# Presentation: 250900

## DOI Annual Business ConferenceAudit Approach to OMB Circular No. A-123 

- A U D I T  /  T A X  /  A D V I S O R Y  /  L I N E   O F   B U S I N E S S

**DOI Annual Business Conference****Audit Approach to ****OMB Circular No. A-123 **

## Agenda 

- Auditors’ objective
- Consolidated level procedures
- Bureau level procedures
- Assurance statement procedures

## Auditors’ Objective

- Test for compliance with Federal Managers’ Financial Integrity Act (FMFIA) of 1982
- OMB Circular No. A-123, Appendix A provides guidance for the internal control over financial reporting of FFMIA
- Utilize managements’ documentation to assist in understanding financial reporting processes
- Consider internal control test results

**Notes:**
Utilize documentation – our teams will still need to walk through transactions and ask questions – this will help facilitate the process

Consider testing results - if a bureau concludes that they have a material weakness we would want to consider this in our audit approach

## Consolidated Level Procedures

- Gain an understanding of managements’ process
- Verify establishment of ***senior assessment team***, its authority, and members
- Verify appropriateness of ***significant financial reports*** selected
- Assess reasonableness of*** materiality assessments*** for each significant financial report
- Verify significant accounts, major transaction cycles, and the relevant financial report assertions are identified and included
- For each significant financial report

**Notes:**
Department’s process – top down

Assessment team – (1) skills, experience, and background as well as (2) the responsibility to enable implementation 

Reports selected
Includes the department PAR and quarterly reports but not the bureau PAR

CFO Council’s Implementation Guide suggests:
SF-132 – Apportionment and Reapportionment Schedule
SF-133 – Report on Budget Execution and Budgetary Resources
Program and Financing (P&F) Schedule
FMS 2108 - Year End Closing Statement

Qualitative and quantitative factors:
Sensitivity of program or balance 
Importance of balance to oversight agencies 
Relates to a segment that has been identified as playing a significant role in the organization's operations
Knowledge of past errors
Susceptibility to loss due to errors or fraud
Accounting and reporting complexities associated with the account
Precise measurement or estimate
Account masks a change in activity or other trends (i.e., an account that includes net activity)
Likelihood of significant contingencies arising from the underlying activities
Changes in account characteristics (i.e., changes a net cost into net income)
Impacts the organization's compliance with regulatory, contractual, or budget requirements 
Effects management's ability for promotion or additional compensation

## Bureau Level Procedures

- Inspect a sample of bureaus’ _***control documentation***_ to verify that it includes controls at the:
- Entity level
- Control environment, risk assessment, monitoring, control activity, and information and communication processes
- Process, transaction, and application level

**Notes:**
Entity level - Complete GAO document

## Bureau Level Procedures

- Inspect a sample of the bureau _***control documentation***_ for consistency with CFO Council’s Implementation Guide
- Controls to mitigate the risk of financial statement errors
- Data characteristics: source; receipt; processing; and transmission
- Supervisor review; process and calculations performed in preparation of financial reporting; and process outputs
- Use of computer application controls and controls over spreadsheets used in the preparation of financial reporting
- Identification of errors: types of errors found; reporting errors; and resolving errors
- Ability of personnel to override the process or controls

**Notes:**
We plan to review the documentation for a sample of processes to verify that it is consistent with the CFO Council’s implementation guide (see areas discussed in slide above)

## Bureau Level Procedures

- Inspect a sample of the internal control _***testing***__ __***documentation***_ to verify that it includes
- Management’s assessment of the design of key controls
- Nature, timing, and extent of testing of key controls
- Assessment of operating effectiveness of key controls tested
- Response and conclusions for deficiencies identified

**Notes:**
Suggested CFO Council’s Implementation Guide sample sizes, based on...
Complexity of the key control 
Frequency with which the control is performed 
Whether control is manual or automated

Manual recurring – 45
Daily – 30
Weekly – 10
Monthly – 3
Quarterly - 2
Annual - 1 

## Assurance Statement Procedures - Bureaus

- Read bureau assurance statement for conformance with Department guidance
- Based on Department materiality
- Compare managements’ and auditors’ testing results to bureau assurance statement to verify that:
- Managements’ results support the assurance statement
- Management identified all material weaknesses

**Notes:**
OMB Circular A-123 definition of material weakness
...results in more than a remote likelihood that a material misstatement of the financial statements, or other significant financial reports, will not be prevented or detected
Significant deficiencies identified under FISMA must be reported as material weaknesses in the annual FMFIA report and the agency’s annual PAR

## Assurance Statement Procedures - Consolidated

- Inspect the assurance statement to verify that it includes:
- Results of the bureau level assurance statements
- Any material weaknesses that are identified
- Statement of ***management’s responsibility*** for establishing and maintaining adequate internal controls
- Statement identifying OMB Circular A-123 as the ***framework*** used by management to conduct the assessment
- An ***assessment*** of the effectiveness of the agency’s internal control

**Notes:**
Verify assurance statement includes material weaknesses discovered...
As of June 30th and corrected as of September 30th – 
Identify the material weaknesses, the corrective action taken, and if the material weaknesses have been resolved
After June 30th but prior to September 30th – 
Include the subsequently identified material weaknesses