# Presentation: 676638

## OMB A-123 from the Internal Audit Perspective

- George Romano
- Director – Audit & Oversight
- Pacific Northwest National Laboratory

## OMB A-123(DOE Implementation)

- DOE defined materiality substantially lower than typical audit risk -- .75% of total assets
- One failure in the sample requires doubling the sample; Two failures in the expanded sample counts as a control failure.
- And you thought the internal auditors were tough!!!

## COSO

- Like SOX, OMB A-123 is based on the original COSO model.
- At this point, A-123 is primarily focused on financial reporting (Appendix A).
- Expect future modifications to A-123 to address the COSO areas of Operations and Compliance.
- Effectively, the government is mandating COSO as a standard control model.

## Internal Control Myths and Facts

_**MYTHS:**_
**Internal control starts with a strong set of policies and procedures.**
*Internal control: That’s why we have internal auditors!*
**Internal control is a finance thing.**
*Internal controls are essentially negative, like a list of “thou-shalt-nots.”*
**Internal controls take time away from our core activities of making products, selling, and serving customers.**

_**FACTS:**_
**Internal control starts with a strong control environment.**
*While internal auditors play a key role in the system of control, management is the primary owner of internal control.*
**Internal control is integral to every aspect of business.**
*Internal control makes the right things happen the first time.*
**Internal controls should be built “into,” not “onto” business processes.**

- Source: Institute of Internal Auditors, 2003

## Benefits of A-123

- Management recognition of their ownership of internal controls
- Prior audit recommendations that were dismissed as too expensive or too cumbersome are being adopted as remediation to A-123 control failures
- Encourages adoption of COSO as a control model for managing the organization

## Downside of OMB A-123

- A-123, like SOX, is an expensive and unfunded mandate; resources are being taken from other activities to perform documentation, testing and remediation.
- Like SOX, the public and perhaps the company and government is being lulled into believing that the implementation of these control models and control testing would have prevented the financial failures of Enron, WorldCom, etc. – Not so!!!
- These tests will not prevent, and may not detect, improper management overrides and collusion.

## Downside – Continued

- The current focus of SOX/A-123 is on financial reporting.
- However, the real risk to an organization is their inability to achieve their objectives.
- Focusing substantial resources in the financial reporting area may lessen resources available to achieve the organization’s objectives.
- At a minimum, the cost of SOX/A-123 makes US businesses less competitive in the world market.

## Impact of A-123 on Internal Audit

- Because of independence, Internal Audit should not be documenting management’s controls nor designing management’s control testing.
- However, like SOX, many Internal Audit groups are being asked to contribute resources to perform A-123 control testing.
- To the extent that additional Internal Audit resources are not added, other higher risk audits are not being performed.  This could cause unwanted conditions to go undetected.
- A-123, like SOX, will lessen risk aspects of financial accounting.  This will allow Internal Audit to focus attention on other parts of the organization to the extent resources allow.

## Short Term View

- It’s like Spring cleaning – a good thing to do periodically.
- Documentation of controls is useful as a basis for optimizing controls (eliminate over-control).
- A realization has occurred that management owns internal controls.
- Long-standing control weaknesses are being identified and remediated.
- New systems and changes to accounting processes will be evaluated in light of A-123/SOX to prevent future control failures.

## Longer Term View

- Management and Internal Audit resources should be focused on the larger risk to the organization – achieving organizational objectives.
- A few years after implementation, I believe substantial testing will continue to occur with little findings.  Is this the best use of the Government’s resources?

## What’s Next

- We are hearing anecdotal evidence of a few companies delisting from the NYSE to avoid SOX.
- We are seeing discussion of Congress scaling back the impact of SOX 404 on small businesses.
- So, if no new financial scandals appear over the next few years (maybe less), we will likely see substantial pressure to declare victory and scale back SOX 404.

## What’s Next – Continued

- Therefore, I believe some change in implementation is inevitable.
- We may see some relaxing of testing occur such that low and medium risk controls will be tested on some longer term cycle than annually.
- Longer term, I believe the cost of this exercise will be seen to outweigh the benefits and the testing requirements of SOX 404 and of A-123 will be eliminated or substantially reduced.

## Questions?

**Questions?**