# Presentation: 718932

## PNWD A-123 Implementation

**Marty Conger, CPA**
**CFO & Director of Business Support Services**

**Notes:**
[Marty – might want to address PNWD since that’s how you are listed in agenda....Battelle’s Pacific Northwest Division, specifically PNNL...]

## Program Timeline

**Program Timeline**

**2006**

**2008**

**March**Controls identified and documented, risk assessment performed and test plans completed

**July**Testing completed (High Risk Controls)

**December 2005**DOE issued A-123 implementation guidance

**August**Assurance statement delivered as to the adequacy of the PNNL’s internal controls as of June 30

**2007**

**95% Complete****on testing and 50% Complete on remediation**

**Complete Year 2 of ****implementation plan**

**January 2008**Implementation Complete

**(of 2 year implementation)**

**Notes:**
[Marty – you could speak to the activity that occurred prior to 12/05]

## DOE Provided Information

- Suggested approach
- Schedule of deliverables and due dates
- PNNL material accounts
- Materiality threshold (0.75% of assets)
- A-123 Assessment and Reporting Tool - AART
- Entity and process level cycles/processes/subcategories

## DOE Systematic Approach to Test Processes and Controls

**DOE Systematic Approach to Test ****Processes and Controls**

- Establish Site Assessment Team (SAT)
- Determine Contractor Management Strategy
- Select Relevant Material Accounts
- Complete Site Implementation Plan

- Identify and Document Processes and Sub-Processes
- Identify and Document Sub-Process Risks and Controls
- Document Entity Risks and Controls

- Perform Risk Assessment
- Assess Process and Sub-Process Control Design Effectiveness
- Assess Entity Control Design Effectiveness

- Develop Test Plan
- Execute Test Plan
- Assess Test Results

- Develop Quarterly Reports
- Develop Final Report
- Deliver Assurance Statement

## Our Approach

- Try to combine this with the next slide

**Battelle Approach**

**Additional Support**

- Provided project management capability and staff with SOX experience
- Established Lab site assessment teams to plan, manage, and facilitate their projects according to expectations set by DOE with a common approach among Battelle managed labs
- Lab site teams responsible for documenting and testing internal controls

- Business process owners involved in the documentation and testing of internal controls in their areas
- Each lab responsible for the maintenance of their respective controls repository
- Business process owners take accountability and ownership for their internal controls

- Deloitte Touche
- SOX-specific training
- Internal Control documentation framework
- Specialist for testing IT and Entity controls
- Support facilitation of project across the Labs including use of best-in-class benchmark data and repository installation

- Grant Thornton
- Documentation and evaluation phase

**Notes:**
[Marty – first mention of SOX – might want to remind audience you’re referring to Sarbanes Oxley]

## PNNL Roles and Responsibilities

- Site Assessment Team (SAT) included:
- Chief Financial Officer
- Controller and/or A-123 Lead (if not the controller, one level below controller function)
- Other key finance staff
- Internal Audit Director (advisor role)
- SAT responsibilities:
- Select key controls & validate ranking (high, medium, low risk)
- Review control matrices
- Rate deficiencies
- A-123 Lead (Jim Cassens) responsibilities:
- Documentation
- Testing
- Reporting resources

## DOE Pre-defined Business Cycles and Processes 

**DOE Pre-defined Business Cycles ****and Processes **

- Enterprise Resource Management (ERM)
- Benefits
- Human Resources
- Payroll
- Budget to Close (B2C)
- Funds Management
- General Ledger
- Cost Management
- Funds Balance with Treasury
- Projects to Assets (P2A)
- Project Cost Management
- Property Management

- Procure to Pay (P2P)
- Acquisition
- Inventory Management
- Payables Management
- Travel
- Quote to Cash (Q2C)
- Revenue
- Receivables Management
- Entity Controls
- Company Level (EC Non-IT)
- General IT (EC IT)

**Process Controls**

## Process Leads
PNNL staff with broad financial knowledge and experience 
Coordinated between outside experts, control owners and A-123 Coordinator/team
Cycle Owner/Control Owners
Control owners and managers with specific knowledge of the processes and controls
Shared knowledge with outside experts for documentation
External Consultants
Outside experts (Grant Thornton, consultant) with specific internal control and documentation skills
Documented the controls and evaluated risks from a SOX perspective

- PNNL staff with broad financial knowledge and experience
- Coordinated between outside experts, control owners and A-123 Coordinator/team
- Cycle Owner/Control Owners
- Control owners and managers with specific knowledge of the processes and controls
- Shared knowledge with outside experts for documentation
- External Consultants
- Outside experts (Grant Thornton, consultant) with specific internal control and documentation skills
- Documented the controls and evaluated risks from a SOX perspective

**Documentation Team**

**PNNL Approach: ****Seven teams around the six DOE cycles**
**(IT separated from Entity level)**

## Documentation Approach

- Workshop Process used to gather documentation
- Narratives describing processes and controls
- Control Matrices
- Risks
- Risk assessment — inherent risk (likelihood and impact)
- Controls
- Control evaluation
- Remediation plan status (if needed)
- Flowcharts
- Documentation binders with examples

## High Risk Controls / Total Controls at Battelle Labs*

| 

Cycle | PNNL | Lab B |  | Lab C | Lab D |  |
| --- | --- | --- | --- | --- | --- | --- |
| B2C | 25 / 54 | 21 / 32 |  | 35 / 55 | 21 / 43 |  |
| P2P | 25 / 53 | 14 / 53 |  | 32 / 54 | 3 / 49 |  |
| P2A | 1 / 19 | 15 / 18 |  | 16 / 29 | 5 / 17 |  |
| Q2C | 5 / 13 | 7 / 16 |  | 11 / 26 | 27 / 33 |  |
| ERM | 22 / 53 | 11 / 30 |  | 15 / 48 | 20 / 39 |  |
| EC NON-IT | 42 / 94 | 12 / 66 |  | 1 / 40 | 9 / 43 |  |
| EC IT | 51 / 111 | 81 / 98 |  | 27 / 135 | 65 / 86 |  |
| TOTAL | 171 / 397 | 161 / 313 |  | 137 / 387 | 150 / 310 |   |
|  |  |  |  |  |  |  |

- B2C = Budget to Close	ERM = Enterprise Resource Mgmt
- P2P = Procure to Pay	EC Non-IT = Entity Controls Non-IT
- P2A = Project to Asset	EC IT = Entity Controls IT
- Q2C = Quote to Cash
- * High risk based on inherent risk, impact and likelihood.

## Testing

- Excel testing template by process
- With information like universe, sampling and results (pass/fail)
- Control tests were designed by documentation team members
- Testers
- Staff independent from control owners
- PNNL’s Internal Audit staff
- Outside Accounting Firm (General IT)
- Failures

**Our Goal: ****Remediate failure control and retest prior to July where applicable**

## Assurance Statement Letter

**Assurance Statement Letter**

## Program Implementation Status

**Program Implementation Status**

**2006**

**2008**

**March**Controls identified and documented, risk assessment performed and test plans completed

**July**Testing completed (High Risk Controls)

**December 2005**DOE issued A-123 implementation guidance

**August**Assurance statement delivered as to the adequacy of the PNNL’s internal controls as of June 30

**2007**

**Year 2**
- Execution of remediation plans
- Testing of remaining low/medium risk controls
- Retesting of selected high risk and remediated controls
- Test new/changed processes
- Clean-up
- Consistency reviews

**95% Complete****on testing and 50% Complete on remediation**

**(of 2 year implementation)**

## Accomplishments and Future Direction

**Accomplishments and Future Direction**

- Identified and documented 397 key internal controls
- Tested 375 controls
- 40 controls failed
- Only 9 were significant as reportable conditions
- Created an environment emphasizing internal controls across PNNL
- Developed 29 remediation plans and actions
- Exceeded DOE expectations
- Provided foundation for assurance process

- Full implementation
- Provide unqualified assertion on the effectiveness of controls
- Complete remediation plans
- Mechanize the documentation process
- Conduct ongoing testing (complete initial and updated controls)
- Implement and maintain improved controls

**Year 1**

**Year 2**

***“******our review of PNNL’s A-123 implementation identified the risk assessment tool as a best practice”***
- —Inspector General

**Notes:**
[[focus on impact more than status.  How is A123 helping the Lab? What risk is it mitigating?]]
[[Great assessment of internal controls to know where the strengths and weaknesses are.  Helps get us into mentality of critiques, measuring, and internal controls.]]

Sarbanes-Oxley type process for Federal Government.   Since PNNL is an integrated contractor (Government Lab), it applies to PNNL. 

Aggressive 6-7 month schedule – took industry 2 years to complete.

## Understanding, documenting and assessing internal control is a huge undertaking
Practices are often undocumented
Controls may be missing or inadequate
Interdependencies are often overlooked
Over-reliance on key personnel (management, Internal Audit, “trusted” employees) 
Process owners may not understand their responsibility for internal controls
Typical Year One Remediation Themes
Segregation of duties
Access to systems or data (quarterly access reviews, change control process)
Audit trail for performance of control activities (i.e, documented management or other non-preparer reviews)

**Observations**

**Lessons Learned**

- Understanding, documenting and assessing internal control is a huge undertaking
- Practices are often undocumented
- Controls may be missing or inadequate
- Interdependencies are often overlooked
- Over-reliance on key personnel (management, Internal Audit, “trusted” employees)
- Process owners may not understand their responsibility for internal controls
- Typical Year One Remediation Themes
- Segregation of duties
- Access to systems or data (quarterly access reviews, change control process)
- Audit trail for performance of control activities (i.e, documented management or other non-preparer reviews)

- Deficiencies can be identified early if control owners understand that documentation of control activities must exist
- Failures can be expected and may be seen as an improvement opportunity
- Key controls may not have been appropriately selected during documentation phase
- Continual evaluation required to ensure control activities mitigate risks
- Not everyone has capacity to be a tester
- Control testing is from a different perspective
- Training and education are key to control owner and tester understanding

**Learning from experience**

## Parting advice . . .

- Treat this like a program, not a project
- Tone at the Top — critical to success and sustainability
- Best practices
**Upfront training and education** on *program* requirements and expectations
- Develop **consistent standard tools and templates**
- Documentation binders, control matrices, testing templates, gap sheets
- Tester training
- Site assessment teams — senior management evaluation and assessment of control failures — rating of deficiencies
- Track gaps and corrective action plans for timely remediation — don’t wait to start fixing