# Presentation: 676643

## 2007 Activities
Reviewing and Compiling control points 
for Site AART
Presented to : Process Owners
By Grace Huang, Project Manager

**Reviewing and Compiling control points **
**for Site AART**
**Presented to : Process Owners**
**By Grace Huang, Project Manager**

**OMB Circular A-123 (Appendix A)****Implementation**

**Notes:**
Greeting

A flavor of 07 implementation activities

Follow up reminder and add. Info to submit data

Representing your group and relay info

## What is OMB Circular A-123?

- Provides Federal managers guidance on improving the accountability and effectiveness of Federal programs and operations by establishing, assessing, correcting, and reporting on management controls*
- Appendix A was added late 2005 with a focus of the management process for assessing internal control over financial reporting
- * From “Purpose and Authority” of Circular No. A-123

**Notes:**
Re-introducing key ideas

## Assurance reporting at different levels

| DOE Headquarters | Assurance Statement |
| --- | --- |
| Chicago Field Office | Roll up Site A-123 Assessment and Reporting Tool (AARTs)
Assurance Statement |
| LBNL | Site AART |

**Notes:**
End product at different levels

Refer to Page 5 (Assurance: What ensures the accuracy of the number?) of the Dec 06 training 

## Site AART 

- Material accounts
- Balance sheet
- Other Liabilities
- Accounts Payables
- Other Non-intragovernmental assets
- General Property, Plant, and Equipment
- Stmt of Net Costs
- World Class Scientific Research Capacity
- Reimbursable Programs
- Stmt of Financing
- Depreciation and Amortization

- Major processes
- Entity Controls
- Process Controls
- Budget to Close
- Procure to Pay
- Enterprise Resource Management
- Project to Asset
- Quote to Cash

**Notes:**
FY06 work condensed into data in Site AART

Refer to the “Local AART” and the “PCS Assess” tab of AART_LBNL.xls 

Data organized in a matrix of material accounts and major processes

DOE specified material accounts relating to LBNL operation and LBNL documented its controls impacting these material accounts

## FY07 Timelines

| Milestones | Due Dates |
| --- | --- |
| Internal Control training | 10/1/2006 through 12/15/2006 |
| Revised Site AART toolkit | Mid December |
| Review of Site AART data (including Financial Statement Assertion linkage) | 12/15/2006 through 2/15/2007 |
| OMBA-123 Webpage development | 11/1/2006 through 12/31/2006 |
| 1st Quarterly reporting   | 1/5/2007 (tentative) |
| Realignment of FY 2006 Data for new Site AART features | 2/15/07 through 5/15/2007 |
| Testing  | 2/15/2007 through 7/31/2007 |
| 2nd Quarterly reporting  | 4/6/2007 (tentative) |
| Remediation of controls  | 2/15/2007 through 6/15/2007 |
| 3rd Quarterly reporting  | 7/6/2007 (tentative) |

**Notes:**
Distribute copies of the Milestones and Timeline and Roles and Responsibilities

Accomplishments and first deliverables for process owner due mid February

Roles and Responsibilities reviewed by the assessment team and will be presented to Jeffery or Steering committee

## FY07 Timelines (Continued)

| Milestones | Due Dates |
| --- | --- |
| Preliminary assurance reporting | 8/10/2007 (tentative) |
| Final assurance reporting | 8/27/2007 (tentative)
 |
| Periodic assessment team meeting | Ongoing |
| Quarterly Steering Committee meeting | Ongoing |
| Periodic status report to CFO | Ongoing |

## New/Changed process?

- Note any significant process change that may have been prompted by or resulted in any of the following
- New regulations requiring additional controls to ensure compliance
- Organizational changes in which new leadership has implemented new procedures or directives
- Existing automated processes changed to manual ones
- 	Process owners are required to discuss any of the above with the implementation team

## Why

- Hours required for testing activities in FY2006
- Agreed controls required clarification or revisions
- Required resources to track the revised controls

**Notes:**
Don’t have to spend time unnecessarily for testing activities, 07 has more ground to cover

## How to

- Review the controls under the sub-processes rated “Moderate” and “Low” risks
- Based on the way the control is worded, conclude the following:
- What does the control accomplish (its objective)?
- Is the control objective preventive, detective, or both in nature (Control Set Mode)?
- Mark the key control(s) with two asterisks at the end of the sentence and list the key control(s) first
- Re-rate the Control Set Design Effectiveness based on the new definition of the rating

**Notes:**
Note the high risk controls were tested in FY06

## Key Controls/Controls Set

- Key Controls are: Controls that have the greatest and most critical impact in mitigating risk occurrence
- A control Set is A logical grouping of controls designed to mitigate a common risk statement

## Control Set Design Effectiveness

| Rating | FY 2007 (New) | FY 2006 (Old) |
| --- | --- | --- |
| 3 | Significant Design Deficiency 
High probability of the risk occurring | Material Weakness
More than a remote likelihood of material misstatement of Financial Statement |
| 4 | Design Deficiency     
More than a remote possibility of the risk occurring | Reportable Condition
More than a remote likelihood and more than inconsequential misstatement of Financial Statement |
| 5 | Minor Design Deficiency
Only a remote possibility of the risk occurring | Control Deficiency
The control will prevent or detect a misstatement of Financial Statements  |
| 6 | Designed Effectively
Less than a remote possibility of the risk occurring | Designed Effectively
The control will prevent or detect a misstatement of Financial Statements |

**Notes:**
Rating, additional definition:

How likely the controls will  mitigate the risk in question.

Use the risk control set on page  as an example

3: The high probability of the risk occurrence may adversely affect our ability to meet our internal control objectives for the specified risk.
4. The possibility of risk occurrence may also adversely affect our ability to meet our internal control objectives for the specified risk.
5. The remote possibility of the risk occurrence may not  adversely affect our ability to meet our internal control objectives for the specified risk.
6. The remote/none possibility of the risk occurrence should not adversely affect our ability to meet our internal control objectives for the specified risk.

## Control Set Design Considerations

- Design Effectiveness Rating Decisions should consider:
- Degree of automation of the control set
- Type and mode of control set
- Frequency of execution of the control set
- Existence of compensating controls
- Risk Assessment rating
- Relative exposure
- Potential for risk occurrence

## How to

- Design Effectiveness Rationale (An example) for a rating of 6 (control set designed effectively):
- 	Control set contains both manual and automated controls directly linked to key risks.  The control set provides for preventive and detective controls to mitigate the risk and provides for identification of issues should the risk occur.  The number of controls also appears adequate based on the level of risk.

## How to

- Project team will determine the following for review:
- The direct impact on the DOE entity-wide financial statements if the control is not able to mitigate the risk(s) involved
- DOE entity-wide statements
**Balance Sheet**
**Statement of Net Costs**
**Statement of Financing**
- In the event that the impact on the entity- wide financial statement is indirect, reference “Indirect impact”

## How to

- The five financial statement assertions (project team will complete this for review):

| Presentation and disclosure | Is it recorded in the right place? |
| --- | --- |
| Existence or occurrence | Did it happen and when? |
| Rights and obligations | Do we own or owe what we think we do? |
| Completeness and accuracy | Is anything missing? |
| Valuation or allocation | Are the numbers right? |

**Notes:**
Is it recorded in the right place

## How to

- Revising controls
- When?
- It is not possible to form a clear, concise control objective which addresses how the risk involved may be averted or detected
- Lack of specificity in the Risk/Control set
- Underlying business processes have changed prompting the controls to be changed or eliminated
- Controls as worded are inaccurate depiction of the actual business processes and procedures
- The Control Set Type (Auto vs. Manual) and Frequency have changed

## How to

- A risk/control set – before and after
- 	Example (before):
- 	Risk: Improper orders can occur
- 	Control: Procurement supervisors review the purchase requisitions for any unallowable items and assign transactions to buyers. Buyers review transactions then source requisitions into purchase orders and place orders with vendors.

## How to

- A risk/control set – before and after
- 	Example (After):
- 	Risk: Prohibited items may be ordered via LBNL Procurement systems
- 	Controls: Procurement supervisors review the purchase requisitions for any unallowable items.
- 		        The DPU Supervisor signs off on monthly statement and reviews the backup documentation.
- 		        Buyers review and approve those purchase orders within their delegated signature authority.
- 		        SAS approvers review for any prohibited items and approve the requisitions.

## How to

- How is after different from before?
- A more clear control objective – prevents unallowable costs from incurring by preventing and/or detecting the requisition of prohibited items
- Specific reference to multiple processes in which the control objective is achieved

## Our goals

- To address the feedback from DOE HQ OMB A-123 Project Management Team (PMT) :
- Most risk statements are detailed and well formed, but some lack specificity
- While the control activities are defined, it is difficult to discern the control objectives.
- To streamline effort for FY07 implementation activities by striving for more clear and concise control objectives

## Optional/Recommended

- Efficiency Opportunities Identifier
- While the control set design may be effective, A-123 evaluations should also assess efficiency where possible.  If during the course of the evaluation opportunities to improve the efficiency of controls are identified, record a “Yes” in the Efficiency Opportunities Column (Col. V).  The nature of the potential efficiency should be recorded in the detailed A-123 Documentation.

## Design Efficiency Opportunities 

- Automation of manual controls
- Elimination of duplicative controls
- Consolidation of multiple controls into a more effective control
- Alteration of control frequency
- Transition from detective to preventive controls
- Alignment of numbers and complexity of controls with level of risk

- Questions?