# Presentation: 676656

## Really Doing More with Less	

**An Integrated Approach **
**To **
**Internal Control Reviews**
- Mary Braun, PFM
- Joe Seger, OCIO
- Thomas Martinez, PAM

## Comprehensive

- Mission Objectives
- Statutory Requirement
- Material Financial Contribution
- High Risk Area
- High Visibility Areas
- Regulatory Requirement

- Identify & chart key business processes

- Perform inherent risk assessment

- A-123
- Appendix A
- Acquisition IC
- FISMA
- Appendix B
- Appendix C
- Improper Payments
- Prompt Pay
**Program Efficiency**
**Program Effectiveness**
**Compliance**
- PART
- FFMIA

- ID mitigating
- internal controls

- Test effective controls

- Report on control risk

- Internal Control Program

- Identify Key Business Processes

- 2008

- 2009

## Program Managers’ Internal Control Model

- Program Managers’ Internal Control Model

- AU Pgm Mgr

- AU Pgm Mgr

- AU Pgm Mgr

- AU Pgm Mgr

- AU Pgm Mgr

- Program Manager

**Segment A-123 Documentation**

- Bureau Offices

- Acquisition	Accounting
- Service Provider Assist

- Bureau Offices

## Assessable Unit Managers’ Internal Control Model

- AU Manager

- Flowchart Process
- (most familiar)

- Perform Risk Analysis

- ID and assess Controls

- Prepare test plans

- Assess Controls

- SOA & CAP

- High?

- stop

- no

- yes

- Bureau
- Service User/
- Customer

- IT/FM Expertise Assist

## Office of Acquisition and Property Management Integration

- Integration of Acquisition and Internal Control Assessments
- Standardization of Processes
- PAM flowcharts of standard processes
- Acquisition
- Contracting Process
- Acquisition Planning, Solicitation, Evaluation and Award, Contract Administration
- Micro-Purchases (Non-Charge Card)
- Charge Card
- Simplified Acquisition
- Financial Assistance
- Grants and Cooperative Agreements
- Property
- Q3
- Bureau procurement chiefs individualizing documentation and flowcharts

**Notes:**
-GAO developed this framework to enable high-level, qualitative assessments of the strengths and weaknesses of the acquisition function at federal agencies. Such assessments can: * help senior agency executives identify areas needing greater management attention, and: * enable accountability organizations (including GAO) to identify areas requiring more focused follow-up work. 
What this framework is not: * A tool to evaluate specific acquisition actions, contracts, compliance with contracting laws and regulations, or a source of detailed assessment questions; 
-Financial Assistance component is going to be reviewed and tailored from the bureaus’ viewpoints.

## Office of Acquisition and Property Management Integration

- Bureau procurement offices distributing workflow process documents
- Bureau
- PAM
- Program Offices
- PAM to issue guidance with PFM support
- PAM to identify high-risk areas for PAM site visits
- Findings will be Addressed w/Corrective Action Plans
- PFM and PAM to monitor progress on Corrective Action Plan

## Office of Acquisition and Property Management Integration

## FY 2008 IT Integration

- FY 2008: Internal Control Assessments Integration
- Department’s PFM and OCIO staff cooperate in planning IT assessments
- A-123 requires testing of IT security controls
- FISMA requires testing of IT security controls
- ~25% of the controls to be tested overlap

**Notes:**
The need for the A-123 and FISMA teams communicating can not be over emphasized.  Planning in concert is critical, as we are a single team striving for the same outcome: Assurance of accuracy, security, and accountability

Currently FISMA ICR leads develop plans and PFM ICR leads develop separate plans.  This activity must be done in concert to ensure everyone understands requirements/dependencies, and agrees on deliverables and milestones.

## FY 2008 IT Integration

- FY 2008: Internal Control Assessments Integration
- System and business process owners are spending resources for testing
- Integration of testing eliminates redundancies
- FISMA and A-123 leads determine control overlap
- System/business owner and CIO integrate resources, planning, and execution costs to realize savings

**Notes:**
System owner (management) is responsible for the integrity of their process.  Integration of multiple testing efforts reduces overhead (e.g. redundancies in processes or testing).  For two years PFM and OCIO have advocated a strong interaction between A123 and FISMA efforts at the bureau-level, but simply advocating it at our level has not been effective.  System and information (business process) owners must understand that both are required, there is an overlap, and the benefit is resource efficiency to their overall system assessment costs.

## FY 2008 IT Integration

- FY 2008: Internal Control Assessments Integration
- Best Practices
- Component-level integrated planning efforts
- Single ICR POC per component gives effort cohesion
- Single contract vehicle optimizes control testing expense
- Automated tracking and reporting

**Notes:**
Planning: Cooperation in ICR procedure development is essential to integrate A-123 assessment efforts with that of FISMA. 

Complete Integration: Department level integration is only the first step, integration at the bureau or office level is crucial.

Efficiencies: There is a 25% overlap in testing requirements and systems owners must pay for both assessments as a part of their business case.  Completing this with a single resource would yield efficiencies. 

Automation: Should be realized through the integration of A-123 assessments with automated FISMA ICR tracking tools.  FISMA tool, CSAM, is planned to be in place for FY 09 FISMA ICRs.  PFM has requested funding for an automated tracking tool, but no requirements analysis or definition yet.

Discussion - "Define" and obtain necessary training for staff (e.g. FISMA testers do not necessarily know Sarbanes Oxley requirements)
- Management must "Define" change for staff to accept it, change is inevitable, but unknowns are usually put off rather than embraced
- Communication is key to integrating the efforts of IT staff at the bureau and system level (participate in the PFM meetings)

## Questions?