# Presentation: 676635

## Department of Commerce A-123 Appendix A Implementation 

- Office Of Financial Management

## A-123 Implementation

- FY 2006 Recap
- FY 2007 Challenges, Approach and Highlights
- FY 2007 Implementation Schedule

## FY 2006 at A Glance

- DOC implemented a full scope A-123 assessment (testing all 12 key processes) in FY 2006.
- Leveraged existing Commerce resources to implement A-123 process (except one bureau).
- Used minimal contractor’s assistance - for work paper review  and non-financial program review.
- Worked with the CIO on testing of IT controls.

## FY 2006 A-123 Results

- DOC reported no material weakness for
-    A-123 Appendix A implementation.
- Federal Managers’ Financial Integrity Act -DOC reported one material weakness involving information technology (IT) security issues.
- Financial Statement Audit - DOC reported no material weakness, and one Reportable Condition involving (IT) security issues.

**Notes:**
Commerce continues to report a material weakness in IT security under FMFIA Section 2.  In FY2006, this weakness did not impact the agency’s internal control over financial reporting or systems.  Progress related to this issue is  tracked under the E-Gov scorecard.

## FY 2006 A-123 Lessons Learned

- Two Areas
- Documentation
- Sampling

**Notes:**
Opening
- We engaged an outside contractor to review our process  
We reviewed the financial statement auditors’ Management Letter comments

Documentation
- Unable to trace some controls documented in the process cycle memos to the key controls listed in testing programs.
- No documented rationale for deviations from overall Departmental sampling plan.
- No documentary evidence that some bureaus reviewed or performed compensating controls for findings identified in SAS 70 reports.
- Retention of Work Papers: Wide variety existed in which work papers were retained at various bureaus.
-Some bureaus did not document their explanations for why certain tests were not performed.
Sampling
-No reconciliation performed of the populations obtained to the general ledger or other type of control documents.
-No standard determination of what constituted a Non-Compliance.  The number of exceptions that could be found in a particular sample of transactions before it was considered to be a finding varied between bureaus.

Cycle Memos to Test Programs – Can do a better job of x-walking from memos to test programs.
Compensating Controls – Better Documentation
Retention – Need to standardize 

## Benefits Gained from FY 2006 Process

- Built a formal process such as Senior Management Council (SMC) and Senior Assessment Team (SAT) to oversee A-123 Process and recognize/ discuss internal control issues.
- Increased awareness and significance of internal controls throughout the Department.
- Increased knowledge of the organization and developed better understanding of organization's mission throughout the Department.
- Built stronger working relationships across divisions and organizational units.

**Notes:**
We didn’t have any areas where we identified significant issues.
There were no big surprises! No Wows.

Discussions with SAT Members ID’ed Gains
Increased Awareness of I/C
- SAT members educated program staff on the implementation and the significance of the I/Cs.

Increased Knowledge of Organization: 
Depending on the level of the participants, some were unaware of the breadth of the Department.
Built Stronger Working Relationships:
-For example, staff responsible for specific areas at a bureau (e.g. reimbursables) were exposed to other bureaus’ processes for that area, and they developed contacts with whom that could discuss issues and determine Best Practices.

## Benefits Gained from FY 2006 Process (Cont’d)

- Developed and/or improved comprehensive documentation (control templates, cycle memos, flow charts, etc.) on key process internal controls.
- Highlighted importance of not just transactional testing, but also of non-routine processes.  Historically, non-routine processes were areas that had Material Weakness and Reportable Conditions.
- Staff developed core competency of conducting A-123 Internal Controls testing.
- Provided increased support for FMFIA assurance statement.

**Notes:**
Non-Routine Processes
Grant Accrual Estimation Methodology
Environmental Liability Estimation Methodology

## Critical Success Factors

- Staff worked as a team
- Staff took ownership and pride in meeting the challenge
- Management Support from Senior Management

**Notes:**
Worked long hours
Juggled other assignments

## FY 2007 Challenges

- Making the process more beneficial and value added.
- Improving and standardizing control documentation.
- Definitional change of “Material Weakness” and “Reportable Condition.”
- Leveraging existing bureau and Department resources with minimal contractor reliance.
- Increase communication and training to all levels of the organization.

**Notes:**
Value-Added
- The FY 06 was more of a compliance exercise – redoing what the FS auditors do (i.e. a tic & tie exercise).

Standardizing Control documentation
- 13 diverse bureaus, processes similar but not always the same
- Contractor review and recommendations

Definitional Change:
- New stricter definitions will elevate findings to higher levels in FY 07, and could increase the possibility of a finding.

Leveraging Internal and External Resources
- Striking the right balance that will be neither overburden the staff or break the budget.

## FY 2007 A-123 Appendix A Approach

- High risk cycles are selected for annual testing.
- Low/Moderate risk cycles will be tested every three years with selected test procedures at specific locations or on specific sub-processes.
- Apply limited controls review assessment survey to cycles that are not being tested in a given year.

- <root/>

**Notes:**

Test Procedures at Specific Locations/Specific Sub-processes:
-Non-routine processes were selected based on issues raised in other reviews and/or by other means.
Some specific areas were selected based on our evaluation of areas identified in the Management Letter and whether or not we believe they could elevate t a significant finding (especially considering the new definitional change for MWs and RCs)
Specific areas at specific sites were selected based on individual issues identified at he site.
- 

## DOC 3-Year Plan 

- <root/>

- <root/>

- <root/>

|   | FY 2007  | FY 2008 | FY 2009 |
| --- | --- | --- | --- |
| Budget Execution |  |  | x |
| Financial Reporting | ** | x |  |
| Grants Management | A | A | A |
| Inventory | x |  |  |
| Loans |  | x |  |
| Payrolls and Employee Benefits | *** | x |  |
| PP&E  | A | A | A |
| Purchasing | x |  |  |
| Revenues | A | A | A |
| Risk Management |  |  | x |
| Treasury Management |  |  | x |
| Information System | A | A | A |

| A- Cycles to be tested annually

 |
| --- |
| x - Cycles to be tested with 3 year rotation and updated  with limited procedures (Cycle memo update/ Control Inquiries) in the off years
 |
| ** - Financial Reporting - Intragovernmental only for FY 2007 |
| ***- Additional cycle for 2 bureaus only in   FY 2007   |

## FY 2007 Appendix A Highlights

- _Follow-up to FY ‘06:_
- Modified departmental sampling plan to ensure consistency and apply statistical sample size generator for attributes sampling.
- Engaged contractor to analyze quality and consistency of all bureaus documentation, and recommend ways to standardize.
- Compiled and emphasized the importance of bureaus methodology and review processes for non-routine processes.
- Bureaus developed corrective action plans on prior year A-123 findings, and OFM obtained update on a quarterly basis to make sure planned actions are followed through.

## FY 2007 Appendix A Highlights (Cont’d)

- _FY ’07 Initiatives:_
- OFM is working with the contractor and other Federal agency to evaluate best ways for A-123 training opportunities.
- Engaged contractor to conduct a review of convenience checks.  Work is scheduled to begin in June.
- Anticipated to use the contractor to conduct a workpaper review after the completion of A-123 Appendix A Phase I testing.  A selective verification of sample testing will also be performed.

## FY 2007 Appendix A Implementation Schedule

- A-123 Appendix A Plan – February 28, 2007
- Documentation Review – May 31, 2007
- Phase I testing – May 31, 2007 *
- Phase II testing – August 17, 2007
- Preliminary Assurance Statement to OMB – September 7, 2007
- Final Assurance Statement from bureaus – October 7, 2007 to be included in the PAR by November 15, 2007
- * A few bureaus will be completed by June 30, 2007

## A-123 Contacts

- A-123 Appendix A lead, Julie Tao (jtao@doc.gov) , 202-482-0502
- A-123 Non-financial lead, Diane Haeger (_[dhaeger@doc.gov](mailto:dhaeger@doc.gov)__), 202-482-0514_
- A-123 Personal Property Review, Fred Fanning (_[ffanning@doc.gov](mailto:ffanning@doc.gov)__), 202-482-1200_

## 

 Any Questions? 

-  Any Questions?

## OMB Circular A-123 andNon-Financial Internal Controls

- OMB Circular A-123 andNon-Financial Internal Controls

- May 30, 2007

## Fiscal Year 2007 Activities

- Senior Assessment Team
- Internal Control Review Inventory
- Risk-Based Approach
- First Commerce-wide Review
- Year-end Statement

## NOAA’s Approach

- Program Internal Control (I/C) Reviews
- Comprehensive look at the internal controls for a selected program.
- Conducted by the Finance Office/Office of the CFO.
- Independence from program area.
- Steps for conducting a Program I/C Review consists of:
- Conducting a risk assessment;
- Test and evaluate internal controls;
- Report findings; and
- Monitoring (quarterly monitoring of corrective actions).
- Management Control Reviews (MCR)
- Conducted by Line and Staff Offices
- Self-assessment of their internal controls.
- Steps for conducting a MCR are similar to Program I/C Review
- Guidance issued to Line and Staff Offices prior to start of MCR.

## ITA’s Approach

- How We Got Started
- Inventory of basic programs that support ITA
- Risk assessment of programs
- Prioritization based on impact on operations
- Established ongoing Internal Control Review Program
- Approach
- Follow DOC guidelines for non-financial ICRs
- Establish cross-functional teams
- ICR report approved through the chain of command
- Action plans, critical milestones and monitoring
- Thorough documentation of event cycles
- Where We Are
- ICR schedule for FY 2007
- Continual evaluation of our program, lessons learned

## Office of Administrative Services

**Office of Administrative Services**
**A-123 Non-Financial **
**Internal Control Review**

** **

## Background

- The Department Personal Property Management Program had major deficiencies
- 11 Elements were identified and are being implemented to correct the deficiencies
- Goal is to make sure the deficiencies do not surface in the future
- Non-financial internal control review was identified as solution

- 3

## Background (Continued)

- Phase I:
- Develop checklist based on guidelines, standards, and elements
- Phase II:
- Draft checklist and conduct pilot
- Phase III:
- Bureaus conduct internal control review of personal property
- OAS contractor provides support to bureaus conducting internal review of personal property

- 4

## Work to be Done

-  Finish internal control review of OS personal property
-  Update checklist from OS lessons learned
-  Provide checklist to bureaus
- Bureaus conduct internal control based on checklist
-  OAS contractor supports bureau reviews
-  Update checklist from bureau lessons learned
- Publish final checklist and conduct internal control review every three-years

- 3