GAO-06-255R Cost and Benefit Review of Internal Control Opinions 

United States Government Accountability Office

Washington, DC 20548 

September 6, 2006 

The Honorable Susan M. Collins 

Chairman 

The Honorable Joseph I. Lieberman 

Ranking Minority Member 

Committee on Homeland Security and Governmental Affairs 

United States Senate 

The Honorable Thomas M. Davis 

Chairman 

The Honorable Henry A. Waxman 

Ranking Minority Member 

Committee on Government Reform 

House of Representatives 

Subject: Internal Control: Analysis of Joint Study on Estimating the Costs and 

Benefits of Rendering Opinions on Internal Control over Financial 

Reporting in the Federal Environment 

The Department of Homeland Security (DHS) Financial Accountability Act, Public 

Law Number 108-330, requires DHS management to provide an assertion on the 

internal control that applies to financial reporting for fiscal year 2005 and to obtain an 

auditor’s opinion on the department’s internal control over its financial reporting for 

fiscal year 2006. The act also directs the Chief Financial Officers (CFO) Council1

 and 

the President’s Council on Integrity and Efficiency (PCIE)2

 to conduct a joint study, 

and report to the Congress and to the Comptroller General of the United States, on 

the potential costs and benefits of requiring agencies subject to the Chief Financial 

Officers Act of 19903

 to obtain audit opinions of their internal control over financial 

 

1

The CFO Council is an organization comprised of the CFOs and Deputy CFOs of the 24 CFO Act 

agencies, senior officials in the Office of Management and Budget (OMB), and the Department of the 

Treasury who work collaboratively to improve financial management in the U.S. government. 

2

The PCIE was established in May 1992 to (1) address integrity, economy, and effectiveness issues that 

transcend individual government agencies and (2) increase the professionalism and effectiveness of 

inspector general personnel throughout the government. The PCIE is composed primarily of the 

presidentially appointed inspectors general. Officials from OMB and the Federal Bureau of 

Investigation, Office of Government Ethics, Office of Special Counsel, and Office of Personnel 

Management serve on the PCIE as well. 

3

See 31 U.S.C. § 901(b)(1) for a list of agencies. 
 Page 2 GAO-06-255R Cost and Benefit Review of Internal Control Audits 

 

reporting.4 The DHS Financial Accountability Act also requires that the Comptroller 

General of the United States review the joint study and report the results of this 

analysis to the Congress. In December 2005, we briefed available committee staff on 

our preliminary analysis of the joint study. This report provides further details on our 

review and on our views regarding a requirement for federal agencies to obtain audit 

opinions on their internal control over financial reporting. 

The Office of Management and Budget (OMB) revised its Circular Number A-1235

 in 

December 2004 (effective beginning with fiscal year 2006) to strengthen the 

requirements for conducting management’s assessment of internal control over 

financial reporting. Major revisions contained in Appendix A of the circular include 

requiring CFO Act agency management to annually assess the adequacy of internal 

control over financial reporting, provide a report on identified material weaknesses 

and corrective actions, and provide separate assurance on the agency’s internal 

control over financial reporting. In initiating the revisions to Circular No. A-123, OMB 

cited the new internal control requirements for publicly traded companies that are 

contained in section 404 of the Sarbanes-Oxley Act of 2002 (Sarbanes-Oxley).6

Sarbanes-Oxley was enacted in response to corporate accountability failures of the 

past several years and contains a provision calling for management’s assessment of 

internal control over financial reporting similar to the long-standing requirements for 

executive branch agencies in 31 U.S.C. § 3512 (c),(d), commonly referred to as the 

Federal Managers’ Financial Integrity Act (FMFIA), to issue annual statements of 

assurance over internal control in the agency. Opinions on internal control over 

financial reporting as required by the Sarbanes-Oxley Act for publicly traded 

companies are important to protect investors by improving the accuracy and 

reliability of corporate disclosures made pursuant to the securities laws. Regulators, 

public companies, audit firms, and investors generally agree that the Sarbanes-Oxley 

Act of 2002 has had a positive and significant impact on investor protection and 

confidence. At the same time, the costs associated with the Sarbanes-Oxley Act have 

been significant and additional steps should be taken to improve the efficiency and 

cost-effectiveness of its implementation. 

Federal agencies also have a duty to attain and maintain the public’s trust and 

confidence. Specifically, federal agencies have a stewardship obligation to prevent 

fraud, waste, and abuse; to use tax dollars appropriately; and to ensure financial 

accountability to the President, the Congress, and the American people. In the 

broadest context, internal control represents an organization’s plans, methods, and 

procedures used to meet its missions, goals, and objectives and serves as the first line 

of defense in safeguarding assets and preventing and detecting errors, fraud, waste, 

abuse, and mismanagement. Effective internal control should provide reasonable 

assurance that an organization achieves the following objectives: (1) effective and 

efficient operations, (2) reliable financial reporting, and (3) compliance with 

applicable laws and regulations. Safeguarding of assets is a subset of these 

4

Both the PCIE and the CFO Council are chaired by OMB’s Deputy Director for Management. 

5

OMB Circular No. A-123, Management’s Responsibility for Internal Control (revised December 

2004). 

6

Pub. L. No. 107-204, § 404, 116 Stat. 745, 789 (July 30, 2002). 
Page 3 GAO-06-255R Cost and Benefit Review of Internal Control Audits

 

objectives. The scope of this report mainly deals with one objective of internal 

control, specifically that related to the reliability of financial reporting. 

Consistent with the DHS Financial Accountability Act’s requirements, our objective 

was to review the joint study and provide our perspective on the important issues 

regarding a potential requirement for CFO Act agencies to obtain audit opinions on 

their internal control over financial reporting. Specifically, this report provides our 

analysis of (1) the joint study and key issues to consider in assessing the costs and 

benefits of obtaining an opinion on internal control over financial reporting and 

(2) factors to consider in establishing criteria for when such an internal control 

opinion is warranted. To address our objective, we reviewed and discussed the joint 

study’s methodology, results, and conclusions with officials from OMB and members 

of the CFO Council and the PCIE. In conducting their joint study, the CFO Council 

and the PCIE obtained cost and benefit data from the CFO Act agency inspectors 

general (IG), but did not verify the cost data supporting the cost-benefit analysis. We 

reviewed the development and administration of the questionnaire, but because the 

scope of our work did not include independently validating the cost information 

reported by questionnaire respondents, we cannot comment on the reliability of its 

cost estimates. 

We reviewed numerous reports and other professional literature that contributed to 

the development of the joint study. These materials are referenced in Attachment A 

of the joint study. We obtained a copy of the questionnaire sent to the IGs of the 24 

CFO Act agencies and the two additional questions that were subsequently asked of 

the CFOs and IGs. We also reviewed prior GAO reports; applicable federal laws and 

regulations; and private sector results after implementation of the Sarbanes-Oxley 

Act of 2002, including documents issued by the Securities and Exchange Commission 

and the Public Company Accounting Oversight Board (PCAOB). We performed our 

work from September 2005 through July 2006 in accordance with U.S. generally 

accepted government auditing standards. We requested comments on a draft of this 

report from OMB. Written comments from OMB’s Deputy Director for Management 

are reprinted in enclosure IV. We also received several technical comments, which 

we have addressed as appropriate. 

Results in Brief 

We recognize that assessing the costs and benefits of obtaining an auditor’s opinion 

on internal control over financial reporting is difficult, and the joint study properly 

noted many challenges inherent in performing cost-benefit analyses on this issue. The 

CFO Council and the PCIE acknowledged in the joint study that estimating the costs 

to render an opinion on internal control over financial reporting was “challenging 

given the lack of hard data and the number of unknown factors that go into 

developing a strong estimate” and refer to their reported estimates as “not hard 

numbers.” Of the total reported estimated costs7

 of about $140 million, the joint study 

attributed about $56 million (40 percent) to internal control audits of the 23 civilian 

7

In conducting the joint study, the CFO Council and the PCIE did not verify the cost data included in 

the report and our scope of work did not include independent validation of the cost information. 
 Page 4 GAO-06-255R Cost and Benefit Review of Internal Control Audits 

 

CFO Act agencies, with the balance of $84 million to cover the Department of 

Defense (DOD). The CFO Council and the PCIE also stated that the benefits from 

obtaining an opinion on internal control over financial reporting are difficult to 

measure, and as a result, the joint study discussed some of the potential benefits only 

qualitatively. Consequently, the joint study did not identify all relevant costs and 

benefits, which may therefore limit the usefulness of the results and conclusions of 

the joint study. 

While the study identified categories of additional work that drive the cost estimates, 

we believe additional factors are relevant in considering the costs of a requirement 

for audit opinions on internal control over financial reporting in the federal 

government. Factors that would likely affect an estimate of the costs of a requirement 

in the federal government include (1) leveraging the resources already in place in 

areas of the financial statement audit; (2) using an audit approach that integrates the 

financial and internal control audits and includes reasoned risk and experience-based 

auditor judgments, similar to the approach in the GAO/PCIE Financial Audit 

Manual (FAM); (3) setting criteria for when an agency should initially be required to 

obtain an audit of internal control over financial reporting; and (4) establishing 

criteria whereby an agency would qualify for a multiyear cycle for obtaining an audit 

opinion on internal control rather than an annual cycle. We also note that some of the 

reasons cited for higher-than-estimated costs in early implementation of the internal 

control provisions of Sarbanes-Oxley for publicly traded companies, should not, to 

nearly the same extent, be factors for incremental costs in the federal government 

environment. For example, auditors of federal agencies have been required for many 

years to test internal control to achieve a low level of assessed control risk. As a 

result, the FAM includes an integrated audit approach for testing internal control in 

connection with a financial statement audit. Similar internal control testing 

requirements were not in place for public companies prior to section 404 of SarbanesOxley. It is important to note, however, that the standards8

 that currently provide the 

basis for the FAM approach for providing an auditor’s opinion on internal control 

over financial reporting are being revised by the Auditing Standards Board of the 

American Institute of Certified Public Accountants. The cost of a requirement for 

internal control opinions in the federal government could be impacted by any future 

changes to the underlying auditing standards. 

Additionally, as reported by the joint study, a majority of the IGs and CFOs believe 

that benefits would be derived from an audit of internal control over financial 

reporting. A majority of the IGs and CFOs cited the following as benefits that may be 

derived from this type of audit: (1) improved internal control and reduced material 

weaknesses; (2) reduced errors and improved data integrity, documentation 

reliability, and reporting; and (3) improved agency focus and oversight. According to 

the study, the true benefit of the auditor’s opinion on internal control is the added 

independent assurance it provides that management’s assessment of its internal 

control is reliable. We agree with the benefits identified by the IGs and CFOs, and in 

turn, these benefits provide additional incentives for timely identifying and correcting 

internal control weakness over financial reporting. In addition, we have identified 

8

“Reporting on an Entity’s Internal Control over Financial Reporting,” AT Section 501, Codification of 

Statements on Auditing Standards, American Institute of Certified Public Accountants. 
Page 5 GAO-06-255R Cost and Benefit Review of Internal Control Audits

several other benefits that should be considered when concluding on the merits of 

establishing a requirement to obtain an opinion on internal control over financial 

reporting. We believe independent assessments and auditor reporting can also 

• strengthen the audit work done to support implementation of laws enacted to 

enhance internal control or reinforce the significance of effective internal 

control, such as FMFIA and the Government Performance and Results Act 

(GPRA); 

• help to improve other efforts, such as cost analyses, budgeting, and 

performance metrics, through additional assurances over the reliability of 

financial and relevant nonfinancial data; and 

• improve monitoring of the effectiveness of an entity’s risk management and 

accountability systems. 

We view auditor opinions on internal control over financial reporting as an important 

component of monitoring the effectiveness of an entity’s risk management and 

accountability systems. We agree in part with the study’s overall conclusion that 

federal agencies should first be given the opportunity to implement revised Circular 

No. A-123 before there is an across-the-board requirement to obtain an audit opinion 

on internal control over financial reporting. However, we also believe that having set 

criteria as to when an agency should initially be required to obtain an opinion, instead 

of agency or OMB discretion, would be useful. We recognize that not all agencies 

have the same maturity level of internal control over financial reporting and that an 

initial determination of an agency’s readiness to undergo an audit may be 

appropriate. Such an approach should consider specific criteria to ascertain when an 

agency should initially obtain an opinion on internal control, such as whether 

management has properly assessed its internal control and has a reasonable basis for 

its statement of assurance. We also believe that criteria can be established to achieve 

a balance between value, risk, and cost, whereby once agency management has 

demonstrated a stabilized effective system of internal control over financial 

reporting, subsequent audits could be performed on a multiyear cycle, for instance, 

every 3 years. Important to this consideration is that during the years not subject to 

an internal control audit, agency management would still have to comply with the 

revised Circular No. A-123, which requires agency management to annually assess the 

adequacy of internal control over financial reporting by providing a report on 

identified material weaknesses and corrective actions and providing a separate 

assurance statement on the agency’s internal control over financial reporting. The 

overarching goal of obtaining an audit opinion on internal control is to provide 

reasonable independent assurance that management’s assessment of internal control 

is adequate, which significantly contributes to ongoing improvement in federal 

agency internal control and accountability. Any criteria used to determine when an 

agency should undergo initial and continual implementation of the requirement for an 

audit opinion on internal control audit should consider at what point the audit will 

contribute to this goal. 

To reasonably ensure that audit opinions on agency internal control over financial 

reporting are obtained at the proper time and for a reasonable cost, we are making 

two recommendations to the Director, Office of Management and Budget, as a 

function of OMB’s financial management leadership role: (1) develop specific criteria 
 Page 6 GAO-06-255R Cost and Benefit Review of Internal Control Audits 

 

as to when agencies should initially be required to obtain opinions on internal control 

over financial reporting and (2) develop criteria as to when agencies have 

demonstrated a stabilized, effective system of internal control over financial 

reporting in order to move to a multiyear cycle for obtaining subsequent opinions on 

internal control. During the years not subject to an internal control audit, agency 

management would still adhere to a comprehensive ongoing management assessment 

and reporting process for internal control over financial reporting, as required by the 

revised Circular No. A-123. 

In written comments on a draft of this report, OMB agreed with the ultimate goal of 

improving internal control in the federal government. OMB’s comments also 

highlighted the continued cooperation of GAO and the PCIE and the CFO Council on 

important issues and stated that OMB looked forward to working together to achieve 

the joint goal of effective internal control in the federal government. (OMB’s 

comments are reprinted in enc. IV.) 

Background 

Federal agencies have a significant responsibility for accurate and timely accounting, 

controlling, and reporting of the receipts, disbursements, and applications of public 

moneys. The Congress has long recognized the importance of internal control, 

beginning with the Budget and Accounting Procedures Act of 1950,9

 which placed 

primary responsibility for establishing and maintaining internal control squarely on 

the shoulders of agency management. In 1982, the Congress passed FMFIA, requiring 

agency heads to establish a continuous process for assessment and improvement of 

their agencies’ internal control and to annually report on the adequacy of internal 

control. In addition, FMFIA required the Comptroller General to establish internal 

control standards and OMB to issue guidelines for agencies to follow in assessing 

their internal control. In December 1982, following FMFIA enactment, OMB issued 

Circular No. A-123, which included the assessment guidelines required by the act. The 

Comptroller General issued Standards for Internal Control in the Federal 

Government in 1983, which was last revised in November 1999.10

We monitored and reported on FMFIA implementation efforts across the government 

in a series of four reports11 from 1984 through 1989, as well as in numerous reports 

9

Pub. L. No. 81-784, 64 Stat. 832 (Sept. 12, 1950). 

10The Comptroller General revised the standards in 1999, based on developments in internal control 

theory, including the internal control framework recommended in the report of the Committee on 

Sponsoring Organization of the Treadway Commission, the effects of information technology, and the 

passage of a series of landmark reforms. GAO, Standards for Internal Control in the Federal 

Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999). 

11See (1) GAO, Implementation of the Federal Managers’ Financial Integrity Act: First Year, 

GAO/OCG-84-3 (Washington, D.C.: Aug. 24, 1984); (2) GAO, Financial Integrity Act: The Government 

Faces Serious Internal Control and Accounting Systems Problems, GAO/AFMD-86-14 (Washington, 

D.C.: Dec. 23, 1985); (3) GAO, Financial Integrity Act: Continuing Efforts Needed to Improve 

Internal Control and Accounting Systems, GAO/AFMD-88-10 (Washington, D.C.: Dec. 30, 1987); and 

(4) GAO, Financial Integrity Act: Inadequate Controls Result in Ineffective Federal Programs and 

Billions in Losses, GAO/AFMD-90-10 (Washington, D.C.: Nov. 28, 1989). 
Page 7 GAO-06-255R Cost and Benefit Review of Internal Control Audits

 

targeting specific agencies and programs. With each report, we noted the efforts 

under way, but also emphasized that more needed to be done. In 1989, we concluded 

that while internal control was improving, the efforts were clearly not producing the 

results intended. The management assessment and reporting process itself appeared 

to have become the objective of the annual efforts rather than actually improving 

internal control, and many serious internal control and accounting systems 

weaknesses remain unresolved. We have highlighted these long-standing weaknesses 

in our series of high-risk reports starting in 1990, the most recent of which we issued 

in January 2005.12

In 1995, OMB made a major revision to its Circular No. A-123 guidance that provided 

a framework for integrating internal control assessments with other work performed 

and relaxed the management assessment and reporting requirements, giving the 

agencies discretion to determine the tools to use in arriving at their annual FMFIA 

assurance statements. OMB’s December 2004 revisions (effective beginning with 

fiscal year 2006) to Circular No. A-123 are intended to strengthen the requirements 

for conducting management’s assessment of internal control over financial reporting 

at CFO Act agencies. Major revisions include requiring CFO Act agency management 

to annually provide a separate assurance statement on internal control over financial 

reporting in its performance and accountability report, along with a report on 

identified material weaknesses and corrective actions. The revision also establishes 

that OMB may, at its discretion, require a CFO Act agency to obtain an opinion on 

internal control over financial reporting if the agency is not meeting its deadlines as 

outlined in its corrective action plans. In general, we supported the revisions to 

Circular No. A-123 as they recognize that effective internal control is critical to 

improving federal agencies’ effectiveness and accountability and to achieving the 

goals that the Congress established for them.13

 

The recent revisions to Circular No. A-123 were initiated in response to the new 

internal control requirements for publicly traded companies that are contained in 

Sarbanes-Oxley. Under section 404 of Sarbanes-Oxley, management of a publicly 

traded company is required to (1) annually assess internal control over financial 

reporting at the company and (2) issue an annual statement on the effectiveness of 

internal control over financial reporting. The company’s auditors are then required to 

attest to management’s assessment as to the effectiveness of its internal control over 

financial reporting and issue an auditor’s opinion as to the effectiveness of internal 

control over financial reporting. 

The Joint Study and Key Issues to Consider in Assessing Costs and Benefits 

The CFO Council and the PCIE joint study transmits the results obtained from a 

questionnaire of the IGs for the 24 CFO Act agencies with additional input from the 

CFO Council’s Policies and Practice Committee. A copy of the joint study report is 

12GAO, High-Risk Series: An Update, GAO-05-207 (Washington, D.C.: January 2005). 

13GAO, Financial Management: Effective Internal Control Is Key to Accountability, GAO-05-321T 

(Washington, D.C.: Feb. 16, 2005). 
 Page 8 GAO-06-255R Cost and Benefit Review of Internal Control Audits 

reprinted in enclosure I. The CFO Council and the PCIE acknowledged inherent 

limitations in conducting the joint study and noted that “performing any sort of 

meaningful cost/benefit analysis has proven elusive.” Specifically, the joint study 

faced numerous challenges, including (1) identifying and estimating all relevant costs 

and benefits and (2) a lack of historical data from the agencies on the costs and 

benefits of implementing the requirement. Because only a few agencies have 

experience with obtaining audit opinions on internal control over financial reporting, 

there is limited specific information about the trade-offs between the costs of 

obtaining an opinion and the benefits provided. The joint study identified general 

categories of the additional work that it stated drive the cost estimates, along with a 

qualitative discussion of some benefits. We believe additional factors related to both 

costs and benefits are also relevant and should be included in considering the costbenefit of the audit requirement. 

Methodology, Results, and Conclusion of the Joint Study

To accomplish their objective, the CFO Council and the PCIE, under the leadership of 

OMB, which chairs both councils, gathered information from the IGs and the CFOs 

about the costs and benefits of the proposed requirement. The PCIE Audit Committee 

coordinated the collection of cost and benefit information from the IGs. The Audit 

Committee Chair sent a questionnaire to the IGs at the 24 CFO Act agencies to gather 

data on the estimated audit costs and the benefits of performing an examination 

under the standards of AT§501, Reporting on an Entity’s Internal Control Over 

Financial Reporting,14 which are issued by the American Institute of Certified Public 

Accountants and incorporated by reference as part of U.S. generally accepted 

government auditing standards. Enclosure II contains a copy of the PCIE 

questionnaire used to gather estimated costs and benefits of opining on internal 

control over financial reporting. The CFO Council and the PCIE acknowledged some 

limitations in the joint study. For example, they acknowledged that they did not 

validate the cost estimates submitted by the 24 CFO Act agency IGs. In addition, the 

study noted that the estimates are “not hard numbers,” meaning that they were only 

overall estimates that were not necessarily based, for example, on the potential 

number of hours and labor rates that would be included by a contracted auditor in a 

formal contract proposal. 

The PCIE Audit Committee summarized the responses from each of the IGs at the 24 

CFO Act agencies, and then shared the summary with the respondents to ensure they 

had accurately captured their comments. The PCIE Audit Committee also shared the 

results with the CFO Council’s Financial Management Policies and Practices 

Committee15 and incorporated its comments. The draft study was then shared with 

 

14This section of the Attestation Standards, issued by the American Institute of Certified Public 

Accountants, provides the standards for the practitioner who is engaged to issue or does issue an 

examination report on the effectiveness of an entity’s internal control over financial reporting. This 

section is currently under revision. 

15The CFO Council’s Financial Management Policies and Practices Committee is comprised of 

representatives from federal agencies who work collaboratively to identify and address emerging 

issues. 
Page 9 GAO-06-255R Cost and Benefit Review of Internal Control Audits

both the full CFO Council and the PCIE, whose comments were also incorporated. 

During the final comment period, two additional questions were asked of the CFOs 

and IGs about the expected benefits of the revised Circular No. A-123 and on 

obtaining opinions on internal control over financial reporting. Enclosure III contains 

the two additional questions that were asked of the CFOs and IGs. The CFO Council 

and PCIE also considered the experiences of publicly traded companies by reviewing 

numerous articles, surveys, and statements made before regulatory bodies relating to 

the implementation of section 404 of the Sarbanes-Oxley Act. 

Of the total reported estimated costs of about $140 million, the joint study attributed 

about $56 million (40 percent) to internal control audits of the 23 civilian CFO Act 

agencies, with the balance of $84 million to cover DOD. The joint study notes that 

driving the cost estimates are the additional work that the auditor would need to 

perform beyond the requirements of OMB Bulletin No. 01-02, Audit Requirements for 

Federal Financial Statements,

16 and the GAO/PCIE FAM in order to render an 

opinion on an agency’s internal control over financial reporting. 

The joint study also noted that the benefits of obtaining an opinion on internal 

control are difficult to measure. The joint study stated that “benefits can only be 

described in general terms, making a cost/benefit analysis difficult.” Some of the 

benefits cited were (1) improved internal control and reduced material weaknesses; 

(2) reduced errors and improved data integrity, documentation reliability, and 

reporting; and (3) improved agency focus and oversight. The joint study did not 

quantify these benefits, but noted that these benefits should largely be achieved when 

agencies effectively implement the revisions to Circular No. A-123. 

The joint study concluded that (1) most industry experts agree that there are 

significant incremental costs to obtaining an opinion on internal control over 

financial reporting; (2) before incurring the additional costs, it would be prudent to 

see how federal managers implement the revised Circular No. A-123 and to evaluate 

the private sector’s implementation of the internal control provisions of SarbanesOxley when additional information becomes available; and (3) the decision on 

whether to obtain an opinion needs to be decided on an agency-by-agency basis, 

depending on the condition of an agency’s financial management program. The CFOs 

and the IGs recommended that all CFO Act agencies should not be required to 

conduct such an audit at this time. Rather, agencies should be given the opportunity 

to implement the revised Circular No. A-123, and obtain an internal control audit only 

where particular circumstances warrant such an audit. 

Certain Factors That Could Influence Costs and Benefits 

Not Included in the Joint Study

We view auditor opinions on internal control over financial reporting as an important 

component of monitoring the effectiveness of an entity’s risk management and 

accountability systems. We agree in part with the study’s overall conclusion that 

 

16 OMB Bulletin No. 01-02, Audit Requirements for Federal Financial Statements, was recently 

superseded by the updated audit requirements included in OMB Bulletin No. 06-03, Audit 

Requirements for Federal Financial Statements (Aug. 23, 2006). 
 Page 10 GAO-06-255R Cost and Benefit Review of Internal Control Audits 

agencies should first be given the opportunity to implement the revised Circular No. 

A-123 before there is an across-the-board requirement to obtain an audit opinion on 

internal control over financial reporting. Internal control is a fundamental 

management responsibility. Management, not the auditor, should be the first line of 

defense and be held accountable for establishing a continuous evaluation process to 

ensure the adequacy of internal control. However, as discussed later, we also believe 

that there should be specific criteria for ascertaining when an agency should initially 

be required to obtain an opinion on internal control. We also recognize that assessing 

the costs and benefits of obtaining an opinion is difficult and agree there are many 

challenges inherent to performing cost-benefit analyses on this issue. While the joint 

study identified categories of additional work that drive the cost estimates along with 

key benefits, we believe additional factors that could influence costs and benefits are 

relevant in considering a requirement for audit opinions on internal control. 

 Additional Factors That Could Influence Costs 

We identified five additional factors that could influence costs and should be 

considered: (1) leveraging resources, (2) using an efficient auditor approach, 

(3) using a staggered implementation approach, (4) implementing a multiyear cycle 

for an audit opinion on internal control over financial reporting, and (5) applying 

Sarbanes-Oxley lessons learned. 

Leveraging resources. In developing cost estimates to obtain an opinion on internal 

control over financial reporting, consideration needs to be given to fully leveraging 

the resources already deployed as part of the financial statement audits. For example, 

it may be possible to leverage the resources deployed to determine compliance with 

laws and regulatory requirements that were enacted to strengthen internal control or 

reinforce the significance of effective internal control, such as the following: 

• OMB Bulletin No. 01-02, Audit Requirements for Federal Financial 

Statements, which requires auditors of federal financial statements to test and 

report on agencies’ internal control over financial reporting in connection with 

the audit of the financial statements; 

• FMFIA, which since its passage in 1982 has called for a continuous process for 

assessment and improvement of internal control, including control over 

financial reporting, and an annual assessment and statement of assurance by 

agency heads; 

• revised Circular No. A-123, which is intended to strengthen the requirements 

for conducting management’s assessment of internal control over financial 

reporting; and 

• revised Circular No. A-127, which is intended to highlight internal control 

requirements unique to financial management systems. 

Leveraging the resources already deployed in other areas of the financial statement 

audit would help reduce the additional work needed to opine on internal control over 

financial reporting and therefore decrease the incremental cost. For example, OMB 

Bulletin 01-02 requires auditors to (1) gain an understanding of internal control over 

financial reporting, (2) obtain an understanding of the process by which the agency 

identifies and evaluates weaknesses required to be reported under FMFIA, 
Page 11 GAO-06-255R Cost and Benefit Review of Internal Control Audits

 

(3) determine if internal control has been properly designed and placed in operation, 

(4) assess control risk, (5) perform tests of internal control to determine whether it is 

effective, and (6) report any identified deficiencies. In meeting the requirements of 

OMB’s Bulletin No. 01-02, auditors are already performing steps that could be 

leveraged for opining on internal control over financial reporting. As noted in the 

FAM, audit work performed in connection with OMB Circular No. 01-02 may be 

sufficient to provide an opinion on internal control over financial reporting. 

The CFO Council and the PCIE requested and received from the IG community cost 

estimates to obtain an opinion on internal control over financial reporting. The 

guidance given to the IG community was to exclude management’s cost to support 

the audit effort or to implement the new requirements of Appendix A to Circular No. 

A-123.17 Costs incurred to comply with Circular No. A-123 will be incurred 

irrespective of a requirement to obtain an opinion on internal control over financial 

reporting. We agree that these costs do not add to the incremental cost of obtaining 

an opinion on internal control over financial reporting and should not be included in 

the estimate to perform the opinion-level work. Instead, these activities can be 

leveraged by the auditors to reduce internal control audit costs. The activities that 

must be performed for agency compliance with the revised Circular No. A-123 include 

identifying, documenting, and testing internal control over financial reporting. These 

are the same types of activities that would have to be performed in conducting an 

audit of internal control over financial reporting and would offer the auditor the 

ability to consider the work of management in evaluating the effectiveness of internal 

control over financial reporting and deciding on the level of audit evidence needed to 

support an opinion. Specifically, the auditor might decide to consider the work of 

management as part of the process of gaining an understanding of internal control 

over financial reporting and in determining the nature, timing, and extent of the 

auditor’s tests. Preparation of such information by management reduces the costs for 

the auditor to gather the information. This requires close coordination and up-front 

planning so that the auditor is in a position to leverage management’s work. 

Efficient auditor approach. An audit approach that uses reasoned risk and 

experience-based auditor judgments in areas such as designing efficient internal 

control testing and additional flexibility in using the work of others, similar to the 

approach in the FAM, would provide an efficient and cost-effective means to 

accomplish audits of internal control. These flexibilities in audit approaches would 

also help reduce the additional audit work needed to opine on internal control and 

thus decrease the incremental cost. It is important to note, however, that the 

standards18 that currently provide the basis for the FAM approach for providing an 

auditor’s opinion on internal control over financial reporting are being revised by the 

Auditing Standards Board of the American Institute of Certified Public Accountants. 

The cost of a requirement for internal control opinions in the federal government 

could be impacted by any future changes to the underlying auditing standards. 

17Appendix A to Circular No. A-123 provides a methodology for agency management to assess, 

document, and report on internal control over financial reporting. 

18See footnote 14. 
 Page 12 GAO-06-255R Cost and Benefit Review of Internal Control Audits 

 

Staggered implementation approach. Having set criteria as to when an agency 

should initially be required to obtain an opinion on internal control over financial 

reporting would be an important cost consideration. As discussed later, not all 

agencies will be in a position to have efficient internal control audits at this time. For 

example, in our view, under most circumstances, it would not be prudent for 

agencies with extensive known internal control weaknesses to pay for opinions on 

internal control over financial reporting, assuming that an agency acknowledges the 

seriousness of its problems and is working to remediate those weaknesses. However, 

in the case of DHS, where the Congress has particular oversight concerns because it 

is a new agency comprising numerous entities, auditor involvement in overseeing 

management’s efforts to evaluate and report on internal control should be beneficial 

to both management and congressional oversight. In addition, if management of an 

agency, such as DHS, which has a significant number of material weaknesses,19 either 

decides to or is required to report on internal control over financial reporting and is 

willing to acknowledge the agency’s weaknesses in its assurance statement, then 

there should be very minimal costs for the auditor to issue an adverse opinion on 

internal control. 

Multiyear audit cycle. Once agency management has demonstrated effective 

internal control over financial reporting as evidenced by unqualified opinions issued 

by an independent external auditor, we believe establishing a multiyear audit cycle 

could be appropriate. Important to this consideration is that during the years not 

subject to audit, agency management would still have to comply with the revised 

Circular No. A-123, which requires agency management to annually assess the 

adequacy of internal control over financial reporting, provide a report on identified 

material weaknesses and corrective actions, and provide separate assurance on the 

agency’s internal control over financial reporting. On a multiyear cycle, the audit of 

internal control over financial reporting would provide independent assurance that 

management’s assessment of its internal control is reliable. This would be a similar 

quality control practice much like that used in the peer review requirements for audit 

organizations, which occur every 3 years. 

Sarbanes-Oxley lessons learned. According to the joint study report, some of the 

agencies pointed to the higher-than-estimated cost of implementing section 404 of 

Sarbanes-Oxley as a deterrent to requiring an opinion on internal control over 

financial reporting in the federal government. However, the private sector internal 

control environment differs from that of federal agencies. Although many companies 

in the private sector have been required to maintain effective internal control under 

the Foreign Corrupt Practices Act of 1977,20 there was no management assessment or 

reporting requirement until passage of Sarbanes-Oxley. On the other hand, federal 

managers have been subject to statutory internal control assessment and reporting 

19In the case of DHS, as part of the audit of its fiscal year 2005 financial statements, the auditor in 

disclaiming its opinion on the financial statements reported 10 material weaknesses and 2 reportable 

conditions. Individually and collectively, these problems are very serious. 

20Pub. L. No. 95-213, 91 Stat. 1494 (Dec. 19, 1977). 
Page 13 GAO-06-255R Cost and Benefit Review of Internal Control Audits

 

similar to the requirements of Sarbanes-Oxley since 1982, as well as other numerous 

legislative and regulatory requirements that promote and support effective internal 

control. Although these laws and regulatory requirements have not proven fully 

effective in establishing a strong system of internal control by themselves, taken as a 

whole, they have long created an environment that has demanded and promoted 

effective control and management accountability. 

In November 2005, PCAOB, which, among other things, is charged by Sarbanes-Oxley 

to issue auditing, quality control, and ethics standards for public company audits, 

issued a report on the first-year implementation of Sarbanes-Oxley requirement for an 

audit of internal control over financial reporting performed in conjunction with an 

audit of financial statements.21 The board’s monitoring focused on whether public 

accounting firms’ audit methodologies, as well as firms’ execution of those 

methodologies, have resulted in audits of internal control that are effective and 

efficient. PCAOB found that both public accounting firms and public companies 

faced enormous challenges in the first year of implementation, arising from the 

limited time frame that firms and public companies had to implement the new 

requirements; a shortage of staff with prior training and experience in designing, 

evaluating, and testing control; and related strains on available resources. These 

challenges were compounded in those companies that needed to make significant 

improvements in their internal control systems to make up for deferred maintenance 

of those systems. 

In our review of the lessons learned from the private sector first-year implementation 

of section 404 of Sarbanes-Oxley, we noted that some of the issues identified that 

affected the efficiency of the audit and, therefore, the cost of the audit, should not 

affect CFO Act agencies to the same extent. Proper implementation of the FAM 

integrated audit approach, which uses reasoned risk, efficient internal control testing, 

additional flexibilities in using the work of others, as well as other measures, would 

to a large extent mitigate the inefficiencies noted in the lessons learned for first-year 

section 404 implementation. Based on the PCAOB report, the following is a summary 

of the audit lessons learned as a result of the implementation of section 404 of 

Sarbanes-Oxley. 

• Some independent public accountants (IPA) did not integrate their audits of 

internal control with their audits of financial statements. In an integrated audit 

of the financial statements and internal control, the auditor designs and 

simultaneously executes procedures that accomplish the objectives of both 

audits. These objectives are not identical but are interrelated. By not 

integrating both audits, the auditors may perform additional audit work than 

would otherwise be necessary, therefore increasing the costs of the audits. 

• Some IPAs did not effectively apply a preferred top-down approach. To 

varying degrees, auditors often approached the audit of internal control from 

21Public Company Accounting Oversight Board, Report of the Initial Implementation of Auditing 

Standard No. 2, “An Audit of Internal Control over Financial Reporting Performed in Conjunction 

with an Audit of Financial Statements,” PCAOB Release No. 2005-023 (Washington, D.C.: Nov. 30, 

2005). 
 Page 14 GAO-06-255R Cost and Benefit Review of Internal Control Audits 

 

the bottom up. Using a top-down approach, the auditor would instead begin by 

evaluating company-level control and significant accounts at the financial 

statement level and then work down to relevant individual control at the 

process, transaction, or application levels. The results of the auditors’ testing 

at each level help the auditor tailor the remainder of the work. Therefore, 

auditors may be able to reduce tests of internal control, which should result in 

reduced audit costs. 

• Some IPAs performed inefficient, and sometimes ineffective, walk-throughs of 

major classes of transactions because they used different transactions to test 

each control separately rather than walking a single transaction through the 

entire process. 

• Some IPAs did not use the work of others to the extent permitted by PCAOB 

Auditing Standard No. 2.22 Auditors that more effectively use the work of 

others as permitted will likely be able to make more efficient use of their own 

time in performing the audits of internal control. 

Additionally, in the report, PCAOB noted that the most common reasons why audits 

were not as effective as expected include the following: 

• In the face of identified control deficiencies, often discovered late in the audit 

process, some auditors failed to sufficiently evaluate the adequacy of 

compensating controls. For example, in some cases, auditors relied on 

management assertions about compensating controls without testing those 

controls in operation. 

• Some IPAs did not perform sufficient testing of the controls over preparing 

financial statement disclosures. The controls in this area are among the most 

important in the financial reporting process because of the relatively high risk 

of material misstatement or omission due to fraud or error. Sufficient testing 

of controls in this area also can make the auditors’ substantive testing of 

financial statement disclosures more efficient. 

Further, implementing the requirements of section 404 of Sarbanes-Oxley has put 

tremendous pressure on the availability of resources in the accounting and auditing 

profession. For instance, the four largest accounting firms have reported that they 

have significantly increased their assurance staff in the past 5 years and are expected 

to continue to experience a significant strain on resources to supply their need for 

assurance staff in the next 5 years. 

Additional Benefits 

The CFO Council and PCIE joint study identified several important benefits of 

obtaining an opinion on internal control over financial reporting, such as independent 

assurance, improved internal control, reduced material weaknesses, reduced errors 

and improved data integrity, improved documentation reliability and reporting, and 

22 Pursuant to 15 U.S.C. §7213, PCAOB issued Auditing Standard No. 2, An Audit of Internal Control 

Over Financial Reporting Performed in Conjunction with an Audit on Financial Statements, 

PCAOB Release No. 2003-017 (Washington, D.C.: Oct. 7, 2003). PCAOB has recently announced that it 

is considering amending this standard. 
Page 15 GAO-06-255R Cost and Benefit Review of Internal Control Audits

 

improved agency focus and oversight, with which we agree. We believe that there are 

additional benefits that should also be considered when concluding on the merits of 

such a requirement. Some of the benefits we identified are not direct benefits of 

having an opinion on internal control, but they are important indirect benefits that 

should be considered in concluding on the merits of this requirement. We believe 

annual independent assessments and audit reporting can also: 

• Strengthen the work done to support implementation of other laws enacted to 

enhance internal control or reinforce the significance of effective internal 

control. Examples include (1) FMFIA, which calls for a continuous process 

for assessment of internal control, and (2) GPRA, which requires agencies to 

set strategic and performance goals and measure performance toward those 

goals. Internal control plays a significant role in helping managers achieve 

their goals. 

• Help to improve other efforts, such as cost analyses, budgeting, and 

performance metrics, through assurances over the reliability of financial and 

relevant nonfinancial data. For example, the internal control audit would 

provide additional assurances about internal control over the accuracy of 

management’s estimates of improper payments (over $38 billion reported by 

the federal government for fiscal year 2005) across federal programs. 

Identifying improper payments and accurately measuring them over time is an 

important factor in eventually addressing and reducing them. 

• Improve monitoring of the effectiveness of an entity’s risk management and 

accountability systems. An audit requirement would not only provide 

assurance, but would also provide a mechanism for reporting on the extent to 

which management is carrying out its fundamental responsibilities in 

establishing and maintaining internal control. 

Factors to Consider in Establishing Criteria 

for an Internal Control Audit Requirement

We view auditor opinions on internal control over financial reporting as an important 

component of monitoring the effectiveness of an entity’s risk management and 

accountability systems. In putting this concept into practice at GAO, we not only 

issue an opinion on internal control over financial reporting at the federal entities 

where we perform the financial statement audit,23 including the consolidated financial 

statements of the U.S. government, but since the early 1990s, we have also obtained 

an auditor’s opinion on internal control over financial reporting in conjunction with 

the audit of our own annual financial statements. Other agencies have also exhibited 

such initiative. For example, the Social Security Administration (SSA) and the 

Nuclear Regulatory Commission received opinions (unqualified and qualified, 

respectively) on their internal control over financial reporting for fiscal year 2005 

from their respective independent auditors. 

23Currently, we perform financial statement audits at the Federal Deposit Insurance Corporation, the 

Internal Revenue Service, the Securities and Exchange Commission, and the American Battle 

Monuments Commission. 
 Page 16 GAO-06-255R Cost and Benefit Review of Internal Control Audits 

 

We agree in part with the study’s conclusion that CFO Act agencies should first be 

given the opportunity to implement the revised OMB Circular No. A-123 before there 

is an across-the-board requirement to obtain an audit opinion on internal control over 

financial reporting. At the same time, we also believe that specific criteria should be 

established as to when such an audit initially would be warranted and, therefore, 

required. Establishing specific criteria will help ensure that current efforts are 

sustained over time and with changes in administrations. As discussed previously, 

while management already has the fundamental responsibility to maintain and assess 

internal control as a key element of properly managing a federal agency, history has 

shown that sustained financial management progress requires ongoing, active 

congressional oversight. A requirement for an auditor’s opinion on internal control 

over financial reporting would help ensure that the intended benefits of 

management’s assertion are fully realized and that the Congress, through an 

independent set of eyes, has an important tool for oversight. Additionally, once 

effective internal control over financial reporting has been established, as evidenced 

by an unqualified opinion, the cost of the requirement may be mitigated by 

implementing a multiyear cycle for the audit opinion on internal control over 

financial reporting, as noted previously. 

As we stressed in our February 2005 testimony,24 the auditor’s role, similar to its 

opinion on the financial statements issued by management, would be to state whether 

the auditor agrees with management’s assertion about the effectiveness of its internal 

control so that the reader has independent assurances about management’s assertion. 

This is especially important when management asserts its internal control is 

adequate. The following are some key factors to consider when establishing criteria 

for when to require an auditor opinion on internal control over financial reporting at 

each entity. 

• Is management providing an unqualified assurance statement? If so, an auditor 

opinion can be cost effective and would serve as an independent validation of 

the reliability of management’s conclusions. 

• What is the effectiveness of management’s process for assessing internal 

control? Even though internal control weaknesses may be reported, an opinion 

can add value to the reliability of management’s process. Further, if there are 

indications that management’s process for assessing internal control is not 

effective, a targeted, limited scope review of the process could be performed 

to identify deficiencies in management’s process. 

• What is the current condition of internal control over financial reporting? The 

condition can be assessed by a number of factors, including 

• recent audit opinion findings; 

• nature of material weaknesses over financial reporting, if any; 

• reported weaknesses or noncompliance under FMFIA and the Federal 

Financial Management Improvement Act; 

• results of OMB Circular No. A-123 assessments; 

• the President’s Management Agenda “Report card” status; and 

24GAO, Financial Management: Effective Internal Control Is Key to Accountability, GAO-05-321T 

(Washington, D.C.: Feb. 16, 2005). 
Page 17 GAO-06-255R Cost and Benefit Review of Internal Control Audits

• percentage or amount of improper payments reported under the 

Improper Payments Information Act. 

• Is the agency demonstrating measurable improvements in its internal control? 

If not, OMB may encourage progress by requiring an audit on internal control 

over financial reporting, as it may assist agencies to identify and prioritize 

solutions to long-standing internal control weaknesses. 

As stated previously, set criteria for when an agency should initially require audits of 

internal control over financial reporting would be more cost effective and efficient in 

many cases. For example, DOD has many known material internal control 

weaknesses. Of the 25 areas on GAO’s high-risk list, 14 relate to DOD, including DOD 

financial management. DOD management is currently working on a long-term plan to 

remediate its weaknesses, and today it is clearly not even close to being in a position 

to state that the department has effective internal control over financial reporting. 

Therefore, little, if any, additional work would be needed for an auditor to render an 

opinion that internal control over financial reporting was not effective. Thus, the joint 

study’s reported estimate of about $84 million for a DOD internal control opinion 

does not appear to reflect a reasonable approach to DOD’s current situation, and the 

DOD Inspector General would likely not even contemplate undertaking such an effort 

at this time. On the other hand, for fiscal year 2005, SSA management reported that 

SSA had adequate internal control over financial reporting. The auditor’s unqualified 

opinion on internal control over financial reporting at SSA for fiscal year 2005 

provided an independent assessment of management’s assertion about internal 

control, which we believe by its nature adds value and credibility similar to the 

auditor’s opinion on the financial statements and provides an external check on the 

effectiveness of internal control and accountability at SSA. 

As noted in the joint study, in deciding when to require an opinion on internal control 

over financial reporting, the facts and circumstances of individual agencies should be 

considered on a case-by-case basis. For example, as in the case of the recently 

enacted internal control audit requirement at DHS, the Congress may have particular 

oversight concerns that could be addressed by an internal control audit. As discussed 

earlier, because DHS is a new agency comprising numerous entities, the requirement 

for an internal control audit at this time should be beneficial to both management and 

congressional oversight. Similar to DOD, DHS has many documented internal control 

weaknesses, the number and nature of which are so serious they should minimize any 

additional work and incremental cost necessary to issue an adverse opinion on 

internal control over financial reporting. On the other hand, it is likely that the 

requirement for an internal control audit has expedited DHS management’s 

development of remediation plans to correct DHS’s internal control weaknesses. In 

any event, while DHS continues toward remediation of its internal control 

weaknesses, the current incremental cost to render an opinion on DHS’s internal 

control over financial reporting should be minimal. 

Conclusions 

As the Congress and the American public have increased demands for accountability, 

the federal government must respond by having a high standard of accountability for 
 Page 18 GAO-06-255R Cost and Benefit Review of Internal Control Audits 

its programs and activities. We view auditor opinions on internal control over 

financial reporting as an important component of monitoring the effectiveness of an 

entity’s risk management and accountability systems. OMB’s efforts to enhance 

Circular No. A-123 through the December 2004 revision and its continued efforts to 

improve the quality of internal control in the federal government financial 

management environment reflect substantial progress in both the criteria and 

expectations for this issue. History, though, has proven that the execution of laws 

and regulations needs to be monitored to effectively implement and maintain 

financial management improvement in the federal government. To that end, specific 

criteria to ascertain when an agency should initially be required to obtain an audit 

opinion on its internal control over financial reporting are critical to ensuring that the 

internal control audits fully contribute to the overarching goal of ongoing 

improvement in federal agency internal control and accountability. Additionally, 

implementing a multiyear cycle for an opinion on internal control over financial 

reporting could assist in mitigating the cost of the requirement while still providing an 

effective quality control mechanism for ascertaining that management’s assessment 

of its internal control is reliable. The benefits identified in the joint study along with 

the additional benefits we identified, although not quantifiable in monetary terms, 

clearly indicate that having set criteria as to when an agency should initially be 

required to obtain an auditor opinion on internal control over financial reporting 

would be a key oversight mechanism for the Congress and ultimately the American 

taxpayer. 

Recommendations for Executive Action 

To ensure that audit opinions on agency internal control over financial reporting are 

obtained at the proper time and for a reasonable cost, we recommend that the 

Director, Office of Management and Budget, as a function of OMB’s financial 

management leadership role, (1) develop specific criteria related to when an agency 

should initially be required to obtain an opinion on internal control over financial 

reporting and (2) consider establishing criteria whereby an agency would qualify for a 

multiyear cycle for obtaining an audit opinion on internal control over financial 

reporting, rather than an annual cycle. Such criteria should address the overarching 

goal of ongoing improvements in federal agency internal control and also consider 

the facts and circumstances of individual agencies and oversight needs. 

Agency Comments and Our Evaluation 

In comments on a draft of this report, reprinted in enclosure IV, OMB’s Deputy 

Director for Management agreed with the ultimate goal of improving internal control 

in the federal government. While not specifically addressing our two 

recommendations, OMB indicated that the most effective and efficient path toward 

the goal is to give agencies reasonable time to fully implement the requirements of 

the revised OMB Circular No. A-123 before considering additional requirements. As 

noted in our report, we agree that agencies should be given the opportunity to 

implement the revised Circular No. A-123 before there is an across-the-board 

requirement to obtain an audit opinion on internal control over financial reporting. 
Page 19 GAO-06-255R Cost and Benefit Review of Internal Control Audits

OMB also provided technical comments, which we reviewed and incorporated as 

appropriate. 

_ _ _ _ _

We are sending copies of this report to other interested congressional committees 

and to the Deputy Director of the Office of Management and Budget, who chairs both 

the CFO Council and the PCIE. Copies will be made available to others upon request. 

In addition, this report will also be available at no charge on GAO’s home page at 

http://www.gao.gov. 

If you or your staffs have any questions regarding this report, please contact me at 

(202) 512-9095 or at williamsm1@gao.gov. Contact points for our Offices of 

Congressional Relations and Public Affairs may be found on the last page of this 

report. Major contributors to this report include Casey Keplinger, Assistant Director; 

Cherry Clipper; Francine DelVecchio; Gabrielle Fagan; and Tim Guinane. 

McCoy Williams 

Director, Financial Management and Assurance 

Enclosures – 4 
Page 20 GAO-06-255R Cost and Benefit Review of Internal Control Audits 

Enclosure I 

Joint Study by the Chief Financial Officers Council and the President’s 

Council on Integrity and Efficiency on Estimating the Costs and Benefits of 

Rendering an Opinion on Internal Control over Financial Reporting 
Page 21 GAO-06-255R Cost and Benefit Review of Internal Control Audits

Enclosure I 
Page 22 GAO-06-255R Cost and Benefit Review of Internal Control Audits 

Enclosure I 
Page 23 GAO-06-255R Cost and Benefit Review of Internal Control Audits

Enclosure I 
Page 24 GAO-06-255R Cost and Benefit Review of Internal Control Audits 

Enclosure I 
Page 25 GAO-06-255R Cost and Benefit Review of Internal Control Audits

Enclosure I 
Page 26 GAO-06-255R Cost and Benefit Review of Internal Control Audits 

Enclosure I 
Page 27 GAO-06-255R Cost and Benefit Review of Internal Control Audits

Enclosure I 
Page 28 GAO-06-255R Cost and Benefit Review of Internal Control Audits 

Enclosure I 
Page 29 GAO-06-255R Cost and Benefit Review of Internal Control Audits

Enclosure I 
Page 30 GAO-06-255R Cost and Benefit Review of Internal Control Audits 

Enclosure I 
Page 31 GAO-06-255R Cost and Benefit Review of Internal Control Audits

Enclosure I 
Page 32 GAO-06-255R Cost and Benefit Review of Internal Control Audits 

Enclosure I 
Page 33 GAO-06-255R Cost and Benefit Review of Internal Control Audits

Enclosure I 
Page 34 GAO-06-255R Cost and Benefit Review of Internal Control Audits 

Enclosure I 
Page 35 GAO-06-255R Cost and Benefit Review of Internal Control Audits

Enclosure I 
Page 36 GAO-06-255R Cost and Benefit Review of Internal Control Audits 

To access the Joint Study, see www.ignet.gov/randp/rpts1.html#2005. 
Page 37 GAO-06-255R Cost and Benefit Review of Internal Control Audits
Page 38 GAO-06-255R Cost and Benefit Review of Internal Control Audits 
Page 39 GAO-06-255R Cost and Benefit Review of Internal Control Audits
Page 40 GAO-06-255R Cost and Benefit Review of Internal Control Audits 
Page 41 GAO-06-255R Cost and Benefit Review of Internal Control Audits

Enclosure II 

PCIE Survey – “Estimated Audit Costs of Opining on Your Agency’s Internal 

Control over Financial Reporting in Accordance with AT§501 of the 

Professional Standards and Related Information” 
Page 42 GAO-06-255R Cost and Benefit Review of Internal Control Audits 

Enclosure II 
Page 43 GAO-06-255R Cost and Benefit Review of Internal Control Audits

Enclosure III 

Two Additional Questions Asked of the CFOs and IGs about the Expected 

Benefits of Circular A-123 and Obtaining an Opinion on Internal Control 
Page 44 GAO-06-255R Cost and Benefit Review of Internal Control Audits 

Enclosure IV 

Comments from the Office of Management and Budget 

(195089) 
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately. 
GAO’s Mission The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To

have GAO e-mail you a list of newly posted products every afternoon, go 

to www.gao.gov and select “Subscribe to Updates.” 

The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548 

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Mail or Phone 

To Report Fraud,

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

PRINTED ON RECYCLED PAPER