulnerable assets    |                 |               |
| the Child  | such as cash,        |                 |               |
| Care       | securities,          |                 |               |
| Program.   | supplies,            |                 |               |
|            | inventories, and     |                 |               |
|            | equipment.           |                 |               |
|            |                      |                 |               |
|            | The agency           |                 |               |
|            | periodically counts  |                 |               |
|            | assets and compares  |                 |               |
|            | the count to control |                 |               |
|            | records and          |                 |               |
|            | exceptions such as   |                 |               |
|            | cash, securities,    |                 |               |
|            | supplies,            |                 |               |
|            | inventories, and     |                 |               |
|            | equipment.           |                 |               |
|            |                      |                 |               |
|            | The agency maintains |                 |               |
|            | cash and negotiable  |                 |               |
|            | securities under     |                 |               |
|            | lock and key with    |                 |               |
|            | access strictly      |                 |               |
|            | controlled.          |                 |               |
|            |                      |                 |               |
|            | Forms such as blank  |                 |               |
|            | checks and purchase  |                 |               |
|            | orders are           |                 |               |
|            | sequentially         |                 |               |
|            | pre-numbered,        |                 |               |
|            | physically secured,  |                 |               |
|            | and access to them   |                 |               |
|            | is strictly          |                 |               |
|            | controlled.          |                 |               |
|            |                      |                 |               |
|            | Inventories,         |                 |               |
|            | supplies, and        |                 |               |
|            | finished items/goods |                 |               |
|            | are stored in        |                 |               |
|            | physically secured   |                 |               |
|            | areas and protected  |                 |               |
|            | from damage.         |                 |               |
|            |                      |                 |               |
|            | The agency secures   |                 |               |
|            | facilities from fire |                 |               |
|            | with fire alarms and |                 |               |
|            | sprinkler systems.   |                 |               |
|            |                      |                 |               |
|            | The agency controls  |                 |               |
|            | access to premises   |                 |               |
|            | and facilities.      |                 |               |
+------------+----------------------+-----------------+---------------+
| 6\. The    | The agency           |                 |               |
| agency has | periodically reviews |                 |               |
| e          | and validates the    |                 |               |
| stablished | propriety and        |                 |               |
| and        | integrity of both    |                 |               |
| monitors   | organizational and   |                 |               |
| p          | individual           |                 |               |
| erformance | performance measures |                 |               |
| measures   | and indicators.      |                 |               |
| and        |                      |                 |               |
| indicators | The agency           |                 |               |
| with       | periodically reviews |                 |               |
| respect to | and ensures that     |                 |               |
| each of    | organizational and   |                 |               |
| the        | individual           |                 |               |
| agency's   | performance measures |                 |               |
| overall    | link to agency       |                 |               |
| activities | mission, goals, and  |                 |               |
| and those  | objectives, while    |                 |               |
| activities | complying with law,  |                 |               |
| related to | regulations, and     |                 |               |
| the Child  | ethical standards.   |                 |               |
| Care       |                      |                 |               |
| Program.   | The agency analyzes  |                 |               |
|            | and reviews          |                 |               |
|            | performance measures |                 |               |
|            | and indicators for   |                 |               |
|            | both operational and |                 |               |
|            | financial reporting  |                 |               |
|            | control purposes.    |                 |               |
|            |                      |                 |               |
|            | The agency compares  |                 |               |
|            | actual performance   |                 |               |
|            | data with expected   |                 |               |
|            | outcomes and         |                 |               |
|            | differences. The     |                 |               |
|            | agency takes         |                 |               |
|            | corrective action if |                 |               |
|            | necessary.           |                 |               |
|            |                      |                 |               |
|            | The agency compares  |                 |               |
|            | different sets of    |                 |               |
|            | data to one another  |                 |               |
|            | to analyze their     |                 |               |
|            | relationships and    |                 |               |
|            | implement corrective |                 |               |
|            | actions if           |                 |               |
|            | necessary.           |                 |               |
+------------+----------------------+-----------------+---------------+
| 7\.        | The agency does not  |                 |               |
| Management | allow one individual |                 |               |
| divides    | to control all key   |                 |               |
| key duties | aspects of a         |                 |               |
| and        | transaction or       |                 |               |
| respon     | event.               |                 |               |
| sibilities |                      |                 |               |
| among      | Examples include:    |                 |               |
| different  |                      |                 |               |
| people to  | -   Separation of    |                 |               |
| reduce the |     responsibilities |                 |               |
| risk of    |     and duties       |                 |               |
| error,     |     involving        |                 |               |
| waste, or  |     transactions and |                 |               |
| fraud and  |     events among     |                 |               |
| those      |     different staff  |                 |               |
| activities |     with respect to  |                 |               |
| related to |     authorization,   |                 |               |
| the Child  |     approval,        |                 |               |
| Care       |     processing and   |                 |               |
| Program.   |     recording,       |                 |               |
|            |     making payments  |                 |               |
|            |     or receiving     |                 |               |
|            |     funds, review    |                 |               |
|            |     and auditing,    |                 |               |
|            |     and the          |                 |               |
|            |     custodial        |                 |               |
|            |     functions and    |                 |               |
|            |     handling of      |                 |               |
|            |     related assets;  |                 |               |
|            |                      |                 |               |
|            | -   Duties are       |                 |               |
|            |     assigned         |                 |               |
|            |     systematically   |                 |               |
|            |     to a number of   |                 |               |
|            |     individuals to   |                 |               |
|            |     ensure that      |                 |               |
|            |     effective checks |                 |               |
|            |     and balances     |                 |               |
|            |     exist;           |                 |               |
|            |                      |                 |               |
|            | -   No one           |                 |               |
|            |     individual can   |                 |               |
|            |     work alone with  |                 |               |
|            |     cash, negotiable |                 |               |
|            |     securities, or   |                 |               |
|            |     other highly     |                 |               |
|            |     vulnerable       |                 |               |
|            |     assets without   |                 |               |
|            |     prior            |                 |               |
|            |     authorization or |                 |               |
|            |     monitoring;      |                 |               |
|            |                      |                 |               |
|            | -   Individuals      |                 |               |
|            |     responsible for  |                 |               |
|            |     opening mail     |                 |               |
|            |     cannot have      |                 |               |
|            |     responsibility   |                 |               |
|            |     for or access to |                 |               |
|            |     files or         |                 |               |
|            |     documents        |                 |               |
|            |     pertaining to    |                 |               |
|            |     accounts         |                 |               |
|            |     receivable or    |                 |               |
|            |     cash accounts;   |                 |               |
|            |                      |                 |               |
|            | -   Staff with       |                 |               |
|            |     responsibility   |                 |               |
|            |     for case         |                 |               |
|            |     receipts or      |                 |               |
|            |     disbursements    |                 |               |
|            |     cannot reconcile |                 |               |
|            |     those accounts;  |                 |               |
|            |     and              |                 |               |
|            |                      |                 |               |
|            | -   Management       |                 |               |
|            |     reduces the      |                 |               |
|            |     opportunity for  |                 |               |
|            |     collusion to     |                 |               |
|            |     occur.           |                 |               |
+------------+----------------------+-----------------+---------------+
| 8\.        | Management           |                 |               |
| Management | establishes          |                 |               |
| authorizes | appropriate          |                 |               |
| a          | controls.            |                 |               |
| ppropriate |                      |                 |               |
| staff to   | Management ensures   |                 |               |
| perform    | the terms of         |                 |               |
| tr         | authorizations are   |                 |               |
| ansactions | in accordance with   |                 |               |
| and other  | directives, within   |                 |               |
| s          | limitations          |                 |               |
| ignificant | established by law   |                 |               |
| events     | and regulation, and  |                 |               |
| with       | communicated to      |                 |               |
| respect to | staff.               |                 |               |
| each of    |                      |                 |               |
| the        |                      |                 |               |
| agency's   |                      |                 |               |
| overall    |                      |                 |               |
| activities |                      |                 |               |
| and those  |                      |                 |               |
| activities |                      |                 |               |
| related to |                      |                 |               |
| the Child  |                      |                 |               |
| Care       |                      |                 |               |
| Program.   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 9\.        | Proper               |                 |               |
| Management | classification and   |                 |               |
| ensures    | recording take place |                 |               |
| the proper | throughout the       |                 |               |
| clas       | entire life cycle of |                 |               |
| sification | each transaction or  |                 |               |
| and timely | event, including     |                 |               |
| recording  | authorization,       |                 |               |
| of         | initiation,          |                 |               |
| s          | processing, and      |                 |               |
| ignificant | final classification |                 |               |
| events     | in summary records.  |                 |               |
| with       |                      |                 |               |
| respect to | Proper               |                 |               |
| each of    | classification of    |                 |               |
| the        | transactions and     |                 |               |
| agency's   | events includes      |                 |               |
| overall    | appropriate          |                 |               |
| activities | organization and     |                 |               |
| and those  | formatting of        |                 |               |
| activities | information on       |                 |               |
| related to | original documents   |                 |               |
| the Child  | (hardcopy or         |                 |               |
| Care       | electronic) and      |                 |               |
| Program.   | summary records from |                 |               |
|            | which reports and    |                 |               |
|            | statements are       |                 |               |
|            | prepared.            |                 |               |
|            |                      |                 |               |
|            | The agency maintains |                 |               |
|            | accurate records to  |                 |               |
|            | minimize             |                 |               |
|            | adjustments.         |                 |               |
+------------+----------------------+-----------------+---------------+
| 10\.       | Managers review and  |                 |               |
| Management | maintain access      |                 |               |
| limits     | restrictions,        |                 |               |
| access and | clearly assign       |                 |               |
| assigns    | custody, and         |                 |               |
| custody to | communicate with     |                 |               |
| resources  | those responsible.   |                 |               |
| and        |                      |                 |               |
| records    | Management compares  |                 |               |
| with       | resources with       |                 |               |
| respect to | records.             |                 |               |
| each of    |                      |                 |               |
| the        |                      |                 |               |
| agency's   |                      |                 |               |
| overall    |                      |                 |               |
| activities |                      |                 |               |
| and those  |                      |                 |               |
| activities |                      |                 |               |
| related to |                      |                 |               |
| the Child  |                      |                 |               |
| Care       |                      |                 |               |
| Program.   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 11\.       | Management maintains |                 |               |
| Management | written              |                 |               |
| ensures    | documentation that   |                 |               |
| all        | is readily           |                 |               |
| tr         | available, complete, |                 |               |
| ansactions | useful, properly     |                 |               |
| and other  | managed, maintained, |                 |               |
| s          | and periodically     |                 |               |
| ignificant | updated.             |                 |               |
| events are |                      |                 |               |
| clearly    |                      |                 |               |
| documented |                      |                 |               |
| with       |                      |                 |               |
| respect to |                      |                 |               |
| each of    |                      |                 |               |
| the        |                      |                 |               |
| agency's   |                      |                 |               |
| overall    |                      |                 |               |
| activities |                      |                 |               |
| and those  |                      |                 |               |
| activities |                      |                 |               |
| related to |                      |                 |               |
| the Child  |                      |                 |               |
| Care       |                      |                 |               |
| Program.   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 12\.       | Management           |                 |               |
| Management | establishes          |                 |               |
| ensures    | appropriate          |                 |               |
| that       | controls.            |                 |               |
| policies   |                      |                 |               |
| and        | Management ensures   |                 |               |
| procedures | the terms of         |                 |               |
| are in     | authorizations are   |                 |               |
| place to   | in accordance with   |                 |               |
| adequately | directives, within   |                 |               |
| monitor    | limitations          |                 |               |
| sub-r      | established by law   |                 |               |
| ecipients, | and regulation, and  |                 |               |
| vendors or | communicated to the  |                 |               |
| providers  | sub-recipients,      |                 |               |
| for        | vendor or provider.  |                 |               |
| compliance |                      |                 |               |
| with       | Management maintains |                 |               |
| applicable | written              |                 |               |
| Federal    | documentation that   |                 |               |
| r          | is readily           |                 |               |
| egulations | available, complete, |                 |               |
| with       | useful, properly     |                 |               |
| respect to | managed, maintained, |                 |               |
| each of    | and periodically     |                 |               |
| the        | updated.             |                 |               |
| agency's   |                      |                 |               |
| overall    |                      |                 |               |
| activities |                      |                 |               |
| and those  |                      |                 |               |
| activities |                      |                 |               |
| related to |                      |                 |               |
| the Child  |                      |                 |               |
| Care       |                      |                 |               |
| Program.   |                      |                 |               |
+------------+----------------------+-----------------+---------------+

+-----------------------------------------------------------------------+
| **III. Control Activities Specific for Information Systems---General  |
| Control**                                                             |
+-----------------------------------------------------------------------+
| Many State agencies use information systems. This section of the      |
| Instrument addresses two areas of information systems control         |
| activities\--general control and application control.                 |
|                                                                       |
| The General Control subsection addresses the structure, policies, and |
| procedures that govern the agency's computer operations. These        |
| elements and criteria apply to all aspects of the agency's computer   |
| operations, ranging from mainframe, servers, and networks, all the    |
| way to the end user environment with personal computers, laptops, and |
| other devices.                                                        |
|                                                                       |
| The General Control section governs how a State's computer function   |
| operates. There are six areas that are examined in the Information    |
| Systems General Control activities. They are:                         |
|                                                                       |
| -   Entity wide security management program;                          |
|                                                                       |
| -   Access control;                                                   |
|                                                                       |
| -   Application software development and change;                      |
|                                                                       |
| -   System software control;                                          |
|                                                                       |
| -   Segregation of duties; and                                        |
|                                                                       |
| -   Service continuity.                                               |
|                                                                       |
| As with the other sections of this Instrument, these elements and     |
| criteria are a beginning point, They are not an all inclusive set of  |
| elements and criteria.                                                |
+-----------------------------------------------------------------------+
| **Entity-wide Security Management Program (CAGC_1)**                  |
+-----------------------------------------------------------------------+

+------------+----------------------+-----------------+---------------+
| **         | **Criteria**         | **              | **Fin         |
| Elements** |                      | Documentation** | dings/Results |
|            |                      |                 | & Suggested   |
|            |                      | **(Provide all  | Follow-up if  |
|            |                      | applicable      | Necessary**   |
|            |                      | d               |               |
|            |                      | ocumentation)** |               |
+============+======================+=================+===============+
| 1\. The    | Management performs  |                 |               |
| agency     | and documents risk   |                 |               |
| pe         | assessments          |                 |               |
| riodically | regularly and        |                 |               |
| performs a | whenever systems,    |                 |               |
| comp       | facilities, or other |                 |               |
| rehensive, | conditions change.   |                 |               |
| high-level |                      |                 |               |
| assessment | Risk assessments     |                 |               |
| of risks   | consider data        |                 |               |
| to its     | sensitivity and      |                 |               |
| i          | integrity.           |                 |               |
| nformation |                      |                 |               |
| systems.   | Management documents |                 |               |
|            | final risk           |                 |               |
|            | determinations and   |                 |               |
|            | managerial approvals |                 |               |
|            | are kept on file.    |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\. The    | The agency security  |                 |               |
| agency has | plan should include  |                 |               |
| developed  | physical security of |                 |               |
| a plan     | all hardware,        |                 |               |
| that       | software, and        |                 |               |
| clearly    | peripheral           |                 |               |
| describes  | equipment, as well   |                 |               |
| its        | as e-mail and        |                 |               |
| security   | Internet access.     |                 |               |
| program,   |                      |                 |               |
| policies,  | A comprehensive set  |                 |               |
| and        | of security software |                 |               |
| p          | is in place and kept |                 |               |
| rocedures. | current.             |                 |               |
+------------+----------------------+-----------------+---------------+
| 3\. Senior |                      |                 |               |
| management |                      |                 |               |
| e          |                      |                 |               |
| stablishes |                      |                 |               |
| and        |                      |                 |               |
| co         |                      |                 |               |
| mmunicates |                      |                 |               |
| a clearly  |                      |                 |               |
| defined    |                      |                 |               |
| structure  |                      |                 |               |
| for        |                      |                 |               |
| im         |                      |                 |               |
| plementing |                      |                 |               |
| and        |                      |                 |               |
| managing   |                      |                 |               |
| the        |                      |                 |               |
| security   |                      |                 |               |
| program    |                      |                 |               |
| throughout |                      |                 |               |
| the agency |                      |                 |               |
| and        |                      |                 |               |
| defines    |                      |                 |               |
| security   |                      |                 |               |
| respons    |                      |                 |               |
| ibilities. |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 4\. The    |                      |                 |               |
| agency     |                      |                 |               |
| implements |                      |                 |               |
| effective  |                      |                 |               |
| securi     |                      |                 |               |
| ty-related |                      |                 |               |
| personnel  |                      |                 |               |
| policies.  |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 5\. The    | The agency           |                 |               |
| agency     | implements, tests,   |                 |               |
| monitors   | and monitors         |                 |               |
| the        | security policy,     |                 |               |
| security   | compliance, and      |                 |               |
| program's  | corrective actions.  |                 |               |
| eff        |                      |                 |               |
| ectiveness |                      |                 |               |
| and makes  |                      |                 |               |
| changes as |                      |                 |               |
| needed.    |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| **Access   |                      |                 |               |
| Control    |                      |                 |               |
| (CAGC_2)** |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\. The    |                      |                 |               |
| agency     |                      |                 |               |
| classifies |                      |                 |               |
| critical   |                      |                 |               |
| and        |                      |                 |               |
| sensitive  |                      |                 |               |
| i          |                      |                 |               |
| nformation |                      |                 |               |
| resources. |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\. The    |                      |                 |               |
| agency has |                      |                 |               |
| e          |                      |                 |               |
| stablished |                      |                 |               |
| physical   |                      |                 |               |
| and        |                      |                 |               |
| logical    |                      |                 |               |
| controls   |                      |                 |               |
| to prevent |                      |                 |               |
| or detect  |                      |                 |               |
| un         |                      |                 |               |
| authorized |                      |                 |               |
| access.    |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 3\. The    |                      |                 |               |
| agency     |                      |                 |               |
| monitors   |                      |                 |               |
| i          |                      |                 |               |
| nformation |                      |                 |               |
| systems    |                      |                 |               |
| access,    |                      |                 |               |
| in         |                      |                 |               |
| vestigates |                      |                 |               |
| apparent   |                      |                 |               |
| v          |                      |                 |               |
| iolations, |                      |                 |               |
| and takes  |                      |                 |               |
| a          |                      |                 |               |
| ppropriate |                      |                 |               |
| remedial   |                      |                 |               |
| and        |                      |                 |               |
| di         |                      |                 |               |
| sciplinary |                      |                 |               |
| action.    |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| **A        |                      |                 |               |
| pplication |                      |                 |               |
| Software   |                      |                 |               |
| D          |                      |                 |               |
| evelopment |                      |                 |               |
| and Change |                      |                 |               |
| Control    |                      |                 |               |
| (CAGC_3)** |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\. The    |                      |                 |               |
| agency     |                      |                 |               |
| authorizes |                      |                 |               |
| i          |                      |                 |               |
| nformation |                      |                 |               |
| system     |                      |                 |               |
| processing |                      |                 |               |
| features   |                      |                 |               |
| and        |                      |                 |               |
| program    |                      |                 |               |
| modi       |                      |                 |               |
| fications. |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\. The    |                      |                 |               |
| agency     |                      |                 |               |
| tests and  |                      |                 |               |
| approves   |                      |                 |               |
| new and    |                      |                 |               |
| revised    |                      |                 |               |
| software.  |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 3\. The    |                      |                 |               |
| agency has |                      |                 |               |
| e          |                      |                 |               |
| stablished |                      |                 |               |
| procedures |                      |                 |               |
| to ensure  |                      |                 |               |
| control of |                      |                 |               |
| its        |                      |                 |               |
| software   |                      |                 |               |
| libraries, |                      |                 |               |
| including  |                      |                 |               |
| labeling,  |                      |                 |               |
| access     |                      |                 |               |
| res        |                      |                 |               |
| trictions, |                      |                 |               |
| and use of |                      |                 |               |
| i          |                      |                 |               |
| nventories |                      |                 |               |
| and        |                      |                 |               |
| separate   |                      |                 |               |
| libraries. |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| **System   |                      |                 |               |
| Software   |                      |                 |               |
| Control    |                      |                 |               |
| (CAGC_4)** |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\. The    |                      |                 |               |
| agency     |                      |                 |               |
| limits     |                      |                 |               |
| access to  |                      |                 |               |
| system and |                      |                 |               |
| documents  |                      |                 |               |
| aut        |                      |                 |               |
| horization |                      |                 |               |
| to system  |                      |                 |               |
| software   |                      |                 |               |
| based on   |                      |                 |               |
| job        |                      |                 |               |
| respons    |                      |                 |               |
| ibilities. |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\. The    |                      |                 |               |
| agency     |                      |                 |               |
| controls   |                      |                 |               |
| and        |                      |                 |               |
| monitors   |                      |                 |               |
| access to  |                      |                 |               |
| the use of |                      |                 |               |
| system     |                      |                 |               |
| software.  |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 3\. The    |                      |                 |               |
| agency     |                      |                 |               |
| controls   |                      |                 |               |
| changes    |                      |                 |               |
| made to    |                      |                 |               |
| the system |                      |                 |               |
| software.  |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| **S        |                      |                 |               |
| egregation |                      |                 |               |
| of Duties  |                      |                 |               |
| (CAGC_5)** |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\. The    |                      |                 |               |
| agency     |                      |                 |               |
| identifies |                      |                 |               |
| and        |                      |                 |               |
| segregates |                      |                 |               |
| In         |                      |                 |               |
| compatible |                      |                 |               |
| duties.    |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\. The    |                      |                 |               |
| agency     |                      |                 |               |
| e          |                      |                 |               |
| stablishes |                      |                 |               |
| access     |                      |                 |               |
| controls   |                      |                 |               |
| to enforce |                      |                 |               |
| s          |                      |                 |               |
| egregation |                      |                 |               |
| of duties. |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 3\. The    |                      |                 |               |
| agency     |                      |                 |               |
| exercises  |                      |                 |               |
| control    |                      |                 |               |
| over staff |                      |                 |               |
| activities |                      |                 |               |
| using      |                      |                 |               |
| formal     |                      |                 |               |
| operating  |                      |                 |               |
| p          |                      |                 |               |
| rocedures, |                      |                 |               |
| su         |                      |                 |               |
| pervision, |                      |                 |               |
| and        |                      |                 |               |
| review.    |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| **Service  |                      |                 |               |
| Continuity |                      |                 |               |
| (CAGC_6)** |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\. The    | Management develops, |                 |               |
| agency     | documents, and tests |                 |               |
| i          | a comprehensive      |                 |               |
| dentifies, | contingency plan.    |                 |               |
| assesses,  |                      |                 |               |
| and        |                      |                 |               |
| p          |                      |                 |               |
| rioritizes |                      |                 |               |
| computer   |                      |                 |               |
| operations |                      |                 |               |
| and        |                      |                 |               |
| supportive |                      |                 |               |
| resources  |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\. The    | The agency uses data |                 |               |
| agency     | and program backup   |                 |               |
| takes      | procedures,          |                 |               |
| steps to   | including off-site   |                 |               |
| prevent    | storage of backup    |                 |               |
| and        | data, as well as     |                 |               |
| minimize   | environmental        |                 |               |
| potential  | controls, staff      |                 |               |
| damage and | training, and        |                 |               |
| int        | hardware maintenance |                 |               |
| erruption. | and management.      |                 |               |
+------------+----------------------+-----------------+---------------+

+-----------------------------------------------------------------------+
| **III Control Activities Specific for Information                     |
| Systems---Application Control**                                       |
+-----------------------------------------------------------------------+
| Information Systems Application Controls attempt to measure the       |
| completeness, accuracy, and validity of all transactions that take    |
| place within the State's computer application. The controls include   |
| the computer programs themselves, as well as the policies and         |
| procedures that govern the operation of specific applications.        |
|                                                                       |
| Four major factors make up the Information Systems Application        |
| Control activities. The State needs to consider the following:        |
|                                                                       |
| -   Authorization control;                                            |
|                                                                       |
| -   Completeness control;                                             |
|                                                                       |
| -   Accuracy control; and                                             |
|                                                                       |
| -   Control over integrity of processing and data files.              |
|                                                                       |
| As in previous sections, the elements and criteria provided here      |
| serve as a beginning point for States.                                |
+-----------------------------------------------------------------------+
| **Authorization Control (CAAC_1)**                                    |
+-----------------------------------------------------------------------+

+------------+----------------------+-----------------+---------------+
| **         | **Criteria**         | **              | **Fin         |
| Elements** |                      | Documentation** | dings/Results |
|            |                      |                 | & Suggested   |
|            |                      | **(Provide all  | Follow-up if  |
|            |                      | applicable      | Necessary**   |
|            |                      | d               |               |
|            |                      | ocumentation)** |               |
+============+======================+=================+===============+
| 1\. The    | Agency restricts     |                 |               |
| agency     | access to incomplete |                 |               |
| controls   | source documents.    |                 |               |
| and        |                      |                 |               |
| requires   | The agency           |                 |               |
| authorized | sequentially         |                 |               |
| access to  | pre-numbers source   |                 |               |
| source     | documents.           |                 |               |
| documents. |                      |                 |               |
|            | The agency requires  |                 |               |
|            | authorizing          |                 |               |
|            | signatures to get    |                 |               |
|            | key source           |                 |               |
|            | documents.           |                 |               |
|            |                      |                 |               |
|            | The agency uses      |                 |               |
|            | batch control sheets |                 |               |
|            | for batch            |                 |               |
|            | application systems, |                 |               |
|            | such as date,        |                 |               |
|            | control number,      |                 |               |
|            | number of documents, |                 |               |
|            | and control totals   |                 |               |
|            | for key fields.      |                 |               |
|            |                      |                 |               |
|            | Supervisory or       |                 |               |
|            | independent review   |                 |               |
|            | of data occurs       |                 |               |
|            | before entry into    |                 |               |
|            | the application      |                 |               |
|            | system.              |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\. Data   |                      |                 |               |
| entry      |                      |                 |               |
| devices    |                      |                 |               |
| have       |                      |                 |               |
| restricted |                      |                 |               |
| access.    |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 3\. The    |                      |                 |               |
| agency     |                      |                 |               |
| uses       |                      |                 |               |
| master     |                      |                 |               |
| files and  |                      |                 |               |
| exception  |                      |                 |               |
| reports to |                      |                 |               |
| ensure     |                      |                 |               |
| proper     |                      |                 |               |
| data       |                      |                 |               |
| processing |                      |                 |               |
| auth       |                      |                 |               |
| orization. |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| **Co       |                      |                 |               |
| mpleteness |                      |                 |               |
| Control    |                      |                 |               |
| (CAAC_2)** |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\. The    |                      |                 |               |
| agency     |                      |                 |               |
| enters all |                      |                 |               |
| authorized |                      |                 |               |
| tr         |                      |                 |               |
| ansactions |                      |                 |               |
| into the   |                      |                 |               |
| computer   |                      |                 |               |
| for        |                      |                 |               |
| p          |                      |                 |               |
| rocessing. |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\. The    |                      |                 |               |
| agency     |                      |                 |               |
| performs   |                      |                 |               |
| timely     |                      |                 |               |
| reco       |                      |                 |               |
| nciliation |                      |                 |               |
| to verify  |                      |                 |               |
| data       |                      |                 |               |
| com        |                      |                 |               |
| pleteness. |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| **Accuracy |                      |                 |               |
| Control    |                      |                 |               |
| (CAAC_3)** |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\.        | The agency data      |                 |               |
| Features   | system includes:     |                 |               |
| of the     |                      |                 |               |
| agency's   | -   The system       |                 |               |
| data       |     performs data    |                 |               |
| system     |     validation and   |                 |               |
| contribute |     editing to       |                 |               |
| to data    |     identify         |                 |               |
| accuracy.  |     erroneous data;  |                 |               |
|            |                      |                 |               |
|            | -   The systems      |                 |               |
|            |     captures,        |                 |               |
|            |     reports,         |                 |               |
|            |     investigates,    |                 |               |
|            |     and promptly     |                 |               |
|            |     corrects         |                 |               |
|            |     erroneous data;  |                 |               |
|            |                      |                 |               |
|            | -   Staff reviews    |                 |               |
|            |     output reports   |                 |               |
|            |     to maintain data |                 |               |
|            |     accuracy and     |                 |               |
|            |     validity; and    |                 |               |
|            |                      |                 |               |
|            | -   The system       |                 |               |
|            |     captures,        |                 |               |
|            |     reports,         |                 |               |
|            |     investigates,    |                 |               |
|            |     and promptly     |                 |               |
|            |     corrects         |                 |               |
|            |     erroneous data.  |                 |               |
+------------+----------------------+-----------------+---------------+
| **Control  |                      |                 |               |
| Over       |                      |                 |               |
| Integrity  |                      |                 |               |
| of         |                      |                 |               |
| Processing |                      |                 |               |
| and Data   |                      |                 |               |
| Files      |                      |                 |               |
| (CAAC_4)** |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\. The    | Computer routines    |                 |               |
| agency     | include:             |                 |               |
| ensures    |                      |                 |               |
| that       | -   Procedures to    |                 |               |
| production |     verify version   |                 |               |
| programs   |     control;         |                 |               |
| and data   |                      |                 |               |
| files used | -   Routines for     |                 |               |
| during     |     checking         |                 |               |
| processing |     internal file    |                 |               |
| are        |     header labels    |                 |               |
| current.   |     before           |                 |               |
|            |     processing; and  |                 |               |
|            |                      |                 |               |
|            | -   Protection       |                 |               |
|            |     against          |                 |               |
|            |     concurrent file  |                 |               |
|            |     updates.         |                 |               |
+------------+----------------------+-----------------+---------------+

+-----------------------------------------------------------------------+
| **IV. INFORMATION AND COMMUNICATIONS**                                |
+-----------------------------------------------------------------------+
| A State must have relevant, reliable information---financial and      |
| non-financial---on relevant external and internal activities. This is |
| the basis for the fourth standard, Information and Communications.    |
| All of the communication tools and methods of processing information  |
| within the agency are part of this standard. Information and          |
| communication need to be broad based and accountable, whether the     |
| communication is done manually or automated. Communications must be   |
| reliable, continuous, appropriate, and secure. The elements and       |
| criteria contained in this standard are a way of measuring the degree |
| to which States are providing these types of communications.          |
|                                                                       |
| As with the other sections of this Instrument, the elements and       |
| criteria are a beginning point for States. They are not an all        |
| inclusive set of elements and criteria.                               |
+-----------------------------------------------------------------------+
| **Information (IC_1)**                                                |
+-----------------------------------------------------------------------+

+------------+----------------------+-----------------+---------------+
| **         | **Criteria**         | **              | **Fin         |
| Elements** |                      | Documentation** | dings/Results |
|            |                      |                 | & Suggested   |
|            |                      | **(Provide all  | Follow-up if  |
|            |                      | applicable      | Necessary**   |
|            |                      | d               |               |
|            |                      | ocumentation)** |               |
+============+======================+=================+===============+
| 1\.        | The agency obtains   |                 |               |
| Management | and reports to       |                 |               |
| collects   | managers any         |                 |               |
| and        | relevant internal    |                 |               |
| reviews    | and external         |                 |               |
| internal   | information that may |                 |               |
| and        | affect the           |                 |               |
| external   | achievement of its   |                 |               |
| p          | missions, goal, and  |                 |               |
| erformance | objectives,          |                 |               |
| in         | particularly those   |                 |               |
| formation. | related to           |                 |               |
|            | legislative or       |                 |               |
|            | regulatory           |                 |               |
|            | developments and     |                 |               |
|            | political or         |                 |               |
|            | economic changes.    |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\. Agency | Management provides  |                 |               |
| management | information that:    |                 |               |
| identifies |                      |                 |               |
| and        | -   Has been         |                 |               |
| obtains    |     analyzed;        |                 |               |
| pertinent  |                      |                 |               |
| i          | -   Provides the     |                 |               |
| nformation |     appropriate      |                 |               |
| and        |     level of detail; |                 |               |
| captures,  |                      |                 |               |
| and        | -   Is summarized    |                 |               |
| d          |     and presented    |                 |               |
| istributes |     appropriately;   |                 |               |
| it         |                      |                 |               |
| appr       | -   Is timely;       |                 |               |
| opriately. |                      |                 |               |
|            | -   Is pertinent;    |                 |               |
|            |     and              |                 |               |
|            |                      |                 |               |
|            | -   Contains         |                 |               |
|            |     operational,     |                 |               |
|            |     financial, and   |                 |               |
|            |     budgetary        |                 |               |
|            |     information.     |                 |               |
+------------+----------------------+-----------------+---------------+
| **Comm     |                      |                 |               |
| unications |                      |                 |               |
| (IC_2)**   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\.        | Senior management    |                 |               |
| Management | provides a clear     |                 |               |
| ensures    | message throughout   |                 |               |
| that       | the agency that      |                 |               |
| effective  | internal control     |                 |               |
| internal   | responsibilities are |                 |               |
| comm       | important and        |                 |               |
| unications | management takes     |                 |               |
| occurs     | them seriously.      |                 |               |
| within the |                      |                 |               |
| agency.    | Management clearly   |                 |               |
|            | communicates         |                 |               |
|            | specific duties to   |                 |               |
|            | staff members, so    |                 |               |
|            | they understand the  |                 |               |
|            | relevant aspects of  |                 |               |
|            | internal control.    |                 |               |
|            | This includes how    |                 |               |
|            | their roles fit the  |                 |               |
|            | agency mission, and  |                 |               |
|            | how their work       |                 |               |
|            | relates to the work  |                 |               |
|            | of others.           |                 |               |
|            |                      |                 |               |
|            | Staff members are    |                 |               |
|            | informed that when   |                 |               |
|            | the unexpected       |                 |               |
|            | occurs in performing |                 |               |
|            | their duties, they   |                 |               |
|            | must be not only     |                 |               |
|            | assess the event,    |                 |               |
|            | but also the         |                 |               |
|            | underlying cause.    |                 |               |
|            | Staff are informed   |                 |               |
|            | that potential       |                 |               |
|            | internal control     |                 |               |
|            | weaknesses must be   |                 |               |
|            | identified and       |                 |               |
|            | corrected before     |                 |               |
|            | they can do further  |                 |               |
|            | harm to the agency.  |                 |               |
|            |                      |                 |               |
|            | Communication        |                 |               |
|            | processes allow the  |                 |               |
|            | easy flow of         |                 |               |
|            | information down,    |                 |               |
|            | across, and up the   |                 |               |
|            | organization.        |                 |               |
|            | Communications exist |                 |               |
|            | between functional   |                 |               |
|            | activities, such as  |                 |               |
|            | between procurement  |                 |               |
|            | activities and       |                 |               |
|            | production           |                 |               |
|            | activities.          |                 |               |
|            |                      |                 |               |
|            | Staff understands    |                 |               |
|            | that there will be   |                 |               |
|            | no reprisals for     |                 |               |
|            | reporting adverse    |                 |               |
|            | information,         |                 |               |
|            | improper conduct, or |                 |               |
|            | circumvention of     |                 |               |
|            | internal control     |                 |               |
|            | activities.          |                 |               |
|            |                      |                 |               |
|            | Staff have           |                 |               |
|            | procedures for       |                 |               |
|            | recommending         |                 |               |
|            | improvements in      |                 |               |
|            | operations and       |                 |               |
|            | management           |                 |               |
|            | acknowledges good    |                 |               |
|            | staff suggestions    |                 |               |
|            | with meaningful      |                 |               |
|            | recognition.         |                 |               |
|            |                      |                 |               |
|            | Management           |                 |               |
|            | communicates         |                 |               |
|            | frequently with      |                 |               |
|            | internal oversight   |                 |               |
|            | groups, such as      |                 |               |
|            | senior management    |                 |               |
|            | councils. Management |                 |               |
|            | keeps these groups   |                 |               |
|            | informed about       |                 |               |
|            | performance, risks,  |                 |               |
|            | major initiatives,   |                 |               |
|            | and any other        |                 |               |
|            | significant events.  |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\.        | Management has open  |                 |               |
| Management | and effective        |                 |               |
| ensures    | communication        |                 |               |
| that       | channels with        |                 |               |
| effective  | clients, suppliers,  |                 |               |
| external   | contractors,         |                 |               |
| comm       | consultants, and     |                 |               |
| unications | others that can      |                 |               |
| occur with | provide significant  |                 |               |
| groups     | suggestions on       |                 |               |
| that can   | quality and design   |                 |               |
| have a     | of agency products   |                 |               |
| serious    | and services.        |                 |               |
| impact on  |                      |                 |               |
| programs,  | Management clearly   |                 |               |
| projects,  | informs all outside  |                 |               |
| o          | parties dealing with |                 |               |
| perations, | the agency of the    |                 |               |
| and other  | agency's ethical     |                 |               |
| a          | standards and        |                 |               |
| ctivities, | understands that the |                 |               |
| including  | agency will not      |                 |               |
| budgeting  | tolerate improper    |                 |               |
| and        | actions.             |                 |               |
| financing. |                      |                 |               |
|            | Management           |                 |               |
|            | encourages           |                 |               |
|            | communication from   |                 |               |
|            | external parties,    |                 |               |
|            | such as Federal      |                 |               |
|            | agencies, State and  |                 |               |
|            | local governments,   |                 |               |
|            | and other related    |                 |               |
|            | third parties, since |                 |               |
|            | these parties may be |                 |               |
|            | a source of          |                 |               |
|            | information on how   |                 |               |
|            | well internal        |                 |               |
|            | controls are         |                 |               |
|            | functioning.         |                 |               |
|            |                      |                 |               |
|            | Complaints or        |                 |               |
|            | inquires are         |                 |               |
|            | welcomed, since they |                 |               |
|            | can identify control |                 |               |
|            | problems.            |                 |               |
|            |                      |                 |               |
|            | Management makes     |                 |               |
|            | certain that the     |                 |               |
|            | advice and           |                 |               |
|            | recommendations of   |                 |               |
|            | auditors and         |                 |               |
|            | evaluators are fully |                 |               |
|            | considered, and that |                 |               |
|            | the agency           |                 |               |
|            | implements actions   |                 |               |
|            | to correct any       |                 |               |
|            | problems or          |                 |               |
|            | weaknesses           |                 |               |
|            | identified.          |                 |               |
+------------+----------------------+-----------------+---------------+
| **Forms    |                      |                 |               |
| and Means  |                      |                 |               |
| of         |                      |                 |               |
| Comm       |                      |                 |               |
| unications |                      |                 |               |
| (IC_3)**   |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 1\.        |                      |                 |               |
| Management |                      |                 |               |
| uses       |                      |                 |               |
| effective  |                      |                 |               |
| methods to |                      |                 |               |
| c          |                      |                 |               |
| ommunicate |                      |                 |               |
| with       |                      |                 |               |
| employees  |                      |                 |               |
| and        |                      |                 |               |
| others.    |                      |                 |               |
+------------+----------------------+-----------------+---------------+
| 2\. The    | Agency integrates    |                 |               |
| agency     | the IT strategic     |                 |               |
| manages    | plan with the agency |                 |               |
| its        | plan to assure:      |                 |               |
| i          |                      |                 |               |
| nformation | -   Identifying      |                 |               |
| systems to |     emerging         |                 |               |
| ensure the |     information      |                 |               |
| usefulness |     needs;           |                 |               |
| and        |                      |                 |               |
| r          | -   Utilizing        |                 |               |
| eliability |     advances in IT;  |                 |               |
| of the     |                      |                 |               |
| i          | -   Monitoring the   |                 |               |
| nformation |     quality of data; |                 |               |
| derived    |     and              |                 |               |
| from the   |                      |                 |               |
| systems.   | -   Committing       |                 |               |
|            |     sufficient       |                 |               |
|            |     resources to IT. |                 |               |
+------------+----------------------+-----------------+---------------+

+----------+---------------------+-----------------+-----------------+---+
| **V.     |                     |                 |                 |   |
| MONI     |                     |                 |                 |   |
| TORING** |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| The last |                     |                 |                 |   |
| internal |                     |                 |                 |   |
| control  |                     |                 |                 |   |
| standard |                     |                 |                 |   |
| is       |                     |                 |                 |   |
| Mon      |                     |                 |                 |   |
| itoring. |                     |                 |                 |   |
| An       |                     |                 |                 |   |
| integral |                     |                 |                 |   |
| part of  |                     |                 |                 |   |
| the      |                     |                 |                 |   |
| Child    |                     |                 |                 |   |
| Care     |                     |                 |                 |   |
| program  |                     |                 |                 |   |
| is       |                     |                 |                 |   |
| mon      |                     |                 |                 |   |
| itoring, |                     |                 |                 |   |
| which    |                     |                 |                 |   |
| allows   |                     |                 |                 |   |
| the      |                     |                 |                 |   |
| State to |                     |                 |                 |   |
| examine  |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| evaluate |                     |                 |                 |   |
| the      |                     |                 |                 |   |
| per      |                     |                 |                 |   |
| formance |                     |                 |                 |   |
| of       |                     |                 |                 |   |
| contract |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| non-     |                     |                 |                 |   |
| contract |                     |                 |                 |   |
| p        |                     |                 |                 |   |
| roviders |                     |                 |                 |   |
| who      |                     |                 |                 |   |
| provide  |                     |                 |                 |   |
| child    |                     |                 |                 |   |
| care and |                     |                 |                 |   |
| other    |                     |                 |                 |   |
| related  |                     |                 |                 |   |
| s        |                     |                 |                 |   |
| ervices. |                     |                 |                 |   |
| This     |                     |                 |                 |   |
| standard |                     |                 |                 |   |
| provides |                     |                 |                 |   |
| elements |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| criteria |                     |                 |                 |   |
| to gauge |                     |                 |                 |   |
| the      |                     |                 |                 |   |
| effec    |                     |                 |                 |   |
| tiveness |                     |                 |                 |   |
| of the   |                     |                 |                 |   |
| program. |                     |                 |                 |   |
| The      |                     |                 |                 |   |
| standard |                     |                 |                 |   |
| also     |                     |                 |                 |   |
| a        |                     |                 |                 |   |
| ddresses |                     |                 |                 |   |
| the      |                     |                 |                 |   |
| effec    |                     |                 |                 |   |
| tiveness |                     |                 |                 |   |
| of       |                     |                 |                 |   |
| audits   |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| other    |                     |                 |                 |   |
| ongoing  |                     |                 |                 |   |
| mo       |                     |                 |                 |   |
| nitoring |                     |                 |                 |   |
| ac       |                     |                 |                 |   |
| tivities |                     |                 |                 |   |
| within   |                     |                 |                 |   |
| the      |                     |                 |                 |   |
| State.   |                     |                 |                 |   |
|          |                     |                 |                 |   |
| "Ongoing |                     |                 |                 |   |
| mo       |                     |                 |                 |   |
| nitoring |                     |                 |                 |   |
| occurs   |                     |                 |                 |   |
| during   |                     |                 |                 |   |
| normal   |                     |                 |                 |   |
| op       |                     |                 |                 |   |
| erations |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| includes |                     |                 |                 |   |
| regular  |                     |                 |                 |   |
| ma       |                     |                 |                 |   |
| nagement |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| sup      |                     |                 |                 |   |
| ervisory |                     |                 |                 |   |
| act      |                     |                 |                 |   |
| ivities, |                     |                 |                 |   |
| comp     |                     |                 |                 |   |
| arisons, |                     |                 |                 |   |
| reconcil |                     |                 |                 |   |
| iations, |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| other    |                     |                 |                 |   |
| actions  |                     |                 |                 |   |
| people   |                     |                 |                 |   |
| take in  |                     |                 |                 |   |
| pe       |                     |                 |                 |   |
| rforming |                     |                 |                 |   |
| their    |                     |                 |                 |   |
| duties.  |                     |                 |                 |   |
| It       |                     |                 |                 |   |
| includes |                     |                 |                 |   |
| ensuring |                     |                 |                 |   |
| that     |                     |                 |                 |   |
| managers |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| sup      |                     |                 |                 |   |
| ervisors |                     |                 |                 |   |
| know     |                     |                 |                 |   |
| their    |                     |                 |                 |   |
| responsi |                     |                 |                 |   |
| bilities |                     |                 |                 |   |
| for      |                     |                 |                 |   |
| internal |                     |                 |                 |   |
| control  |                     |                 |                 |   |
| and the  |                     |                 |                 |   |
| need to  |                     |                 |                 |   |
| make     |                     |                 |                 |   |
| control  |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| control  |                     |                 |                 |   |
| mo       |                     |                 |                 |   |
| nitoring |                     |                 |                 |   |
| part of  |                     |                 |                 |   |
| their    |                     |                 |                 |   |
| regular  |                     |                 |                 |   |
| o        |                     |                 |                 |   |
| perating |                     |                 |                 |   |
| pr       |                     |                 |                 |   |
| ocesses. |                     |                 |                 |   |
| Separate |                     |                 |                 |   |
| eva      |                     |                 |                 |   |
| luations |                     |                 |                 |   |
| are a    |                     |                 |                 |   |
| way to   |                     |                 |                 |   |
| take a   |                     |                 |                 |   |
| fresh    |                     |                 |                 |   |
| look at  |                     |                 |                 |   |
| internal |                     |                 |                 |   |
| control  |                     |                 |                 |   |
| by       |                     |                 |                 |   |
| focusing |                     |                 |                 |   |
| directly |                     |                 |                 |   |
| on the   |                     |                 |                 |   |
| c        |                     |                 |                 |   |
| ontrol's |                     |                 |                 |   |
| effec    |                     |                 |                 |   |
| tiveness |                     |                 |                 |   |
| at a     |                     |                 |                 |   |
| specific |                     |                 |                 |   |
| time.    |                     |                 |                 |   |
| These    |                     |                 |                 |   |
| eva      |                     |                 |                 |   |
| luations |                     |                 |                 |   |
| may take |                     |                 |                 |   |
| the form |                     |                 |                 |   |
| of       |                     |                 |                 |   |
| self-as  |                     |                 |                 |   |
| sessment |                     |                 |                 |   |
| as well  |                     |                 |                 |   |
| as       |                     |                 |                 |   |
| review   |                     |                 |                 |   |
| of       |                     |                 |                 |   |
| control  |                     |                 |                 |   |
| design   |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| direct   |                     |                 |                 |   |
| testing, |                     |                 |                 |   |
| and may  |                     |                 |                 |   |
| include  |                     |                 |                 |   |
| the use  |                     |                 |                 |   |
| of this  |                     |                 |                 |   |
| Ma       |                     |                 |                 |   |
| nagement |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| Ev       |                     |                 |                 |   |
| aluation |                     |                 |                 |   |
| Tool or  |                     |                 |                 |   |
| some     |                     |                 |                 |   |
| similar  |                     |                 |                 |   |
| device.  |                     |                 |                 |   |
| In       |                     |                 |                 |   |
| a        |                     |                 |                 |   |
| ddition, |                     |                 |                 |   |
| mo       |                     |                 |                 |   |
| nitoring |                     |                 |                 |   |
| includes |                     |                 |                 |   |
| policies |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| pr       |                     |                 |                 |   |
| ocedures |                     |                 |                 |   |
| for      |                     |                 |                 |   |
| ensuring |                     |                 |                 |   |
| that any |                     |                 |                 |   |
| audit    |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| review   |                     |                 |                 |   |
| findings |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| recomme  |                     |                 |                 |   |
| ndations |                     |                 |                 |   |
| are      |                     |                 |                 |   |
| brought  |                     |                 |                 |   |
| to the   |                     |                 |                 |   |
| a        |                     |                 |                 |   |
| ttention |                     |                 |                 |   |
| of       |                     |                 |                 |   |
| ma       |                     |                 |                 |   |
| nagement |                     |                 |                 |   |
| and are  |                     |                 |                 |   |
| resolved |                     |                 |                 |   |
| p        |                     |                 |                 |   |
| romptly. |                     |                 |                 |   |
| Managers |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| ev       |                     |                 |                 |   |
| aluators |                     |                 |                 |   |
| should   |                     |                 |                 |   |
| consider |                     |                 |                 |   |
| the      |                     |                 |                 |   |
| appropr  |                     |                 |                 |   |
| iateness |                     |                 |                 |   |
| of the   |                     |                 |                 |   |
| agency's |                     |                 |                 |   |
| internal |                     |                 |                 |   |
| control  |                     |                 |                 |   |
| mo       |                     |                 |                 |   |
| nitoring |                     |                 |                 |   |
| and the  |                     |                 |                 |   |
| degree   |                     |                 |                 |   |
| to which |                     |                 |                 |   |
| it helps |                     |                 |                 |   |
| them     |                     |                 |                 |   |
| ac       |                     |                 |                 |   |
| complish |                     |                 |                 |   |
| their    |                     |                 |                 |   |
| obj      |                     |                 |                 |   |
| ectives. |                     |                 |                 |   |
| Listed   |                     |                 |                 |   |
| below    |                     |                 |                 |   |
| are      |                     |                 |                 |   |
| factors  |                     |                 |                 |   |
| a user   |                     |                 |                 |   |
| might    |                     |                 |                 |   |
| c        |                     |                 |                 |   |
| onsider. |                     |                 |                 |   |
| The list |                     |                 |                 |   |
| is a     |                     |                 |                 |   |
| b        |                     |                 |                 |   |
| eginning |                     |                 |                 |   |
| point.   |                     |                 |                 |   |
| It is    |                     |                 |                 |   |
| not      |                     |                 |                 |   |
| all-in   |                     |                 |                 |   |
| clusive, |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| every    |                     |                 |                 |   |
| item     |                     |                 |                 |   |
| might    |                     |                 |                 |   |
| not      |                     |                 |                 |   |
| apply to |                     |                 |                 |   |
| every    |                     |                 |                 |   |
| agency   |                     |                 |                 |   |
| or       |                     |                 |                 |   |
| activity |                     |                 |                 |   |
| within   |                     |                 |                 |   |
| the      |                     |                 |                 |   |
| agency.  |                     |                 |                 |   |
| Even     |                     |                 |                 |   |
| though   |                     |                 |                 |   |
| some of  |                     |                 |                 |   |
| the      |                     |                 |                 |   |
| f        |                     |                 |                 |   |
| unctions |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| points   |                     |                 |                 |   |
| may be   |                     |                 |                 |   |
| su       |                     |                 |                 |   |
| bjective |                     |                 |                 |   |
| in       |                     |                 |                 |   |
| nature   |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| require  |                     |                 |                 |   |
| the use  |                     |                 |                 |   |
| of       |                     |                 |                 |   |
| j        |                     |                 |                 |   |
| udgment, |                     |                 |                 |   |
| they are |                     |                 |                 |   |
| i        |                     |                 |                 |   |
| mportant |                     |                 |                 |   |
| in       |                     |                 |                 |   |
| esta     |                     |                 |                 |   |
| blishing |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| mai      |                     |                 |                 |   |
| ntaining |                     |                 |                 |   |
| good     |                     |                 |                 |   |
| internal |                     |                 |                 |   |
| control  |                     |                 |                 |   |
| mo       |                     |                 |                 |   |
| nitoring |                     |                 |                 |   |
| policies |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| procedu  |                     |                 |                 |   |
| res."^2^ |                     |                 |                 |   |
|          |                     |                 |                 |   |
| ^2^      |                     |                 |                 |   |
| Go       |                     |                 |                 |   |
| vernment |                     |                 |                 |   |
| Accoun   |                     |                 |                 |   |
| tability |                     |                 |                 |   |
| Office.  |                     |                 |                 |   |
| (August  |                     |                 |                 |   |
| 2001*.)  |                     |                 |                 |   |
| Internal |                     |                 |                 |   |
| Control  |                     |                 |                 |   |
| Ma       |                     |                 |                 |   |
| nagement |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| Ev       |                     |                 |                 |   |
| aluation |                     |                 |                 |   |
| Tool.*   |                     |                 |                 |   |
| (GAO     |                     |                 |                 |   |
| Pub      |                     |                 |                 |   |
| lication |                     |                 |                 |   |
| No.      |                     |                 |                 |   |
| GAO--01- |                     |                 |                 |   |
| -1008G). |                     |                 |                 |   |
| Was      |                     |                 |                 |   |
| hington, |                     |                 |                 |   |
| DC: U.S. |                     |                 |                 |   |
| Go       |                     |                 |                 |   |
| vernment |                     |                 |                 |   |
| Printing |                     |                 |                 |   |
| Office.  |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| *        |                     |                 |                 |   |
| *Ongoing |                     |                 |                 |   |
| Mo       |                     |                 |                 |   |
| nitoring |                     |                 |                 |   |
| (M_1)**  |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| **El     | **Criteria**        | **              | **F             |   |
| ements** |                     | Documentation** | indings/Results |   |
|          |                     |                 | & Suggested     |   |
|          |                     | **(Provide all  | Follow-up if    |   |
|          |                     | applicable      | Necessary**     |   |
|          |                     | d               |                 |   |
|          |                     | ocumentation)** |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 1\.      | The agency's        |                 |                 |   |
| Ma       | monitoring          |                 |                 |   |
| nagement | includes:           |                 |                 |   |
| ensures  |                     |                 |                 |   |
| e        | -   Communication   |                 |                 |   |
| ffective |     to managers     |                 |                 |   |
| mo       |     regarding their |                 |                 |   |
| nitoring |                     |                 |                 |   |
| and      |    responsibilities |                 |                 |   |
| internal |     for internal    |                 |                 |   |
| control. |     control and     |                 |                 |   |
|          |     regular         |                 |                 |   |
|          |     monitoring; and |                 |                 |   |
|          |                     |                 |                 |   |
|          | -   Periodic        |                 |                 |   |
|          |     evaluation of   |                 |                 |   |
|          |     control         |                 |                 |   |
|          |     activities for  |                 |                 |   |
|          |     critical        |                 |                 |   |
|          |     operational and |                 |                 |   |
|          |     mission support |                 |                 |   |
|          |     systems.        |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 2\. The  |                     |                 |                 |   |
| agency   |                     |                 |                 |   |
| produces |                     |                 |                 |   |
| reports  |                     |                 |                 |   |
| used to  |                     |                 |                 |   |
| monitor  |                     |                 |                 |   |
| program  |                     |                 |                 |   |
| ac       |                     |                 |                 |   |
| tivities |                     |                 |                 |   |
| and to   |                     |                 |                 |   |
| identify |                     |                 |                 |   |
| inac     |                     |                 |                 |   |
| curacies |                     |                 |                 |   |
| or other |                     |                 |                 |   |
| issues   |                     |                 |                 |   |
| r        |                     |                 |                 |   |
| equiring |                     |                 |                 |   |
| fo       |                     |                 |                 |   |
| llow-up. |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 3\.      | Management          |                 |                 |   |
| Ma       | investigates        |                 |                 |   |
| nagement | customer complaints |                 |                 |   |
| monitors | for potential       |                 |                 |   |
| commun   | deficiencies.       |                 |                 |   |
| ications |                     |                 |                 |   |
| from     | Management uses     |                 |                 |   |
| external | communications and  |                 |                 |   |
| p        | reports from        |                 |                 |   |
| artners. | external partners   |                 |                 |   |
|          | as control          |                 |                 |   |
|          | monitoring          |                 |                 |   |
|          | techniques.         |                 |                 |   |
|          |                     |                 |                 |   |
|          | Management uses     |                 |                 |   |
|          | information from    |                 |                 |   |
|          | oversight groups    |                 |                 |   |
|          | about compliance or |                 |                 |   |
|          | internal control    |                 |                 |   |
|          | functions to        |                 |                 |   |
|          | identify problems   |                 |                 |   |
|          | requiring           |                 |                 |   |
|          | follow-up.          |                 |                 |   |
|          |                     |                 |                 |   |
|          | Management          |                 |                 |   |
|          | reassesses weak     |                 |                 |   |
|          | control activities. |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 4\.      | Management uses     |                 |                 |   |
| Ma       | automated edits and |                 |                 |   |
| nagement | checks and other    |                 |                 |   |
| uses the | activities for      |                 |                 |   |
| agency's | control accuracy    |                 |                 |   |
| organi   | and completeness of |                 |                 |   |
| zational | transaction         |                 |                 |   |
| s        | processing.         |                 |                 |   |
| tructure |                     |                 |                 |   |
| to       | Management uses     |                 |                 |   |
| provide  | separation of       |                 |                 |   |
| o        | duties and          |                 |                 |   |
| versight | responsibilities to |                 |                 |   |
| of       | help deter fraud.   |                 |                 |   |
| internal |                     |                 |                 |   |
| control  |                     |                 |                 |   |
| fu       |                     |                 |                 |   |
| nctions. |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 5\. The  |                     |                 |                 |   |
| agency's |                     |                 |                 |   |
| internal |                     |                 |                 |   |
| audit    |                     |                 |                 |   |
| de       |                     |                 |                 |   |
| partment |                     |                 |                 |   |
| is       |                     |                 |                 |   |
| a        |                     |                 |                 |   |
| vailable |                     |                 |                 |   |
| to       |                     |                 |                 |   |
| research |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| r        |                     |                 |                 |   |
| ecommend |                     |                 |                 |   |
| impr     |                     |                 |                 |   |
| ovements |                     |                 |                 |   |
| within   |                     |                 |                 |   |
| the      |                     |                 |                 |   |
| internal |                     |                 |                 |   |
| control  |                     |                 |                 |   |
| st       |                     |                 |                 |   |
| ructure. |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 6\.      | Management uses     |                 |                 |   |
| Ma       | information, and    |                 |                 |   |
| nagement | feedback concerning |                 |                 |   |
| meets    | internal control    |                 |                 |   |
| with     | from training and   |                 |                 |   |
| staff to | planning sessions,  |                 |                 |   |
| receive  | and other meetings  |                 |                 |   |
| feedback | to address problems |                 |                 |   |
| on       | or strengthen the   |                 |                 |   |
| effec    | internal control    |                 |                 |   |
| tiveness | structure.          |                 |                 |   |
| of       |                     |                 |                 |   |
| internal | Management uses     |                 |                 |   |
| control. | staff suggestions   |                 |                 |   |
|          | In evaluating the   |                 |                 |   |
|          | effectiveness of    |                 |                 |   |
|          | internal controls.  |                 |                 |   |
|          |                     |                 |                 |   |
|          | Management          |                 |                 |   |
|          | encourages staff to |                 |                 |   |
|          | identify and report |                 |                 |   |
|          | internal control    |                 |                 |   |
|          | weaknesses.         |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 7\.      | Management uses     |                 |                 |   |
| Ma       | separate            |                 |                 |   |
| nagement | evaluations and     |                 |                 |   |
| uses     | audits to evaluate  |                 |                 |   |
| separate | significant agency  |                 |                 |   |
| eva      | or program changes. |                 |                 |   |
| luations |                     |                 |                 |   |
| or       | Management uses     |                 |                 |   |
| audits   | qualified staff or  |                 |                 |   |
| to       | external providers  |                 |                 |   |
| review   | to conduct separate |                 |                 |   |
| risk     | evaluations or      |                 |                 |   |
| as       | audits.             |                 |                 |   |
| sessment |                     |                 |                 |   |
| results, | Management          |                 |                 |   |
| effec    | considers risk      |                 |                 |   |
| tiveness | assessment results  |                 |                 |   |
| of       | and the             |                 |                 |   |
| ongoing  | effectiveness of    |                 |                 |   |
| mo       | ongoing monitoring  |                 |                 |   |
| nitoring | when determining    |                 |                 |   |
| and      | the scope and       |                 |                 |   |
| internal | frequency of        |                 |                 |   |
| c        | evaluations.        |                 |                 |   |
| ontrols. |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 8\.      | The agency's        |                 |                 |   |
| Ma       | methodologies may   |                 |                 |   |
| nagement | include:            |                 |                 |   |
| ensures  |                     |                 |                 |   |
| the      | -                   |                 |                 |   |
| effec    |    Self-assessment; |                 |                 |   |
| tiveness |                     |                 |                 |   |
| of       | -   Review of       |                 |                 |   |
| ev       |     control design; |                 |                 |   |
| aluation |                     |                 |                 |   |
| te       | -   Direct testing  |                 |                 |   |
| chniques |     of internal     |                 |                 |   |
| and      |     control         |                 |                 |   |
| metho    |     activities; and |                 |                 |   |
| dologies |                     |                 |                 |   |
| used.    | -                   |                 |                 |   |
|          |   Computer-assisted |                 |                 |   |
|          |     audit           |                 |                 |   |
|          |     techniques.     |                 |                 |   |
|          |                     |                 |                 |   |
|          | The agency's        |                 |                 |   |
|          | evaluation plan is: |                 |                 |   |
|          |                     |                 |                 |   |
|          | -   Coordinated     |                 |                 |   |
|          |     with            |                 |                 |   |
|          |     appropriate     |                 |                 |   |
|          |     parties;        |                 |                 |   |
|          |                     |                 |                 |   |
|          | -   Managed and     |                 |                 |   |
|          |     conducted by    |                 |                 |   |
|          |     qualified       |                 |                 |   |
|          |     staff; and      |                 |                 |   |
|          |                     |                 |                 |   |
|          | -   Well            |                 |                 |   |
|          |     documented.     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 9\. If   | The internal audit  |                 |                 |   |
| the      | department or like  |                 |                 |   |
| agency's | entity has          |                 |                 |   |
| internal | sufficient levels   |                 |                 |   |
| audit    | of competent and    |                 |                 |   |
| de       | experienced staff.  |                 |                 |   |
| partment |                     |                 |                 |   |
| conducts | The internal audit  |                 |                 |   |
| eval     | department or like  |                 |                 |   |
| uations, | entity is           |                 |                 |   |
| the      | independent and     |                 |                 |   |
| agency   | reports to the      |                 |                 |   |
| should   | highest levels      |                 |                 |   |
| have     | within the agency.  |                 |                 |   |
| su       |                     |                 |                 |   |
| fficient |                     |                 |                 |   |
| re       |                     |                 |                 |   |
| sources, |                     |                 |                 |   |
| ability, |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| indep    |                     |                 |                 |   |
| endence. |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 10\.     |                     |                 |                 |   |
| Ma       |                     |                 |                 |   |
| nagement |                     |                 |                 |   |
| promptly |                     |                 |                 |   |
| reports  |                     |                 |                 |   |
| and      |                     |                 |                 |   |
| resolves |                     |                 |                 |   |
| defi     |                     |                 |                 |   |
| ciencies |                     |                 |                 |   |
| found    |                     |                 |                 |   |
| during   |                     |                 |                 |   |
| eval     |                     |                 |                 |   |
| uations. |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| **Audit  |                     |                 |                 |   |
| Re       |                     |                 |                 |   |
| solution |                     |                 |                 |   |
| (M_2)**  |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 1\.      | Managers review and |                 |                 |   |
| Ma       | evaluate audit      |                 |                 |   |
| nagement | findings,           |                 |                 |   |
| ensures  | assessments, and    |                 |                 |   |
| prompt   | other reviews,      |                 |                 |   |
| re       | including those     |                 |                 |   |
| solution | showing             |                 |                 |   |
| of       | deficiencies and    |                 |                 |   |
| findings | those identifying   |                 |                 |   |
| from     | opportunities for   |                 |                 |   |
| audits   | improvements.       |                 |                 |   |
| and      |                     |                 |                 |   |
| other    | Management          |                 |                 |   |
| reviews. | determines the      |                 |                 |   |
|          | proper actions to   |                 |                 |   |
|          | take in response to |                 |                 |   |
|          | findings and        |                 |                 |   |
|          | recommendations.    |                 |                 |   |
|          |                     |                 |                 |   |
|          | Management takes    |                 |                 |   |
|          | corrective action   |                 |                 |   |
|          | within established  |                 |                 |   |
|          | time frames to      |                 |                 |   |
|          | resolve the         |                 |                 |   |
|          | deficiencies.       |                 |                 |   |
|          |                     |                 |                 |   |
|          | Management uses     |                 |                 |   |
|          | consultations with  |                 |                 |   |
|          | internal and        |                 |                 |   |
|          | external auditors   |                 |                 |   |
|          | and other reviewers |                 |                 |   |
|          | as appropriate.     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+
| 2\.      | Senior management   |                 |                 |   |
| Ma       | evaluates findings  |                 |                 |   |
| nagement | and recommendations |                 |                 |   |
| responds | and determines the  |                 |                 |   |
| to       | appropriate         |                 |                 |   |
| findings | actions.            |                 |                 |   |
| and      |                     |                 |                 |   |
| recomme  | Management ensures  |                 |                 |   |
| ndations | implementation of   |                 |                 |   |
| of       | changes to internal |                 |                 |   |
| audits   | controls.           |                 |                 |   |
| and      |                     |                 |                 |   |
| other    | Senior management   |                 |                 |   |
| reviews  | reviews periodic    |                 |                 |   |
| and      | reports to ensure   |                 |                 |   |
| takes    | the quality and     |                 |                 |   |
| app      | timeliness of       |                 |                 |   |
| ropriate | resolution          |                 |                 |   |
| f        | decisions.          |                 |                 |   |
| ollow-up |                     |                 |                 |   |
| action.  |                     |                 |                 |   |
+----------+---------------------+-----------------+-----------------+---+

[^1]: Government Accountability Office. (June 2004.) *TANF and Child
    Care Programs: HHS Lacks Adequate Information to Assess Risk and
    Assist States in Managing improper Payments.* (GAO Publication No.
    GAO--04--723). Washington, DC: U.S. Government Printing Office.

[^2]: Full descriptions of strong internal control environments are
    provided in OMB Circular A-123, *Management's Responsibility for
    Internal Control* (December 21, 2004), available at
    <http://www.whitehouse.gov/omb/circulars/a123/a123_rev.pdf> and
    *Standards for Internal Control in the Federal Government* (November
    1999), available at http://www.gao.gov/special.pubs/ai00021p.pdf.

[^3]: Available at <http://www.gao.gov/new.items/d011008g.pdf>.

[^4]: Government Accountability Office. (June 2004.) *TANF and child
    care programs: HHS lacks adequate information to assess risk and
    assist States in managing improper payments.* (GAO Publication No.
    GAO--04--723). Washington, DC: U.S. Government Printing Office.

[^5]: Full descriptions of strong internal control environments are
    provided in OMB Circular A-123, *Management's Responsibility for
    Internal Control* (December 21, 2004), available at
    <http://www.whitehouse.gov/omb/circulars/a123/a123_rev.pdf> and
    *Standards for Internal Control in the Federal Government* (November
    1999), available at http://www.gao.gov/special.pubs/ai00021p.pdf.

[^6]: Available at <http://www.gao.gov/new.items/d011008g.pdf>.

[^7]: Improper Payment Information Act of 2002, Pub. L. No. 107--300, §
    2, 116 Stat. 2350.

[^8]: Office of Management and Budget. (2003). The Improper Payment
    Information Act, Public Law No: 107--300 \[On-line\]. Available:
    <http://www.whitehouse.gov/omb/memoranda/m03-13-attach.pdf>.

[^9]: Government Accountability Office. (June 2004) *TANF and Child Care
    Programs: HHS Lacks Adequate Information to Assess Risk and Assist
    States in Managing Improper Payments.* (GAO Publication No.
    GAO--04--723). Washington, DC: U.S. Government Printing Office.

[^10]: Government Accountability Office. (August 2001) *Internal Control
    Management and Evaluation Tool* (GAO Publication No.
    GAO--01--1008G). Washington, DC: U.S. Government Printing Office.

[^11]: Government Accountability Office. (October 2001) *Strategies to
    manage improper payments: Learning from public and private sector
    organizations* (GAO Publication No. GAO--02--69G). Washington, DC:
    U.S. Government Printing Office.

[^12]: Originally, the CCB intended for one State, Territory,
    Commonwealth, or District from each of the ten Federal Regions to
    participate in the next phase of the pilot process; however, due to
    a number of compelling factors, there was difficulty in securing a
    pilot state in Region III. After discussions, the CCB, decided to
    proceed with the pilot with eight States and the Commonwealth of
    Puerto Rico.