# Presentation: 907997

## Federal Managers’ Financial Integrity Act (FMFIA) Process for FY 2008

- Presented by: Suzanne Servis
- Director, Office of Management Assessment
- MAWG Meeting
- July 17, 2008

## Purpose of Presentation

- Describe the requirements for an annual FMFIA assessment
- Provide an overview of the FMFIA process
- Describe the changes to the FMFIA process for FY 2008
- Discuss the relationship of the FMFIA process and the NIH Risk Management Program
- Communicate the timeline for FMFIA submissions

**Notes:**
The purpose of today’s briefing is to provide you with background on the requirements of the Federal Managers’ Financial Integrity Act, as well as an outline of what will be expected from OD/IC offices to support the NIH Director’s annual Statement of Assurance.

## What does FMFIA require?

- FMFIA requires the NIH Director to annually attest (certify) in writing that there are controls in place to ensure that agency programs are:
- Effective and efficient
- Accounted for financially in a reliable and timely manner
- Administered with integrity, and consistent with high ethical standards
- Compliant with all applicable laws and regulations, including performance management
- Managed by good stewards of the assets entrusted to them
- Monitored through risk assessments to ensure controls are in place and working reasonably well

**Notes:**
FMFIA requires Dr. Zerhouni to annually assess programmatic and financial controls to ensure that business is operating effective and efficiently, while also mitigating the risks that may negatively impact the mission.

While it is impossible to mitigate all risk, Dr Zerhouni is required to provide reasonable assurance to the Secretary of HHS that effective controls are working.  If controls are not working, he is required to provide a plan of action to resolve any weaknesses.

## What is NIH required to do?

*OMB Circular A-123, Management’s Responsibility for Internal Control* and the* HHS Guidance Manual for OMB Circular A-123 Assessments* require an annual OPDIV assessment of operational and financial controls
- The NIH Director is required to assess operational and financial controls, and sign an annual Statement of Assurance

**Notes:**
OMB A-123 and the HHS guidance manual provide a framework as to how the annual assessment of controls will occur.  

While the framework provides broad guidelines for assessing programmatic controls, Ken Stith (OFM) and his staff have a very thorough process they are required to follow to assess Internal Controls over Financial Reporting.

The assessment provides Dr. Zerhouni with the information he needs to prepare the annual Statement of Assurance.

## What was the FMFIA process in previous years?

- Prior to last year, the NIH Director made the annual FMFIA assurance for all of NIH without supporting assurances from OD/ICs
- Beginning in FY 2007, OD/ICs submitted written Assurance Statements to the NIH Director
- The written Assurance Statements provided the NIH Director with some confidence that internal control or risk management activities were in place
- The OD/IC Assurance Statements included a list of internal control/risk management activities

**Notes:**
Prior to FY 2007, Dr Zerhouni submitted the Statement of Assurance without supporting Assurance Statements from OD/IC Directors.

For FY 2007, OD/ICs prepared Assurance Statements for Dr. Zerhouni that provided some confidence that internal controls or risk management activities were in place.  OD/ICs also included a list of Risk Management activities.  

## Comparison of the prior year and current year FMFIA process

- For **FY07**
- the Assurance Statement was accompanied by a summary listing and description of what the IC or OD organization did to identify and manage risks
- descriptions included risk management activities for the **two** years prior to September 30, 2007

- For **FY08**
- the Assurance Statement will be accompanied by a summary listing and *description* of what the IC or OD organization did to identify and manage risks.  The summary information will be submitted using the Assurance Support Template
- descriptions should include risk management activities for **one** year prior to September 30, 2008
- documentation should be maintained to support risk management activities

**Notes:**
Two key changes for this years process are: (1) Risk Management activities will be submitted utilizing an Assurance Support Template that will provide greater consistency for the submission and (2) OD/ICs will only be required to report on the FY 2008 Risk Management activities.

OD/ICs should maintain documentation to support the risk management activities. 

## What are the OD/ICs required to do for FMFIA in FY 2008?

- The OD/ICs will continue to make assurances asserting compliance with the FMFIA
- New for FY 2008 – OD/ICs will prepare a summary of risk management activities using an Assurance Support Template
- New for FY 2008 – OD/ICs should maintain documentation that supports their risk management activities included in their Assurance Statement

**Notes:**
This slide reiterates the submission requirements for FY 2008, highlighting what is new for FY 2008

## Slide 8

**Notes:**
This slide is the draft template for the OD Office Assurance Statement.  This document is very similar to the Assurance Statement that was required last year.

## Slide 9

**Notes:**
The Statement of Assurance Support Template provides a standardized format for the submission of risk management activities.

## Slide 10

**Notes:**
The Statement of Assurance Support Template provides a standardized format for the submission of risk management activities.

## How Can OD/ICs Make Assurances with Confidence?

- Assurances can be made with confidence by conducting risk management activities within organizations that include:
- Audits
- Inspections
- Updated policies and procedures
- Performance measures
- Security enhancements
- Disaster recovery plans
- Reliable data for management decisions

**Notes:**
This slide provides a list of risk management activities that are likely ongoing in your OD/IC.

## How does the FMFIA Assurance relate to the Risk Management Program?

- OMA is rolling out the NIH Risk Management Program in OD
- OMA will then work with ICs to implement the NIH Risk Management Program
- Results from Risk Management Program activities will support FMFIA Assurances

**Notes:**
The FMFIA process and the NIH-wide Risk Management program are very inter-related.  A strong Risk Management program will provide a strong foundation for future FMFIA activities.

As we continue to roll out the NIH-wide Risk Management, the results of our actions will support the Assurance Statements.

## How are Risk Management Officers involved with FMFIA Assurances?

- Risk Management Officers (RMO) should be involved with:
- Compiling the list of risk management activities within their organizations
- Reviewing documentation that supports the reported risk activities
- Performing quality control of the Assurance submission

**Notes:**
Recognizing that some of you are also Risk Management Officers, RMOs will play a key role in managing the OD/IC FMFIA Assurance Statements, as well as the quality of the submission of Risk Management activities. 

## Next Steps

- OMA will coordinate the assurance process and work with OD and EOs to implement the Assurance requirement
- OMA will provide OD and EOs with the Statement of Assurance Support Template to submit information
- EOs will work with IC Directors to meet the requirement
- Key dates include:
- 		 August 1—OMA request for OD/IC assurances
- 		 September 10—OD/IC assurances due to OMA
- 		 September 30—NIH Director signs agency assurance
- 		 October 2—NIH assurance sent to HHS with FMFIA report

## FMFIA Timeline

**Notes:**
The Statement of Assurance Support Template provides a standardized format for the submission of risk management activities.

## Actions Required of OD Offices/ICs

- Inform OD/IC Directors of the FMFIA process
- Establish internal deadlines to meet OD deadline dates
- Compile OD/IC risk management activities conducted and corrective actions taken with documentation to support these activities
- Use the Statement of Assurance Support Template to submit risk information
- Obtain Director’s signed assurance
- Fax and mail hard copy to OMA by September 10th
- Request technical assistance from OMA as needed

**Notes:**
The key actions from today’s meeting are:

Work with your OD/IC Directors to establish internal deadlines to meet the FMFIA timeline

Compile OD/IC risk management activities conducted and corrective actions taken with documentation to support these activities

Use the Statement of Assurance Support Template to submit risk information

Obtain Director’s signed assurance

Fax and mail hard copy to OMA by September 10th

Please do not hesitate to contact myself or my staff if you need any assistance. 

## Point of Contact:

- Suzanne Servis
- Director, Office of Management Assessment
- 301-496-1873
- ServisS@mail.nih.gov