Audit of NRC’s

Reactor Business Lines’ 

Compliance With Agency 

Non-Financial Internal 

Control Guidance

OIG-15-A-16 

June 25, 2015 

All publicly available OIG reports (including this report) 

are accessible through NRC’s Web site at

http://www.nrc.gov/reading-rm/doc-collections/insp-gen
UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, D.C. 20555-0001

OFFICE OF THE

INSPECTOR GENERAL

June 25, 2016

MEMORANDUM TO: Mark A. Satorius

Executive Director for Operations

FROM: Stephen D. Dingbaum /RA/

Assistant Inspector General for Audits

SUBJECT: AUDIT OF NRC’S REACTOR BUSINESS LINES’ 

COMPLIANCE WITH AGENCY NON-FINANCIAL 

INTERNAL CONTROL GUIDANCE (OIG-15-A-16)

Attached is the Office of the Inspector General’s (OIG) audit report titled Audit of NRC’s 

Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control 

Guidance.

The report presents the results of the subject audit. Following the May 1, 2015, exit 

conference, OIG revised the draft report to include the agency’s informal written, verbal and 

editorial comments, as appropriate. The agency reviewed the changes to the report and 

provided formal written comments to OIG on May 26, 2015, which appear in Appendix D of 

the report.

Please provide information on actions taken or planned on each of the recommendations 

within 30 days of the date of this memorandum. Actions taken or planned are subject to OIG 

followup as stated in Management Directive 6.1.

We appreciate the cooperation extended to us by members of your staff during the audit. If 

you have any questions or comments about our report, please contact me at (301) 415-5915 

or Robert K. Wild, Team Leader, at (301) 415-5948.

Attachment: As stated
Office of the Inspector General

U.S. Nuclear Regulatory Commission

Defense Nuclear Facilities Safety Board

Results in Brief

Audit of NRC’s Reactor Business Lines’ Compliance With Agency 

Non-Financial Internal Control Guidance

What We Found

NRC’s two safety business lines do not comply with the majority of the agency’s nonfinancial internal control process requirements detailed in the MD 4.4 Handbook. 

Specifically, for the required steps in the process: 

Planning: The agency did not write detailed Internal Control Plans that identify 

key elements that NRC staff would use to document organizational control 

activities. 

Assessing Risk: The process for conducting risk assessment and evaluating key 

controls excluded the identification of program operations, functions, and 

activities. 

Testing: The two safety business lines did not conduct tests of internal controls 

using the prescribed, detailed examination of a selected number of activities to 

verify the effectiveness of internal controls and to determine if the internal 

controls are, in fact, operating as intended.

Taking Corrective Actions: The two safety business lines did not write corrective 

action plans that would have evaluated test findings and determine whether the 

existing internal control is sufficient to manage risk. Furthermore, this category 

requires identification of internal control weaknesses, a responsible official,

milestones toward completion of the action, metrics which measure progress 

and remediation, and dates when these milestones will be addressed. 

Non-compliance with the non-financial internal control requirements occurs because 

business line staff are unfamiliar with the internal control process in the MD 4.4 

Handbook, business line managers do not emphasize using the MD 4.4 Handbook, and 

the business lines rely on the Office of the Chief Financial Officer for non-financial internal 

control compliance. As a result, agency managers and staff may not discover existing and 

prevent future non-financial internal control weaknesses. 

What We Recommend

This report makes recommendations that will increase compliance with agency 

programmatic, non-financial internal control guidance. Management stated their 

agreement with the recommendations in this report.

Why We Did This Review

All Federal agencies are required to 

have internal controls in place for 

both financial and non-financial 

processes. Internal controls include 

activities to ensure that agency 

programs and processes work as 

intended.

The Nuclear Regulatory 

Commission (NRC) has organized all 

NRC programs, functions, and major 

activities into internal control areas 

referred to as business lines to 

provide a consistent framework for 

assessing internal control. A 

business line is a subdivision or 

component part of an agency

program or administrative function 

that can be assessed for risks and 

allow for meaningful evaluation of 

internal control.

The audit objective was to 

determine the extent to which NRC 

has developed effective reactor 

safety business line internal control 

processes for non-financial, 

programmatic activities. 

To meet this objective, the Office of 

the Inspector General (OIG) 

assessed NRC’s Nuclear Reactor 

Safety Programs’ two reactor safety 

business lines’ (the Operating 

Reactors Business Line and the New 

Reactors Business Line) compliance 

with 76 non-financial internal 

control requirements contained in 

NRC Management Directive (MD) 

and Handbook 4.4, Internal Control.

OIG-15-A-16

June 25, 2015
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

ABBREVIATIONS AND ACRONYMS ............................................................i

I. BACKGROUND ......................................................................................1

II. OBJECTIVE ...........................................................................................4

III. FINDING ...............................................................................................4

Low Compliance With Agency Internal Control 

Requirements...................................................................................4

Recommendations.........................................................................14

IV. AGENCY COMMENTS ......................................................................15

APPENDIXES

A. OBJECTIVE, SCOPE, AND METHODOLOGY ...................................16

B. NRC BUSINESS LINE MANAGERS BY MAJOR PROGRAM.............18

C. MANAGEMENT DIRECTIVE 4.4, INTERNAL CONTROL, HANDBOOK 

SECTION III, REQUIREMENTS FOR EVALUATING PROGRAMMATIC 

INTERNAL CONTROL OVER NON-FINANCIAL OPERATIONS ............19

D. AGENCY FORMAL COMMENTS .......................................................28

E. OIG ANALYSIS OF AGENCY FORMAL COMMENTS.....................32

TO REPORT FRAUD, WASTE, OR ABUSE .................................................36

COMMENTS AND SUGGESTIONS ..............................................................36

 TABLE OF CONTENTS
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

i

CAP Corrective Action Plan

ECIC Executive Committee on Internal Control

FY Fiscal Year

GAO Government Accountability Office

ICC Internal Control Coordinator

ICP Internal Control Plan

MD Management Directive

NRC Nuclear Regulatory Commission

OCFO Office of the Chief Financial Officer

OEDO Office of the Executive Director for Operations

OIG Office of the Inspector General

PSAT Programmatic Senior Assessment Team

SAT Senior Assessment Team

TAC Task Assignment Control

 ABBREVIATIONS AND ACRONYMS
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

1

Internal controls are the plans, methods, policies, and procedures an 

organization employs to ensure effective resource use in fulfilling its 

mission, goals, objectives, and strategic plan. A quality internal control 

program promotes operational efficiency, ensures that established policies 

are followed and performed in a thorough manner, prevents fraud, 

minimizes errors, and verifies the accuracy and reliability of data.

The Nuclear Regulatory Commission (NRC) is mandated by the Federal 

Managers’ Financial Integrity Act of 1982 with the responsibility for 

establishing and maintaining effective internal control. The Office of 

Management and Budget’s Circular A-123, “Management’s Responsibility 

for Internal Control,” provides Federal agencies with guidance for 

complying with the Federal Managers’ Financial Integrity Act of 1982. In 

concert with the Government Accountability Office’s (GAO) Standards for 

Internal Control in the Federal Government, Circular A-123 also defines 

management’s responsibility for establishing and maintaining internal 

control to achieve the objectives of effective and efficient operations, 

reliable reporting, and compliance with applicable laws and regulations. 

This guidance is applicable to both financial and non-financial 

programmatic internal control.

NRC Management Directive and Handbook 4.4, Internal Control (MD 4.4), 

approved in October 2012, establishes agency policy, objectives, and 

procedures for implementing and maintaining effective internal control in 

accordance with the aforementioned mandate and guidance. NRC 

managers, supervisors, and staff at all levels are responsible for active 

participation in achieving the internal control objectives. MD 4.4 

Handbook Section III, “Assessment of Internal Control Over Program 

Operations (Non-Financial),” provides specific agency guidance for 

assessing internal control over programmatic, non-financial operations, 

which is the scope of this audit. Non-financial internal controls would 

include activities implemented to ensure that appropriate controls are in 

place so that NRC’s reactor oversight programs and processes work as 

intended. An example might be a manager who implements steps to 

ensure staff follow program guidance for operations related to reactor 

 I. BACKGROUND
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

2

licensing and inspections, in contrast with financial internal control 

guidance for financial processes related to collecting fees and preparing 

financial statements. Potential goals, examples, and impacts of nonfinancial and financial controls are differentiated in Figure1.

Figure 1

Internal Controls

Non-Financial Control Financial Control

Goals:  Ensure reactor oversight 

programs work as intended

 Protect the financial assets of the 

agency

Examples:  Supervisory approval of 

inspection plan

 Panel review of potentially 

significant inspection 

findings

 Fee received from licensee deposited in 

lockbox

 Separation of duties between billing 

and accounting

Impacts:  Does not impact agency 

financial statements

 Impacts successful conduct 

of program

 A problem with financial internal control 

may impact agency financial 

statements

 Audited during annual financial 

statement audit

Source: OIG-generated from analysis of agency documentation.

NRC has organized all NRC programs, functions, and major activities into 

internal control areas referred to as business lines to provide a consistent 

framework for assessing internal control. A business line is a subdivision 

or component part of an agency program or administrative function that 

can be assessed for risks and allow for a meaningful evaluation of internal 

control. A responsible lead office and Business Line Manager for each 

business line is tasked with assigning responsibilities to staff within the 

business line in a manner that reasonably ensures the agency’s internal 

control complies with Federal and NRC requirements. 

For example, NRC’s Nuclear Reactor Safety Major Programs consists of 

two reactor safety business lines: the Operating Reactors Business Line

and the New Reactors Business Line, which are also the focus of this 
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

3

audit. The Office of Nuclear Reactor Regulation is the responsible lead 

office for the Operating Reactors Business Line, and this office director 

serves as the Business Line Manager. Similarly, the Office of New 

Reactors is the responsible lead office for the New Reactors Business 

Line, and this office director is the Business Line Manager. For a 

complete listing of the NRC Business Line Managers by Major Program, 

see Appendix B.
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

4

 III. FINDING

The audit objective was to determine the extent to which NRC has 

developed effective reactor safety business line internal control processes 

for non-financial, programmatic activities.

To accomplish this objective, Office of the Inspector General (OIG)

auditors evaluated relevant documentation and interviewed cognizant staff 

and managers in order to ascertain NRC compliance with MD 4.4 

Handbook Section III, “Assessment of Internal Control over Program 

Operations (Non-Financial).” Appendix A contains additional information 

on the audit scope and methodology.

Low Compliance With Agency Internal Control 

Requirements

MD 4.4 Handbook Section III specifies the requirements for evaluating 

programmatic internal control over non-financial operations. However, 

NRC’s two safety business lines do not comply with the majority of the 

agency’s non-financial internal control requirements for planning, 

assessing risk, testing, and taking corrective actions because the agency 

needs to improve its internal control approach. As a result, agency 

managers and staff may not discover existing and prevent future nonfinancial internal control weaknesses.

 II. OBJECTIVE
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

5

Agency Policy Requires Internal Control Planning, Assessing Risk, 

Testing, and Taking Corrective Action

MD 4.4 Handbook Section III provides 76 requirements1 for evaluating 

programmatic internal control over non-financial operations, and identifies 

management and staff roles and responsibilities for implementing internal 

control activities. MD 4.4 Handbook Section III describes the agency’s 

process for assessing programmatic, non-financial internal control and 

includes requirements associated with the following four steps:

2

Step 1 – “Plan the Overall Process, Develop, and Update Internal Control 

Plan (ICP).” ICPs are executive summaries of an office’s approach to 

implementing an effective internal control program. MD 4.4 Handbook

Section III includes 25 internal control planning requirements. 

Step 2 – “Conduct Risk Assessments and Evaluate Controls.” A “risk” is 

anything that endangers the achievement of an objective. MD 4.4

Handbook Section III contains 25 requirements for NRC to identify, 

analyze, and manage potential risks using a comprehensive screening 

process for the identification of potential problems or risks from both 

internal and external sources, referred to as “risk assessment.”

Step 3 – “Test Programmatic Internal Control.” Testing is detailed 

examination of a selected number of transactions for a specific assessable 

unit3 to verify the effectiveness of internal controls in operation by 

determining if they are, in fact, operating as intended, meeting the control 

objectives, and reducing risks. MD 4.4 Handbook Section III contains 10 

test and document program control requirements.

 1 Appendix C includes a list of the 76 requirements OIG identified in MD 4.4 Handbook Section III.

2 MD 4.4 Handbook Section III also includes a Step 5, “Submit Assurance Statement.” OIG did not 

evaluate Step 5 as part of this audit because it is based almost entirely on Handbook Section V, which is 

focused on submitting reasonable assurance statements and thus was out of scope for this audit.

3 NRC has designated its assessable units to be NRC’s Business Lines. The term assessable unit

manager is synonymous with the NRC Business Line Manager. For the purposes of this report, OIG 

replaced the term, “assessable unit” with the term, “business line.” 

What Is Required
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

6

Step 4 – “Report the Results and Take Corrective Actions.” The next 

assessment category is for NRC managers to evaluate their test findings 

and determine whether the existing internal control is sufficient to manage 

the risk. Furthermore, this category requires Business Line Managers to 

write a statement of the corrective actions related to a weakness or 

recommendation. This statement, referred to as a corrective action plan

or CAP, is to include a responsible official, milestones toward completion 

of the action, metrics which measure progress and remediation, and dates 

when these milestones will be addressed. In all, MD 4.4 Handbook

Section III provides 16 internal control evaluation and corrective action 

requirements.

The Majority of Agency Non-Financial Internal Control Evaluation 

Requirements Are Not Met

NRC’s two reactor safety business lines do not comply with the majority of 

MD 4.4 Handbook Section III requirements for evaluating non-financial,

programmatic internal controls. This is true within each of the four 

categories of internal control requirements described above. Figure 2 

summarizes the agency’s compliance with MD 4.4 Handbook Section III

requirements. 

What We Found
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

7

Figure 2

Low Compliance With MD 4.4 Internal Control

Requirements

Plan, Develop,

and Update 

Internal Control 

Plan 

25 Requirements

Conduct Risk 

Assessment/Evaluate 

Key Controls

25 Requirements

Test Program 

Controls 

10 Requirements

Report Results/Take 

Corrective Action

16 Requirements

Operating 

Reactors 

Business Line

28% 28% 0% 0%

New Reactors 

Business Line

28% 28% 0% 0%

Source: OIG-generated figures from analysis of agency documentation.

Step 1 - Plan, Develop, and Update ICP 

The reactor safety business lines do not meet the majority of requirements 

for compliance with internal control process planning. Of the 25 

requirements for planning, developing, and updating ICPs contained in 

MD 4.4 Handbook Section III, the two NRC reactor safety business lines 

each comply with 7 requirements, which equates to 28-percent 

compliance. 

The Operating Reactors Business Line and New Reactors Business Line 

ICPs do not identify key elements that NRC staff would use to document 

organizational control activities. Specifically, the ICPs do not have the 

required executive summary with an introduction, agency mission, 

organizational structure, and management’s key internal controls sections 

that would identify internal control information, such as the business lines’

• Approach for implementing an effective internal control program. 

• Commitment to maintaining effective internal control.

• Mission and mandate, citing applicable statutory references.
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

8

• Executive manager names and titles, number of employees, and key 

staff and their responsibilities for providing technical support and 

assistance.

• Schedule of planned reviews that would be conducted within a 

specified 5-year timeframe. 

Step 2 - Conduct Risk Assessments and Evaluate Controls

The reactor safety business lines do not meet the majority of MD 4.4 

Handbook Section III requirements for conducting risk assessment and 

evaluating key controls requirements. Of the 25 requirements for 

conducting risk assessment and evaluating key controls in MD 4.4 

Handbook Section III, the two NRC reactor safety business lines each 

comply with 7 requirements, which equates to 28-percent compliance. 

Primarily, the Operating Reactors Business Line and New Reactors 

Business Line processes for conducting risk assessments and evaluating 

key controls excluded identifying their program operations, including all of 

the organization’s functions or activities. Furthermore, neither business 

line (1) assessed and evaluated risk categories to determine whether 

existing or previously completed corrective action should be revised, (2) 

identified how it would update the risk assessment when the business line 

was impacted by changes affecting risk or controls, or (3) identified which 

high risk activities would be reviewed more frequently and which low risk 

activities will be reviewed once every 3 to 5 years. 

Step 3 - Test Programmatic Internal Control

The reactor safety business lines meet none of the 10 MD 4.4 Handbook 

Section III requirements for testing program controls. Unable to locate 

internal control testing documentation or procedures, OIG auditors queried 

seven business line and program managers about locating such 

documents. The managers variously stated that the agency did not 

conduct tests of programmatic internal controls, or they were not certain 

about testing. Office of the Chief Financial Officer (OCFO) staff later 

provided documentation on behalf of the Operating Reactors Business 

Line and New Reactors Business Line which was described as the first 

two internal control tests. However, OIG concluded that these documents 

do not meet the requirements for testing because the two topic areas—

specifically, Rulemaking and Homeland Security—are not identified as 

internal control activities in the Operating Reactors and New Reactors 

Business Lines’ ICPs and/or risk assessments.
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

9

Step 4 - Report the Results and Take Corrective Actions

The reactor safety business lines met none of the 16 MD 4.4 requirements 

for evaluating test results and taking corrective actions. Principally, the 

two business lines did not develop and write corrective action plans 

although the Operating Reactors Business Line and New Reactors 

Business Line identified abbreviated corrective actions on their ICPs. 

Management and Staff Representation of Internal Controls

At the May 1, 2015, exit conference, NRC management officials 

acknowledged that the two reactor business lines are not in complete 

compliance with MD 4.4 Handbook Section III. However, they explained 

that NRC addresses these requirements through established programs for 

self-assessment and oversight of licensee safety. The agency provided 

multiple examples—such as the Reactor Oversight Process Annual SelfAssessment—that the agency believes demonstrate a rigorous 

programmatic internal control environment. 

OIG acknowledges that some of the agency’s examples may constitute 

rigorous internal controls. However, the scope of this audit was not to 

evaluate whether the agency’s non-financial internal controls were 

adequate, but rather the effectiveness of the agency’s non-financial 

internal control processes as implemented through the MD 4.4 Handbook 

Section III. As such, OIG evaluated whether the agency’s implementation 

of non-financial internal controls incorporates the identification of program 

risk areas and control needs, followed by documenting, testing, and 

revising the internal controls over program functions and workflows, as 

required. OIG found that the agency’s examples of programmatic 

activities are not assessed as part of an overall, systematic review of 

controls as outlined in MD 4.4 Handbook Section III. Therefore, in most 

cases, OIG could not appropriately credit the agency with meeting MD 4.4 

Handbook Section III requirements.
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

10

Internal Control Approach Needs Improvement

The two reactor safety business lines are not in compliance with the nonfinancial internal control requirements in MD 4.4 Handbook Section III

because its internal control approach needs improvement, characterized 

by the following:

• Lack of agency managers’ emphasis on the importance of using the 

procedures identified in MD 4.4 Handbook Section III to carry out nonfinancial internal control processes.

• Reliance on the OCFO for non-financial internal control compliance. 

• Staff unfamiliarity with the internal control process in MD 4.4 Handbook 

Section III.

Lack of Emphasis on the Importance of Non-Financial Internal Controls

There is a lack of emphasis on non-financial internal control processes, as 

stated in MD 4.4, in the two reactor business lines, especially when 

compared with the agency’s implementation of internal controls over 

financial reporting. For example, MD 4.4, Internal Control, outlines both 

Senior Assessment Team (SAT)4 and Programmatic Senior Assessment 

Team (PSAT)5 roles. However, agency senior managers opted to not 

establish the PSAT which, under the direction of the Office of the 

Executive Director for Operations (OEDO), would have been charged with 

overseeing the non-financial internal control program operations. An NRC 

official explained that at one time, OEDO had responsibility over the 

implementation of non-financial programmatic internal controls but did not 

take the same rigorous approach towards implementing the internal 

control process as OCFO does with internal controls related to financial 

reporting. 

 4 The SAT is an oversight board led by the Chief Financial Officer and composed of program executives 

who are tasked with directing the assessment of internal controls over financial reporting. 

5 The PSAT was to have similar duties as the SAT, with the exception of overseeing areas pertaining to 

financial reporting. The PSAT is meant to be led by the Office of the Executive Director for Operations, 

which also designates the members of the PSAT. 

Why This Occurred
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

11

Additionally, the non-financial internal controls process is not integrated 

into daily work. Both the Operating Reactors and New Reactors Business 

Lines wait for OCFO to prompt them for the annual assessment of internal 

controls before performing any internal control-related actions, rather than 

working on them throughout the year. An NRC official described the 

internal control process as a corporate support activity that technical staff 

view as not being part of the NRC mission, “which is considered the ‘real 

work’ of the agency.” 

Another indicator of a lack of emphasis on non-financial internal controls is 

demonstrated by how the business line managers take a reactive rather 

than proactive approach towards the non-financial internal control 

process. NRC managers described a reactive approach towards the 

internal control process where internal control weaknesses are not 

proactively identified and corrected until the weaknesses have already 

occurred. This is evidenced, for example, by the Operating Reactors 

Business Line’s ICP, where the majority of control activities are derived 

from the GAO, OIG, and other external entity reviews. 

A final indicator of lack of emphasis on non-financial internal control can 

be derived from payroll data. NRC has established a Task Assignment 

Control (TAC)6 code for tracking hours performed working on non-financial 

internal controls; however, it is rarely used. The total hours for the entire 

agency’s non-financial internal controls TAC code were relatively minor, at 

approximately 574 hours, between fiscal year (FY) 2013 and FY 2014 

(FY13 and FY14). In comparison, the Operating Reactors Business Line 

charged a total 2,520,909 hours to all TAC codes, while the New Reactors 

Business Line charged a total 1,002,378 hours to all TAC codes for FY13 

and FY14, and OIG could find no evidence of those business lines using 

the non-financial internal controls TAC code at all. Agency management 

stated in informal written comments to the discussion draft report that the 

agency’s internal controls are woven into the fabric of the staff’s routine, 

daily work. As such, the staff submits the time spent on internal controls 

through the TAC codes that report their daily work. Even if fully 

implementing MD 4.4, managers said they would not expect their staff to 

charge such activities under the internal control TAC codes, but rather as 

the mission critical work that they are. Agency managers further stated 

that TAC charges are not now, and will not become, an indicator of 

internal control level of effort. 

 6 TAC codes are used by NRC as part of the time and labor process to track work and hours allocated.
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

12

Reliance on OCFO for Non-Financial Internal Control Compliance

OEDO and the two nuclear reactor business lines rely on OCFO for 

compliance with the internal control process, even though MD 4.4 

Handbook Section III designates OEDO and the business lines with nonfinancial internal controls oversight responsibilities. For example, contrary 

to MD 4.4 Handbook Section III’s specific guidance for conducting risk 

assessments, OEDO and the business lines have relied on OCFO to 

conduct the initial risk assessments for non-financial internal controls. In 

addition, business lines rely on OCFO to issue internal control guidance 

and maintain the documentation regarding the internal control process, 

even for programmatic business lines. 

Moreover, the agency’s organizational structure for internal controls gives 

the appearance that internal control compliance is mainly a function and 

responsibility of the OCFO. Specifically, the Internal Controls and 

Planning Branch—which is the branch charged with leading and executing 

the agency’s Programmatic Internal Control Program—is located within 

OCFO’s Budget Division. Agency managers state that NRC’s internal 

control is centralized in OCFO to establish and maintain the program, 

provide oversight, coordinate activities and reporting, and to prevent 

duplication of efforts. However, the GAO guidance indicates that nonfinancial internal controls should not be viewed as a strictly budgetary 

function.

Staff Unfamiliarity With the Agency’s Internal Control Process

NRC staff and managers conveyed a lack of familiarity regarding the 

internal control process in MD 4.4 Handbook Section III. NRC managers 

interviewed by OIG for this audit all stated that guidance documents are 

essential for internal controls. The internal control process in MD 

Handbook 4.4 Section III would require that if guidance is an internal 

control, then guidance would need to be assessed for risk, tested, and 

have a corrective action plan. Managers did not convey or provide 

documentation that indicates how guidance is assessed for risk, tested, or 

has corrective action plans. Additionally, one manager had no knowledge 

of MD 4.4 and its requirements. 

To better understand the lack of familiarity with internal controls, OIG 

reviewed the agency’s training requirements for internal controls. 

Currently, NRC does not have any mandatory, standalone internal control 

training or guidance for all managers and staff that emphasizes the 
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

13

importance of internal controls. Moreover, internal control training is not 

covered in the NRC’s formal development programs, such as the Nuclear 

Safety Professional Development Program, Leadership Potential Program, 

or the Senior Executive Service Candidate Development Program.

Non-Financial Internal Control Weaknesses May Not Be Discovered 

and Addressed

Given the lack of emphasis on adherence to MD 4.4 Handbook Section III 

non-financial internal control processes, NRC managers and staff may not 

discover existing and prevent future non-financial internal control 

weaknesses that would help to achieve programmatic goals. In not 

complying with MD Handbook 4.4 Section III, agency managers and staff 

are missing the opportunity as the subject matter experts over NRC 

programs to self-identify internal control weaknesses. By not following the 

non-financial programmatic internal control process and not mapping NRC 

programs/processes to an internal control assessment, NRC is potentially 

at risk for having unknown internal control weaknesses in program/process 

areas that have not been assessed. With a weak non-financial 

programmatic internal control process, NRC may lose a valuable tool to 

ensure that agency objectives are met within the New Reactors Business 

Line and Operating Reactors Business Lines.

Furthermore, the reactor business lines will likely continue to receive a 

high percentage of audit recommendations related to internal controls if 

the business lines do not adhere to rigorous non-financial internal control 

processes, such as that outlined in MD 4.4 Handbook Section III. 

Historically, approximately 64 percent of OIG’s findings for audits 

conducted in the two reactor business lines were attributable to internal 

control deficiencies. A change in the agency’s approach to its nonfinancial internal control processes can help the agency improve its overall 

controls and likely result in fewer OIG internal control findings.

Why This Is Important
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

14

Recommendations

OIG recommends that the Executive Director for Operations:

1. Implement NRC Management Directive and Handbook 4.4, Internal 

Control, non-financial internal control requirements.

2. Implement steps that hold program managers and staff accountable for 

meeting their responsibility for adhering to internal controls.

3. Develop internal control training and guidance to include mandatory 

standalone courses for managers and staff, and incorporate internal 

control responsibilities in the NRC formal developmental programs.
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

15

 IV. AGENCY COMMENTS

On April 16, 2015, OIG provided the agency with a discussion draft of this 

report, prior to the exit conference which has held on May 1, 2015. 

Subsequently, agency management provided supplemental information 

via informal written and verbal comments that have been incorporated into 

this report, as appropriate. 

On May 26, 2015, agency management provided formal comments to the 

draft report that indicated agreement with the recommendations contained 

in the audit report. Appendix D contains a copy of the agency’s formal 

comments. Appendix E contains OIG analysis of the agency’s formal 

comments. 
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

16

Appendix A

Objective

The audit objective was to determine the extent to which NRC has 

developed effective reactor safety business line internal control processes 

for non-financial, programmatic activities. 

Scope

The audit focused on assessing NRC’s implementation of the nonfinancial, programmatic internal control process indicated in MD Handbook 

4.4 Section III for the two business lines in the Nuclear Reactor Safety 

Major Program: the Operating Reactors Business Line and the New 

Reactors Business Line. The scope was also limited to the review of 

information pertaining to FY13 and FY14.

We conducted this performance audit at NRC headquarters in Rockville, 

MD, from September 2014 through March 2015.

Methodology

To evaluate NRC’s compliance with non-financial internal control 

processes outlined in MD 4.4 Handbook Section III, OIG reviewed relevant 

Federal laws, standards, regulations, and agency guidance. Specifically, 

OIG assessed the compliance with MD 4.4 Handbook Section III, 

“Assessment of Internal Control Over Program Operations (NonFinancial)” which provides specific step-by-step agency guidance for 

assessing internal control over programmatic, non-financial operations. 

Auditors broke-down the requirements in MD 4.4 Handbook Section III by 

(1) the step in the process; (2) the office, manager or staff responsible for 

meeting the requirements; and (3) whether the narrative indicates that the 

item “must,” “shall,” “will,” is a “goal,” is “critical,” and/or “should” be 

completed. 

 OBJECTIVE, SCOPE, AND METHODOLOGY
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

17

Accordingly, OIG auditors reviewed the Operating Reactors Business Line 

and the New Reactors Business Line internal control plans, risk 

assessments, and performance measurement documentation. Auditors 

also interviewed staff from the Operating Reactors Business Line, the New 

Reactors Business Line, OCFO, and OEDO to obtain their perspectives 

and opinions on how they meet the non-financial, programmatic MD 4.4 

Handbook Section III requirements, to ascertain their internal control 

practices, and to collect supporting documentation. 

To further address the audit objective within the scope of this audit, 

auditors attended the FY14 4th quarter performance review meeting to 

observe the presentations of the Operating Reactors and New Reactors 

Business Line leads’ 4th quarter performance and related activities. These 

presentations included agencywide and crosscutting issues; follow-up on 

“parking lot” items as appropriate; discussion of challenges and how they 

will impact the future performance of the business line; and discussion of

high level accomplishments of the business line. Additionally, auditors 

attended a presentation from a GAO management official to better 

understand the 2014 revision to GAO Standards for Internal Control in the 

Federal Government (Green Book) and to obtain insight into non-financial 

internal controls. 

Internal control processes within MD 4.4 Handbook Section III as related 

to the audit objectives were reviewed and analyzed. Throughout the audit, 

auditors were aware of the possibility of fraud, waste or abuse in the 

program.

We conducted this performance audit in accordance with generally 

accepted government auditing standards. Those standards require that 

we plan and perform the audit to obtain sufficient, appropriate evidence to 

provide a reasonable basis for our findings and conclusions based on our 

audit objectives. We believe that the evidence obtained provides a 

reasonable basis for our findings and conclusions based on our audit 

objectives. 

The audit was conducted by R.K.Wild, Team Leader; Kevin Nietmann, 

Senior Technical Advisor; Vicki Foster, Audit Manager; Avinash Jaigobind, 

Senior Auditor; Tincy Thomas, Senior Auditor; Ebaide Esoimeme, Auditor;

and Meredith Johnson, Student Analyst.
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

18

Appendix B 

Source: NRC Management Directive 4.4, Internal Control

The Office of Federal and State Materials and Environmental Management Programs (FSME) was merged with the 

Office of Nuclear Material Safety and Safeguards (NMSS). 

NRC renamed the Office of Human Resources (HR) as the Office of the Chief Human Capital Officer.
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

19

Appendix C

MANAGEMENT DIRECTIVE 4.4, INTERNAL CONTROL, HANDBOOK SECTION III, 

REQUIREMENTS FOR EVALUATING PROGRAMMATIC INTERNAL CONTROL OVER 

NON-FINANCIAL OPERATIONS

Appendix C-1, MD 4.4 Handbook Section III Requirements7 for Planning the 

Overall Process, Develop and Update Internal Control Plan

Requirement

Met

Operating 

Reactors 

Business

Line 

New 

Reactors 

Business 

Line

1. OEDO is to provide guidance to the Operating Reactor Business Line Managers 

on developing performance plans and performance reports. 

Yes Yes

2. Business Line is to submit performance plan to the OEDO. Yes Yes

3. Business Line performance plan is to provide a summary of activities that 

structure the baseline workload for a business line to accomplish the NRC 

Strategic Plan goals and strategies.

Yes Yes

4. Each Business Line Manager is to develop the ICP for the Business Line. No No

5. The Business Line ICP is to include internal control related to programmatic 

operations. 

Yes Yes

6. The Business Line ICP is to include internal control related to administrative 

operations. 

Yes Yes

7. The Business Line ICP is to include internal control related to financial 

operations.

No No

8. The Business Line ICP must include an introduction section that identifies NRC 

Business Line key staff and their responsibilities for providing technical support 

and assistance. 

No No

9. The Business Line ICP must include an introduction section that identifies other 

internal control contacts or team members.

No No

 7 When MD Handbook Section III is ambiguous or silent on the subject of a requirement, OIG asserts that 

the following applies:

A. In accordance with MD 4.4, the policies in MD 4.4 apply to all NRC employees. NRC managers, 

supervisors and staff at all levels are responsible for active participation in achieving the objectives of 

this directive. 

B. Also, in accordance with MD.4.4, NRC managers must follow the five GAO standards contained in 

GAO Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1), and 

managers must incorporate the GAO standards into their daily operations and assessment 

documentation.
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

20

Appendix C-1, MD 4.4 Handbook Section III Requirements7 for Planning the 

Overall Process, Develop and Update Internal Control Plan

Requirement

Met

Operating 

Reactors 

Business

Line 

New 

Reactors 

Business 

Line

10. The Business Line ICP narrative in the introduction section must address the 

type and frequency of internal control evaluations. 

Yes Yes

11. The Business Line ICP must include an introduction section that addresses the 

commitment to maintaining effective internal control. 

No No

12. The Business Line ICP must include an introduction section that identifies how 

recommendations for improvement are managed. 

No No

13. The Business Line ICP must include an agency mission section that states the 

Business Line mission and mandate and cite applicable statutory references. 

No No

14. The Business Line ICP must have an organizational structure section that 

includes the names and titles of executive management and discusses agency 

programs, the number of employees, and the organization’s internal plan. 

No No

15. The Business Line ICP must include a management’s key internal control 

concepts section that discusses philosophies and actions already being 

performed by the Business Line that significantly strengthens the agency’s 

overall control environment. 

No No

16. The Business Line must incorporate the Business Line’s governance document 

in the management’s key internal control concepts section of their ICP.

No No

17. The Business Line must include in a management’s key internal control concepts 

section of their ICP, an inventory of the office’s and the region’s assessable units 

along with assigned risk ratings.

No No

18. The Business Line must include in a management’s key internal control concepts 

section of their ICP, an inventory of the office and the regions’ assessable risks 

including the name of the assessable unit manager and Internal Control 

Coordinator (ICC).

8

No No

 8 OCFO staff indicated that they serve as the ICCs. However, according to MD 4.4, each office should 

have an ICC whose role is to plan, direct, and control the evaluation process, but they do not. NRC 

employees retain primary responsibility for program operating performance. The ICC should be a senior 

staff with clear authority, delegated from the office director to establish and oversee effective internal 

control processes. Each ICC has the following responsibilities:

(a) Ensures the standardization of information.

(b) Oversees the tracking of processes across their office or region.

(c) Leads the review of internal control within the office or region.

(d) Prepares the internal control plans and reasonable assurance certifications for signature.

(e) Recommends corrective actions, as necessary.
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

21

Appendix C-1, MD 4.4 Handbook Section III Requirements7 for Planning the 

Overall Process, Develop and Update Internal Control Plan

Requirement

Met

Operating 

Reactors 

Business

Line 

New 

Reactors 

Business 

Line

19. The Business Line must include in a management’s key internal control concepts 

section of their ICP, an inventory of the office and the region’s assessable risks 

including the type and year of prior internal control reviews (ICRs), selfassessments, independent program evaluations, and audits.

No No

20. The Business Line must include in a management’s key internal control concepts 

section of their ICP, an inventory of the office and the region’s assessable risks 

including a schedule of planned reviews (i.e., interval evaluations that will be 

conducted within a specified 5-year timeframe).

No No

21. Managers are to include in the Performance and Accountability Report (PAR), 

extensive information about NRC mission, goals, programs, performance 

measures, and recent financial statements. 

Yes Yes

22. Managers are to include in the PAR, a sound background for understanding key 

elements of NRC and its mission that affect risk and the design of internal 

control. 

No No

23. The Business Line is to make special arrangements with the Executive 

Committee on Internal Control (ECIC),

9 Chairman, and Co-Chairman regarding 

classified activities in the ICP, in order to protect the evaluation process and the 

classified materials.

No No 

24. The Business Line is to manage the reporting of classified activities, included in 

the ICP, on a need-to-know basis.

No No

25. The responsible organization must keep all documentation resulting from an 

evaluation of reported classified activities included in the ICP. 

No No

 9 The ECIC is the NRC senior management council, chaired by the Executive Director for Operations and 

co-chaired by the Chief Financial Officer, whose membership includes senior agency managers, that are

responsible for assessing, monitoring, and providing general oversight of all agency internal control.
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

22

Appendix C-2, MD 4.4 Handbook Section III Requirements for Conducting Risk 

Assessment and Evaluating Key Controls

Requirement

Met 

Operating 

Reactors 

Business

Line

New 

Reactors 

Business 

Line

1. Managers are to use any of the following methods to identify potential risks:

10 (a) 

qualitative and quantitative ranking activities, (b) issues identified during 

management conferences or meetings, (c) forecasting and strategic planning, (d) 

consideration of previous audit findings.

Yes Yes

2. Managers need to ask, “What could go wrong?” during the risk identification 

process.

Yes Yes

3. Managers need to ask, “Which assets do we need to protect?” during the risk 

identification process. 

No No

4. It is critical for managers to determine from the assessment whether NRC had any 

risk level changes in the organization from one period to another or as the result 

of program or statutory changes.

Yes Yes

5. It is critical for managers to determine from the assessment whether existing or 

previously completed corrective action should be revised if the risk has not been 

minimized or it has increased.

No No

6. The Business Line Manager is responsible for conducting risk assessments and 

analyzing potential risks associated with their program area.11

No No 

7. The Business Line Manager is to identify, in the risk assessment, internal and 

external risk that could have prevented the organization from meeting its 

objectives.

No No 

8. The Business Line is to update its risk assessment when the Business Line is 

impacted by changes affecting risk or controls to support the reasonable 

assurance certification. 

No No

9. The Business Line Manager is to respond to the guidance. No No 

10. The Business Line Manager is to establish the Risk Assessment rating for its 

Business Line and use the Risk Assessment rating for the baseline documentation 

in determining areas that will be reviewed and the frequency of review. 

No No 

11. The Business Line Manager is to identify which high risk activities would be No No

 10 A risk is anything that endangers the achievement of an objective.

11There was no evidence that the Business Line Managers developed or concurred on the FY 2013 

Operating Reactors Business Line and New Reactors Business Line risk assessments.
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

23

Appendix C-2, MD 4.4 Handbook Section III Requirements for Conducting Risk 

Assessment and Evaluating Key Controls

Requirement

Met 

Operating 

Reactors 

Business

Line

New 

Reactors 

Business 

Line

reviewed more frequently.

12. The Business Line Manager is to identify which low risk activities will be reviewed 

once every 3-5 years.

No No

13. Managers are to establish business lines and identify the responsible manager for 

the business line that is referred to as an internal control area and a subdivision or 

component part of a program or administrative function that can be assessed for 

risks. 

No No

14. Managers are to establish business lines and identify the responsible manager for 

all NRC programs, functions, and major activities that must be included in the 

business line to allow for a meaningful evaluation of internal control. 

No No

15. Managers are to document internal control within each business line. No No

16. Managers are to establish business lines and identify the responsible manager for 

the goal of ensuring that all organization’s functions or activities are included in 

the business line. 

No No 

17. Managers are to identify agency programs and functions that cut across 

organizational boundaries, e.g., contracting, research, budget formulation and 

execution, and support to various technical programs.

Yes Yes

18. The Business Line Manager is to assign the level of risk for programs within their 

business line. 

No No

19. The Business Line Manager after assigning the risk levels is to then consider the 

control activities (i.e., regulations, procedures, business process improvements) 

for mitigating those risks. 

No No

20. OCFO is to provide Business Line Managers with specific guidance on conducting 

the risk assessment in a memorandum annually or when needed. 

Yes Yes

21. OEDO is to provide the Business Line Manager with specific guidance on 

conducting the risk assessment in a memorandum annually or when needed.

No No 

22. Business Line Managers are to interview and involve other senior operational 

managers in order to document key controls, including the following: (i) the types 

and the flow of program operations, and (ii) the persons involved in program 

operations and the related control features, such as reviews and approvals, and 

measures to assess program performance.

No No
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

24

Appendix C-2, MD 4.4 Handbook Section III Requirements for Conducting 

Risk Assessment and Evaluating Key Controls

Requirement

Met

Operating 

Reactors 

Business

Line

New 

Reactors 

Business 

Line

23. OCFO is to provide specific guidance to Business Line Managers on internal 

control documentation requirements. 

Yes Yes

24. OEDO is to provide specific guidance to Business Line Managers on internal 

control documentation requirements.

No No

25. The ICC is to request that the Business Line make the following records available: 

(i) flowcharts, (ii) policies and procedure manuals, (iii) desk procedure manuals, 

(iv) position descriptions, (v) business unit organizational charts, and (vi) output 

reports.

Yes Yes
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

25

Appendix C-3, MD 4.4 Handbook Section III Requirements for Testing Program 

Controls

Requirement 

Met

Operating 

Reactors 

Business

Line

New 

Reactors 

Business 

Line

1. Managers are to conduct internal control assessments. No No

2. Managers are to conduct appropriate tests of programmatic internal control using 

either Internal Control Review or Alternative Internal Control Review for all control 

evaluations. 

No No

3. Managers are to reassess internal controls following modifications of the 

organization such as reorganization, realignment or any other event that would 

have triggered the need for an assessment of internal control. 

No No

4. Managers are to use a variety of techniques to test internal control and gather 

evidence. 

No No

5. Staff is to use any of the following methods to test internal controls: document 

analysis, transaction testing, observation, and interview. 

No No

6. The internal control team12 is to perform required testing based on assessment of 

the agency’s overall control environment. 

No No

7. Business Line internal control team is to perform required testing based on the 

significance of the business cycle, process or activity to the agency’s missions. 

No No

8. Business Line Managers are primarily responsible for ensuring that reviews are 

conducted in accordance with the ICP. 

No No

9. The ICC is primarily responsible for coordinating all efforts and ensuring that the 

reviews incorporate principles outlined in the Government Accountability Office

standards. 

No No

10. Business Line is to use the assessment checklist for internal control contained in 

ADAMS package ML102790438 as guidance through the review process. 

No No

 12 MD 4.4 does not identify the NRC staff that would comprise the internal control team.
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

26

Appendix C-4, MD 4.4 Handbook Requirements for Evaluating Results and 

Taking Corrective Action

Requirement 

Met

Operating 

Reactors 

Business

Line

New 

Reactors 

Business 

Line

1. Managers are to evaluate their internal control test findings to determine whether 

the existing internal control is sufficient to manage the risk.

No No

2. OCFO is to issue guidance annually on how to report test results and take 

corrective actions. 

No No

3. Business Line Managers make certain to confirm findings and recommendations 

by discussing them with appropriate staff, management, PSAT, working groups,

and the ECIC. 

No No

4. Business Line Managers work with the ICC to develop CAPs and submit a 

schedule for completion for problem areas to the Programmatic Internal Control 

Program Manager. 

No No

5. Business Line Managers document all findings and recommendations in a written 

report that is presented to the Chief Financial Officer, Executive Director for 

Operations, and Programmatic Internal Control Program Manager. 

No No

6. The Business Line Manager’s written report is to include recommendations for 

improvement, and identify any redundant process or internal control, that should 

be modified or eliminated, including modifications to the CAPS and associated 

schedules. At minimum, the written report is to include:

(a) a statement describing management’s responsibility for establishing and 

maintaining internal control,

(b) a statement of the framework or criteria used to evaluate the effectiveness 

of internal control,

(c) a statement about the inherent limitations of the existing internal control 

program,

(d) a statement on the overall effectiveness of internal control in 

the business line, including disclosure of any significant or internal control 

deficiencies identified,

(e) a summary of the steps the Business Line Manager plans to

take to correct any reported deficiencies and the estimated dates

of completion, and

(f) comments on control weaknesses identified in prior reports, including the 

following:

(i) whether the weaknesses have been corrected, and

(ii) whether the new policies and/or procedures have been in place for 

a sufficient period of time to determine if they are operating effectively. 

No No

7. Managers are to continuously monitor, evaluate, and improve the effectiveness of 

internal control associated with their programs and administrative activities. 

No No
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

27

Appendix C-4, MD 4.4 Handbook Requirements for Evaluating Results and 

Taking Corrective Action

Requirement 

Met

Operating 

Reactors 

Business

Line

New 

Reactors 

Business 

Line

8. The Business Line Manager is to work with responsible officials and staff to 

determine which deficiencies to correct based in part on the cost analysis benefit.

No No

9. Business Line Managers are to include in their CAP, targeted milestones and 

completion dates for proposed corrections and progress to be monitored.

No No

10. Business Line Mangers are to include in their CAP, measureable indicators of 

compliance and resolution, to assess and validate progress throughout the 

resolution cycle. 

No No

11. Business Line Managers are to develop CAPs vetted through the PSAT and 

reviewed by the ECIC for weaknesses that are programmatic in nature. 

No No

12. The PSAT will review the CAPs quarterly, to ensure that progress was being made 

toward resolution of the issue(s) requiring the plan. 

No No

13. ECIC will track corrective actions and their target dates resulting from information 

collection requirements. 

No No

14. Managers are to conduct a Corrective Action Review 1 year after the CAP was 

implemented. 

No No

15. The organization responsible for correcting the internal control deficiency will 

review the action within 6 months to ensure that the intended results have been 

achieved, and the necessary internal control is functioning properly.

No No

16. The ECIC will remind the office or region of the due date for the validation review 

within 3 months after being advised that the corrective action has been completed. 

No No
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

28

AGENCY FORMAL COMMENTS

Appendix D 
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

29
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

30
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

31
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

32

 OIG ANALYSIS OF AGENCY FORMAL COMMENTS

Appendix E

On April 16, 2015, OIG issued the discussion draft of this report to the 

Executive Director for Operations. OIG met with NRC management and 

staff on May 1, 2015, at an exit conference and on May 6, 2015, at a staff 

meeting to discuss the draft report content. At these meetings, the agency 

provided informal comments, which OIG subsequently incorporated into 

the draft report as appropriate. On May 26, 2015, NRC provided formal 

comments to the draft report that indicated their agreement with the audit 

recommendations. OIG has assigned a reference number to each of the 

agency’s formal comments to aid the following point-by-point analysis:

Agency Comment 1:

It is important to us that the report be taken in the context of our control 

environment and that the context be provided to the reader.

OIG Analysis of Agency Comment 1:

OIG maintains that NRC needs to improve its approach for implementing an 

effective internal control program, within the context of the current control 

environment as described in the formal comments.

Agency Comment 2:

Because of its strong attention to its mission and function as a regulator, 

the NRC is continuously focused on planning, assessing risk, testing, and 

identifying and implementing corrective actions. These internal control 

activities are conducted by the staff and management through welldocumented programs for self-assessment of its processes and 

substantial efforts associated with its oversight of licensee safety. The 

NRC performs these activities as part of its everyday work and ensures 

that the programs/processes are incorporated into supporting 

documentation for management’s review of program operations.

OIG Analysis of Agency Comment 2:

OIG provided the agency’s explanation on page 9 of this report that the 

agency believes that NRC addresses non-financial internal control 

requirements for planning, assessing risk, testing, and identifying and 
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

33

implementing corrective actions requirements through established 

programs for self-assessment and oversight of licensee safety. However, 

OIG maintains that the agency’s examples of programmatic activities are 

not assessed as part of an overall, systematic review of controls as 

outlined in MD 4.4 Handbook Section III. Specifically, the agency’s 

programs for self-assessment do not include the required identification, 

tests, and written documentation regarding the internal controls 

established over the Reactor Safety Business Lines’ functions and flow of 

program operations.

Agency Comment 3:

NRC staff significantly improved the NRC’s non-financial (programmatic) 

internal control framework in FY 2013 based on the Government 

Accountability Office (GAO) Standards for Internal Control in the Federal 

Government. As a way to illustrate the agency’s diligent and 

comprehensive approach on management and internal controls, 

Enclosure 1 provides a subset of the programs within the Reactor 

Business Lines that support internal control processes to meet GAO 

Standards. NRC staff concurs that the improved framework is carried out 

differently than described in parts of MD 4.4 Handbook Section III 

(“Assessment of Internal Control over Program Operations (NonFinancial)”), which was the subject of the audit. As part of the agency’s 

continuous process improvements, the new framework cross-references 

the internal control programs/processes to responsibilities described in a 

Memorandum of Understanding [MOU] for each business line and its 

partner offices. This is an enhancement to MD 4.4 Handbook Section III, 

where the Internal Control Plan (ICP) is identified as the basis for mapping 

programs/processes to internal control. The NRC consciously decided not 

to repeat information in the ICPs and to prevent unnecessary duplication 

of effort. As the improvements are recent and continuing, MD 4.4 does 

not contain this modification and will be updated by the staff after Office of 

Management and Budget (OMB) next updates Circular A-123 in 2016.

OIG Analysis of Agency Comment 3:

MOUs for each business line and its partner offices are not required 

elements for non–financial internal controls. However, OIG notes that the 

MOU the agency describes in its formal comments to this report does not 

repeat information contained in the ICP. The purpose of the MOU 

between the Business Line Lead and its partner offices is to identify, 
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

34

clarify, and communicate mutual mission expectations as they relate to 

programmatic internal control and reasonable assurance certification. 

The MOU facilitates the transition to the NRC's updated programmatic 

internal control framework that requires reasonable assurance certification 

by business line, which, previous to the updated framework, was by office. 

The MOU also establishes organizational responsibilities where 

appropriate. The MOU does not detail the required non-financial ICP 

information as identified in Appendix C of this report and serves a different 

purpose than the ICP. Therefore, preparing an ICP would not be a 

duplication of effort.

Moreover, only one manager provided a copy of the business line’s MOU 

as internal control documentation and did not indicate the view that the 

information in the MOU repeated information contained in the Business 

Line’s ICP.

Agency Comment 4:

While the audit didn’t include step 5 in its scope, “Submit Assurance 

Statement,” the Reactor Business Lines met the MD 4.4 requirements for 

developing and certifying their respective assurance statements. 

Specifically in MD 4.4 Handbook Section III, the final step in the internal 

control process for an NRC Business Line Manager is to submit the 

reasonable assurance statement at the end of each fiscal year, a key 

element for preparing the Performance and Accountability Report. 

Business Line Managers must submit annual assurance statements in 

accordance with annual Programmatic Internal Control and Reasonable 

Assurance Guidance issued by the Executive Director for Operations and 

Chief Financial Officer. Business Line Managers consider programmatic, 

administrative, and financial programs when signing the assurance 

statement. The two business lines do identify all such programmatic 

products and services and their associated internal control activities and 

objectives in their annual reasonable assurance statements and 

supporting documentation.

OIG Analysis of Agency Comment 4:

OIG acknowledged on page 5, footnote 2 of this report that MD 4.4 

Handbook Section III also includes a Step 5 “Submit Assurance 

Statement.” This requirement briefly states that “OCFO shall provide 

guidance for preparation of the assurance certification annually. See 

Section V of this handbook for an overview of assurance certification.” 
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

35

OIG did not evaluate Step 5 as part of this audit because it is based 

almost entirely on Handbook Section V, which is focused on submitting 

reasonable assurance statements and thus was out of scope for this audit.
Audit of NRC’s Reactor Business Lines’ Compliance With Agency Non-Financial Internal Control Guidance

36

 TO REPORT FRAUD, WASTE, OR ABUSE

 COMMENTS AND SUGGESTIONS

Please Contact:

Email: Online Form

Telephone: 1-800-233-3497

TDD 1-800-270-2787

Address: U.S. Nuclear Regulatory Commission

Office of the Inspector General

Hotline Program

Mail Stop O5-E13

11555 Rockville Pike

Rockville, MD 20852

If you wish to provide comments on this report, please email OIG using this link.

In addition, if you have suggestions for future OIG audits, please provide them using 

this link.