# Presentation: 231621

## A-123 Case Study: Developing Effective Corrective Action Plans

**June 4 - 5, 2007**

**Annie Walker-Bradley**
**A-76/A-123 Program Coordinator**
**Office of the Chief Financial Officer**
**Planning and Accountability Division**

**Larry Albert**
**PricewaterhouseCoopers**

## Agenda

- Role of OMB
- Role of CFO
- Purpose of Corrective Action Plans (CAPs)
- CAP Process
- Case Study:
- Creating an Effective Corrective Action Plan
- Exercise #1 – Financial Reporting Cycle
- Exercise #2 – General Computer Controls
- Wrap-Up

- USDA 2007 Financial Management Training

## Role of OMB

- OMB Circular A-123, *Management’s Responsibility for Internal Control*, requires a formal process to evaluate and report on internal controls within USDA
- Once evaluation is complete, OMB policy directs USDA management to develop, implement, and manage remediation plans for all areas where material weakness, significant deficiencies or control deficiencies conditions exist (hereafter collectively referred to as control deficiencies)
- OMB requires USDA and its component agencies to provide quarterly updates on their CAP progress for material weaknesses
- Progress on corrective actions is included as part of USDA’s quarterly scorecard for the Improving Financial Management Initiative of the President’s Management Agenda (PMA)

- USDA 2007 Financial Management Training

## Role of CFO

- The USDA Chief Financial Officer (CFO) is responsible for policy and oversight of the Department-wide internal control program
- Internal controls are designed to eliminate fraud, waste, and abuse of the Department’s assets; and to insure the proper reporting of assets, liabilities, income, and expenses
- Internal controls are at the program, agency, and Department level
- Key factors in developing a Department-wide internal control structure include:
- Documenting controls
- Evaluating design of controls
- Testing controls operating effectiveness
- Identifying weaknesses
- Remediating internal control deficiencies
- While overall coordination of the program rests with the CFO, accountability for remediation of deficiencies is shared throughout the Department and will include processes overseen by other components, business functions, programs, and operating areas
- The CFO is committed to work with all stakeholders throughout the Department to eliminate material weaknesses thereby creating a sustainable operating process which reduces the risk of fraud, waste, and reporting errors

- USDA 2007 Financial Management Training

## Purpose of Corrective Action Plans (CAPs)

- Assists management in identifying, assessing, prioritizing, and monitoring the progress of corrective efforts for control deficiencies found in their processes and operations
- Permits management to present a comprehensive plan for correcting one or multiple control deficiencies
- Provides a means for identifying tasks that need to be accomplished and facilitate oversight to ensure accountability for results
- Serves as a management tool to address and resolve control deficiencies identified within individual USDA cycles or general computer controls
- Provides detailed view of what needs to be done to correct identified control deficiencies

- USDA 2007 Financial Management Training

## USDA’s CAP Process

- USDA has developed a formal process to be used to identify and document control deficiencies and then develop, maintain, report, and monitor remediation plans throughout the Department

- USDA 2007 Financial Management Training

## 1.  Identify, Assess and Reach Consensus on Control Deficiency

**1.  Identify, Assess and Reach Consensus on Control Deficiency**

- Control deficiencies are usually identified during a formal review process such as an annual FMFIA management assessment, A-123, Appendix A assessment, or an independent financial audit
- OMB Circular A-123 has defined the term “control deficiency” as a condition where the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis
- A “Design Deficiency” exists when a control necessary to meet the control objective is missing or an existing control is not properly designed so that even if the control operates as designed, the control objective is not always met
- An “Operating Deficiency” exists when a properly designed control does not operate as designed or when the person performing the control is not qualified or properly skilled to perform the control effectively
- Control Deficiencies vary in the level of severity and may be categorized as a material weakness, significant deficiency, or a control deficiency

*****

- USDA 2007 Financial Management Training

## 2.  Document Control Deficiency

**2.  Document Control Deficiency**

- Once consensus has been reached on a control deficiency or finding, the control deficiency must be documented
- For A-123, Appendix A assessments, all control deficiencies must be documented in the Summary of Aggregated Deficiencies worksheets included as part of the final Risk and Control Matrices (RCMs) and General Computer Control Matrices (GCCs)
- Corresponding control deficiency information must also be documented in each CAP
- Sufficient data is required within the CAP to permit oversight and tracking, as well as to provide a crosswalk back to the original source

*****

- USDA 2007 Financial Management Training

## 2.  Document Control Deficiency – Compensating Controls

**2.  Document Control Deficiency – Compensating Controls**

- Compensating controls may be considered in the evaluation and classification of a control deficiency
- Definition of a compensating control
- A control that limits the severity of a control deficiency and prevents it  from rising to the level of a significant deficiency or, in some cases, a material weakness (Statement on Auditing Standard (SAS) No. 112
- A management, operational, or technical control (i.e. safeguard or countermeasure) employed by an organization _in lieu of_ a recommended security control that provides equivalent or comparable protection of an information system
- Although compensating controls mitigate the effects of a control deficiency, they do not eliminate the control deficiency
- Only those controls that have been _tested and evaluated_ can be considered for mitigation

*****

- USDA 2007 Financial Management Training

## 3.  Prioritize Control Deficiency

**3.  Prioritize Control Deficiency**

- Prioritization of control deficiencies is a key factor in developing a CAP, particularly in allocating resources and developing schedules
- In general, control deficiencies should be prioritized for resolution based on risk, resource availability, mission impact, and other factors
- Control deficiencies should be prioritized according to the following hierarchy:

*****

| Higher Priority | Department-wide Material Weakness
Department-wide Significant Deficiency (including non-compliance with laws and regulations)
USDA Management Letter
Component Agency Material Weakness
Component Agency Significant Deficiency (including non-compliance with laws) |
| --- | --- |
| Lower Priority | Component Agency Management Letter |

- USDA 2007 Financial Management Training

## 4.  Develop CAP

**4.  Develop CAP**

- Collaborative effort between the Responsible Party (RP), Process Owner (PO), and the Senior Assessment Team (SAT) members
- May require cross-functional coordination requiring Senior Management Control Council (SMCC) support
- CAP development includes the following activities:
- Plan for the steps needed to resolve the control deficiency
- Root cause analysis should be performed by the RP, rather than relying solely on the audit finding or control deficiency
- Coordinate with management’s assessment of ICFR and FMFIA reviews
- Develop realistic timeline for corrective action milestones and for resolving control deficiencies
- Milestones should be specific, realistic, obtainable, and timed
- Milestones should show clear linkage to preceding and following milestones, if applicable
- Must be able to demonstrate progress within a reasonable time span (quarterly progress)
- Assign responsibilities for completing actions in the CAPs
- Document the control deficiency details and corrective action plan in the Department’s CAP template
- Vet the CAP internally, including SAT and other Agency stakeholders

*****

- USDA 2007 Financial Management Training

## 4.  Develop CAP:  FY07 Draft Template

**4.  Develop CAP:  FY07 Draft Template**

*****

|  |
| --- |

- USDA 2007 Financial Management Training

## 4. Develop CAP:  Highlights of Changes for FY07

**4. Develop CAP:  Highlights of Changes for FY07**

- Simplified template combines Summary and Detailed Information – only one form required for FY07
- Reduced number of data fields required
- NIST 800-53 Control References for General Computer Controls
- Ability to associate a Phase and Task / Subtask designation for each corrective action milestone
- Hardcopy signatures/approvals not required on the form.  The formal SAT member review and approval process will occur through the ADTS submission process
- Updated Corrective Action Plan Process Guide for FY07
- Submission, review, and approval process

*****

- USDA 2007 Financial Management Training

## 5.  Approve CAP

**5.  Approve CAP**

- Once the CAP is determined to contain sufficiently detailed milestones to correct the control deficiency and the CAP has been sufficiently vetted with stakeholders, the PO, SAT member, the Agency /Staff Office Head must review the CAP prior to execution
- Final CAPs should be forwarded to OCFO – Director, Planning and Accountability Division
- CAPs created as the result of the A-123, Appendix A assessment should be forwarded to the Review Team via email, and once approved, be uploaded into the A-123 Deliverable Tracking System (ADTS)

*****

- USDA 2007 Financial Management Training

## 6.  Execute Corrective Action

**6.  Execute Corrective Action**

- Once the CAP has been approved by the Department, it must be executed by the Agency
- Timely completion of corrective actions to resolve the weakness/deficiency is the most important aspect of the CAP

*****

- USDA 2007 Financial Management Training

## 7.  Monitor and Report

**7.  Monitor and Report**

- CAP activity should be monitored on a continuous basis and updated as significant events occur.  USDA currently requires a status report on milestones in the CAP on a monthly basis
- The following time intervals have been established for senior management monitoring activities:

*****

| Monthly Basis | CAP progress should be monitored by the responsible SAT member
CAP Owners required to submit status updates to the Department using the CAP Template
Process Owners prepare briefings for the OCFO, SAT, and/or SMCC (IT Issues) |
| --- | --- |
| Periodic Basis | Process owners meet with the SAT to determine if sufficient action has been taken to resolve control deficiency conditions (evidence required)
OIG may conduct audits of corrective action efforts to provide an independent assessment to support compliance with OMB Circular A-123, Appendix A |

- USDA 2007 Financial Management Training

## 8.  Validation Testing

**8.  Validation Testing**

- One critical element of each CAP is the plan for assessing the design effectiveness and to test operating effectiveness of newly implemented controls (verification and validation)
- A determination that a control deficiency has been corrected should be made only when sufficient corrective actions have been taken and the desired results achieved
- Sufficient corrective actions also must include determining whether specified controls were designed and operating effectively; and whether the controls satisfy applicable control objectives as required by OMB A-123, Appendix A

*****

- USDA 2007 Financial Management Training

## 8.  Validation Testing

**8.  Validation Testing**

- Plans to test the design and operating effectiveness that support the verification and validation of corrective actions must be approved by the Department
- Results from testing procedures must also be documented and supported by sufficient evidence which is readily available for review by OCFO, SAT, SMCC, OIG or IPA
- Use Department-provided templates for documenting the results of testing
- Maintain documents in accordance with USDA file retention procedures

*****

- USDA 2007 Financial Management Training

## 9.  QA Review and CAP Closure

**9.  QA Review and CAP Closure**

- Testing results must be submitted to and approved by the IT Weakness Quality Assurance (QA) Group and / or the OCFO Review Team prior to the Agency requesting closure of the CAP

*****

- USDA 2007 Financial Management Training

## Validation Testing Requirements

| Validation Testing Requirements |  |  |
| --- | --- | --- |
| Frequency of Control | Validation Period | Testing |
| Multiple times/day | 3 months | 45 items per month (or the entire population if fewer than 45) - 3 monthly samples |
| Daily | 3 months | All days in the month - 3 monthly samples |
| Weekly | 15 weeks | All weeks on a monthly basis for 15 weeks |
| Monthly | 6 months | Every month on a month-by-month basis for 3 months. The last three months may be tested at the end of each month or at the close of the entire three-month period. |
| Quarterly | 3 quarters | Each quarter - 3 quarterly samples |
| Annually | Annual | Once |
| Automated IT Controls that are not subject to sampling | Once | User Acceptance Testing qualifies if Change Controls are operating effectively and documentation is sufficient for A-123 assessment purposes.  If change controls are not effective, separate validation testing is required. |

- The control must pass all testing over the entire validation period to close out the identified control finding
- If the control fails during the validation testing period, a revised corrective action plan is required and the validation testing period starts over
- Validation testing may count towards fulfilling the current assessment period testing requirements and assurance results

- USDA 2007 Financial Management Training

## OCFO Reporting

- OCFO produces periodic reports to track the status of CAP activities
- Monthly reports to management monitor CAP progress, identify potential problem areas, and provide feedback to Process Owners, Responsible Parties, and other stakeholders
- RCAP Summary Reports
- RCAP Status Detailed Reports
- Annual Reports
- OMB A-123 requires the Secretary to include in the annual PAR, assurance statements related to FMFIA Section 2, Section 4, and Internal Control over Financial Reporting, along with a summary of corrective action plans for each material weakness
- Annual component agency assurance statements, CAP Summary and Detailed Status Reports maintained by POs and RPs will be used to create an executive summary of corrective actions to support the Agency/Staff Offices assurance statements and ultimately the Secretary's assurance statements

- USDA 2007 Financial Management Training

## Case Study:  Creating an Effective CAP

- Control deficiencies identified in the CAP may be combined, summarized or paraphrased for ease of tracking but should utilize the language from the original sources that identified the weakness
- Each CAP should clearly trace back to its original source(s); (e.g., an internal review finding or audit finding/recommendation)
- For complex issues, more detailed project management plans may be needed for corrective action items identified in the CAP

- USDA 2007 Financial Management Training

## Case Study:  Exercise #1 – Financial Reporting Cycle CAP Overview

- Your Agency, Agency ABC, is in the process of completing its FY07 A-123, Appendix A assessment.  During the course of testing, your testing team has identified a number of operating control deficiencies in the Financial Reporting cycle around Unliquidated Obligations (ULOs).  These deficiencies have already been classified as significant deficiencies on your Agency’s Summary of Aggregated Deficiencies (SAD) which has been submitted to the Department along with the testing results
- You have been tasked with reviewing the corresponding draft CAP which has been prepared by your Agency prior to submitting the final version to the Department.  The 7/31/07 deadline for submitting your Agency’s CAPs is rapidly approaching and you need to be confident that your CAP has been properly prepared and will be approved by the Department without the need for revisions

- USDA 2007 Financial Management Training

## Case Study:  Exercise #1 – Financial Reporting Cycle CAP Instructions

- Review the Exercise #1 handout which contains the following documents:
- Agency ABC Financial Reporting CAP
- Review the CAP and assess ways in which the CAP can be improved (review discussion questions on the following slide)
- Divide into small groups (no larger than 4 persons per group) to discuss recommended changes to the CAP
- Be prepared to share your suggestions with the larger group

- USDA 2007 Financial Management Training

## Case Study:  Exercise #1 – Financial Reporting Cycle CAP Discussion Questions

- Has the RCAP been completed fully?
- Are the documented tasks and subtasks measurable, actionable, and do they address the root cause of the issue?  How can it be improved?
- Is the timeframe for corrective action reasonable?
- Does the RCAP provide for the closure of the deficiency?  What steps need to be taken?
- As RCAPs must be vetted within each Agency prior to forwarding to the Department, what questions or concerns are various stakeholders likely to ask?
- Process Owner
- Responsible Party
- SAT Member/Agency CFO/Agency Head

- USDA 2007 Financial Management Training

## Case Study:  Exercise #2 – General Computer Controls CAP Overview

- As part of its FY06 A-123, Appendix A assessment, your Agency, Agency XYZ, identified a number of design and operating control deficiencies related to general computer controls.  While these deficiencies only warranted a control deficiency classification on your Agency’s Summary of Aggregated Deficiencies (SAD), the Department reported an IT material weakness at the consolidated Department level for FY06. As such, the Department is tracking the status of all IT-related CAPs
- You are tasked with providing the regular monthly updates to the Department.  You want to make sure that your Agency is adhering to best practices in providing regular status updates

- USDA 2007 Financial Management Training

## Case Study:  Exercise #2 – GCC CAP Instructions

- Review the Exercise #2 handout which contains the following documents:
- Agency XYZ GCC CAP
- Review the CAP and assess ways in which progress can be documented in the CAP Status Report section (review discussion questions on the following slide)
- Divide into small groups (no larger than 4 persons per group) to discuss recommended CAP documentation
- Be prepared to share your suggestions with the larger group

- USDA 2007 Financial Management Training

## Case Study:  Exercise #2 – GCC CAP Discussion Questions

- What are the CAP status reporting requirements to the Department?  What does the Department do with the information that is provided?
- What steps can an Agency take at an Agency-level to ensure progress is being made on CAPs?  Who needs to be involved in this process?
- What is the process for making changes to a CAP once an CAP has already been approved?
- When is it appropriate to record an actual completion date?  What evidence needs to exist in order to support this completion date?
- What types of explanations should be included in the Comments section?

- USDA 2007 Financial Management Training

## Wrap-Up

- Questions?

- USDA 2007 Financial Management Training